CYBERSECURITY
TRENDS 2023:
Securing our hybrid livesTABLE OF CONTENTSINTRODUCTION
3HYBRID WORK: Turning business platforms into preferred social spaces

1

4 —5

2

6—8

3

9 — 11HYBRID COMMERCE: Blurring the lines between business and pleasure

HYBRID PLAY: Leveling the playing field in online video gaming and beyond

CONCLUSION
12

www.welivesecurity.com

2

INTRODUCTION
Living a hybrid life, counting benefits and costs

clude many social apps like Facebook, WhatsApp,
LinkedIn, and Tinder, or even games like Fortnite and
VALORANT. There are too many to count, but all forecast
one reality: millions of IT users forging their hybrid lives
and recasting our definitions of security and privacy.
This super bloom of cloud-powered environments hasbrought unimagined opportunities to create, collaborate, buy, sell, and play. Going beyond the scope of previous cloud-based technologies, which first freed users
from limitations associated with hardware costs andlong intervals between updates, today’s cloud-based
environments bring transformative hybrid opportunities. And while we have gone all in on what the cloud

James Shepperd
ESET Security Editor

can do for us, unforeseen dangers await.

HYBRID LIVES POWERED BY THE CLOUD
AND SECURED BY…?
Along with great opportunities, the immersive multifeatured cloud-powered environments we’ve adopted

ESET’s predicted trend for 2023 is that the changes infor work, play, education, data storage, and connected

human behavior online, expressed in both professional

lifestyles have also opened up pathways for cybercrime.

and personal lives, will further blur the line between the

The scale of these always up-to-date platforms, withphysical world and our engineered virtual worlds. As

millions of users logged in concurrently from desktop,

security professionals, we are confronting the implica-

mobile, and Internet of Things (IoT) devices, has a handtions of these changes across the IT ecosystem, espe-

in creating a massive, shared threat surface.

cially from cloud-powered apps to which we all increasingly entrust our enjoyment, professional success,privacy, and security.

With some cloud-powered environments even offering
the rawest of material – free server space – all have thepotential to help create, house, and share vast amounts

However we got here (certainly helped along throughof personal data and intellectual property, even to mil-

COVID-19 lockdowns), we’re here now! And where islions of fellow users. Herein, this wealth of human ex-

that exactly? Likely, even now we are logged in to ourpression is simultaneously a wealth of data tempting

preferred cloud-powered environment. We are talking

everyone from average joes to entrepreneurs to sea-

about large-scale, cloud-enabled digital environments

soned cybercriminals.

like Discord, Slack, and Microsoft Teams. We could in-www.welivesecurity.com

3

1

HYBRID WORK: TURNING
BUSINESS PLATFORMS
INTO PREFERRED SOCIALSPACES
Hybrid work and hybrid play now merge into hybrid living, but where is the line
between the two? Is there one?
That the pandemic brought a new normal to businesses, educational institutions, and our everyday lives is an understatement. Many interactions,
whether work-related or personal, moved online orat least gained a virtual mirror. This virtual migration began alongside the pandemic when most people and businesses first turned to tried-and-tested
communications solutions, such as Microsoft Teams,
Slack, and Zoom, which merged rich communication
functions with collaboration and productivity tools
to help compensate for lost in-person work.
Together with Skype and Skype for Business, all were
known entities before our “new normal”; however,Alžbeta Kovaľová
ESET Security Writer

the shift to hybrid work, study, and play saw theseplatforms explode in popularity. As cloud-based solutions, shared access and files, parallel workflows, instant messaging, and more were all easily accessible.
But all ups have their downs.
Anything that becomes widely popular also becomes
attractive to attackers. This holds true of cloudbased platforms too. Cloud-based cyberattacks accounted for 20% of all cyberattacks in 2020. Because
the popularity of cloud-powered services isn’t wavering, neither is the interest of attackers. Let’s look at
three platforms mentioned above to identify a trend:apps designed for work but transformed by populardemand into a social communication platform.

www.welivesecurity.com

4

HYBRID WORK: Turning business platforms into preferred social spaces

SECURING THE CONVENIENCE OFHYBRID LIFE

Also early into the pandemic, hackers gathered morethan 500,000 Zoom usernames and passwords via an
attack known as credential stuffing before putting theMicrosoft Teams, launched in 2017, is now the fast-logins up for grabs on the dark web. Another type of is-

est-growing Microsoft app and go-to communications

sue involved security vulnerabilities, including one that

tool. Teams has seen explosive growth from early in theaffected the Zoom app for macOS and could have given

pandemic. The annual number of Teams users nearly dou-

hackers root access to macOS desktops. Fast forward

bled between 2020 and 2021, and in 2022, users numbered

to early 2022, and Google’s Project Zero team revealed

270 million, most of whom are of working age (35-54 years

a buffer overflow and an info leak vulnerability in Zoomold). The choice of many, Teams has moved beyond its in-that, before it was remedied, could have allowed threattended business setting and is now commonly used inactors to monitor Zoom meetings. Some of these issues

education and has gained a role in people’s personal lives.

were followed by reports of phishing and other social
engineering attacks, which are known for being the top

Microsoft Teams is a convenient option among com-

vector for malware delivery.

munication apps, but it is not without risks. In 2021, avulnerability was discovered in Teams that allowed malicious insiders to steal emails, Teams messages, and
OneDrive and SharePoint files. More recently, in August

INHERITING THE RISKS OF SUCCESS– A PATTERN

2022, a post-exploitation opportunity was discovered
due to Teams storing access tokens in plaintext on disk,

Similarly, the abovementioned productivity app, Slack,thus making them easier to steal should an attacker

which claims to reduce the need for emails by 32% andsomehow first manage to compromise a victimized

meetings by 27%, is also a victim of its success. This in-computer. For some, weaknesses like these indicate

stant messaging platform allows users to make voicethat cloud-based solutions are more susceptible to at-calls and video chats, and send messages and media

tacks than on-premises solutions and thus need a spe-files in private chats or as part of a community (work-

cial layer of cloud-based protection.

space). This app reports over 12 million daily users while
being compatible with all major operating systems. Ac-

Another cloud-based solution for videoconferencing

cording to one estimate, an average user is on the appthat has become a household name in recent years isfor at least 10 hours a week. Slack is used by more thanZoom. This peer-to-peer software platform saw a mas-

100,000 organizations worldwide and offers a paid tiersive boom during the pandemic as people began work-

called Slack Connect that includes a secure messaging

ing, socializing, and attending events online. Zoom

feature used by over 10,000 organizations.

seemed to be the perfect option, as it didn´t require
having an account to attend an event. It also has a free

However, Slack comes with its fair share of vulnerabil-

version with limited functionalities.

ities and risks to users too. A more recent vulnerabili-

Of course, Zoom’s wide use brought with it the atten-

a vulnerability in Slack Desktop for Windows to alterty was reported in 2019. It allowed attackers to exploit
tion of security professionals and ill-intentioned ac-

where files sent through a Slack channel are download-

tors alike. The platform has come under the spotlighted, ultimately allowing them to inject malware into thea number of times since 2020, including for privacy andfiles or steal them. This, of course, is not the first security

security issues that were not of its own making. In one

issue, as major flaws were found as early as 2015.

widely publicized issue, the former UK Prime Minister
Boris Johnson came under fire for inadvertently reveal-

One of Slack´s more obvious downsides seems to be

ing a Zoom meeting ID for a Cabinet meeting, which

its open communities feature, allowing large groups ofraised concerns about the meetings being exposed topeople to connect. Like email, Slack has become a per-a heightened risk of eavesdropping and attacks known

fect vector for phishing and spam.

as Zoombombing.

www.welivesecurity.com

5

2

HYBRID COMMERCE:
BLURRING THE LINESBETWEEN BUSINESSAND PLEASURE
It is now acceptable to find a job on a dating app!

Although many enterprises and small and medium
businesses (SMBs) take advantage of solutions suchas Slack or Microsoft Teams for collaborative work,
these platforms are still trying to figure out betterways to create meaningful interactions between
staff members. While these companies prioritize
workflow, there’s also a growing need to reinforce
social connections through a virtual company culture that enhances engagement and a feeling of belonging among workers, both with those who work
remotely and those who work in hybrid mode. These
virtual hallways are, in many ways, a needed replacement for in-between discussions that typically happen by the copier or in the office corridors.

André Lameiras
ESET Security Writer“SOCIAL” PAST ITS PEAK?
In Q4 2021, well into the pandemic, Facebook saw its
user numbers drop for the first time in 18 years – losing approximately half a million users. Though sincerebounding, did this episode signal that traditionalsocial media platforms are past their apex?

www.welivesecurity.com

6

HYBRID COMMERCE: Blurring the lines between business and pleasure

Since the internet went “social” on the wave of Web 2.0,

a new capability designed to support new content cre-around 2004, social networks started mimicking theators by giving them access to analytics and moneti-

everyday interactions of life: lists of friends with whom

zation programs, including the possibility of receiving

we could share photos, thoughts, and other multimedia

money directly from fans.

content. But while in real life you can meet one group offriends one day and another the day after, on social media they were encouraged to mix. Suddenly, it became
acceptable for work colleagues to send friend requests

WORK TRICKLING INTO OUR SOCIAL
LIVES

and, very quickly, it became awkward not to accept.
Google tried to solve this by launching Google+, a social

Running a successful business may demand an “always

network that would divide the people you connect withon” status, but to be “always on” is more than just sit-

into different circles, just like in real life. But the ideating at your PC in the office. Clearly our work is no lon-

didn’t have much success.

ger confined there. Our work is in our pockets, on our

Meanwhile, the internet got so used to Facebook that,

centration of data, data processing and creation tools

phones, and just next to our personal pictures. This conby 2015, the platform had reached 1.44 billion users and(your camera included), and communication tools, all inacquired Instagram and WhatsApp. It quickly became

one, is a big shift in how we organize our lives. Any app

the “new normal” for work colleagues to message eachdeveloper worth their salt knows this.

other about work during and after work hours, connecting employees in a way that never existed before. While

Telegram, a cloud-based instant messaging service withthis could be a positive – for example, enhancing com-over 700 million active users worldwide and with apps

pany culture – it didn’t take long for employees to startfor all devices, is also becoming an increasingly capable

discussing “the right to disconnect”; after all, no one

mobile workspace. The app allows for the creation of

wanted to receive texts about work at dinnertime or togroups and channels (like on Slack or Teams), file shar-

share vacation pictures with their bosses. And in the of-ing up to 4GB, and folders that prompt users to use theirfice, managers didn’t want employees to lose time withexisting accounts to create a dedicated space just forsocial interactions. But it was too late.

workflow, right there between the family and gaming
chats. It persistently pings users with notifications from

DEMOCRATIZING BUSINESS TOOLS

work, even during a vacation, if not turned off.
Even if some users benefit from the nascent legislation

Simultaneously, people were also starting small busi-

on the right to disconnect, everyone is affected by thenesses on Facebook, initially taking advantage of “buydata policies of their favored cloud-provided service.

and sell” groups and, from 2016, using the platform’s new

While this should be a concern for both personal andMarketplace. Freelancers started using personal pages

work data, at minimum, companies should use apps

to promote their work, teachers shared class notes, andthat encrypt data and collect only minimal data, andsmall bookshops promoted their new arrivals. Every-

preferably use apps that store all messages and media

thing was possible without even having an official busi-

locally on the user’s device.

ness account with pro features and complex analytics; it
was anyone’s game.

In parallel, there are a host of other messaging apps
being repurposed for business that several million peo-

By the end of 2020, it was already so common to do

ple use: dating apps. Surprisingly, these too are usedbusiness via these social media platforms that Facebook

for professional networking, finding new clients, hiring,launched the Facebook Business Suite app to allow

and job hunting. In 2020, at the start of the pandemic,

small businesses to manage their content, messages,

the dating app Bumble created the “Community Grants”

and analytics for Facebook and Instagram in one place.

profile, which looks just like a regular user’s profile. By

And since November 2022, all Facebook users can “re-swiping right on it, users are matched and requested topurpose” their personal profile into “professional mode”,

nominate a local SMB in need of financial support due towww.welivesecurity.com

7

HYBRID COMMERCE: Blurring the lines between business and pleasure

the lockdowns. Bumble pledges to choose 200 business-

not be a widespread problem, nothing guarantees thates and award them up to a USD$5,000 grant. While its

this is not happening at other companies. And even if

primary focus is dating, Bumble also offers a Bizz mode

the target might be a personal account, work details ex-that facilitates meetings between professionals.

changed using that account is icing on the cake once incriminal hands.

THE RISKS OF MIXING PROFESSIONAL
AND PERSONAL LIVES

Indeed, some employees might be more interesting targets than others, depending on how much data they
have access to. And that can be an important factor

Mixing business with your social life is a growing trend.

when imposing more restrictive measures on staff withTinder, for example, offers the possibility to run ads, andhigher exposure. But this can also be misleading, as ev-

many freelancers and SMB owners take advantage ofery employee in a company is connected, and it might

their personal profiles to get new customers to swipe

be easier to steal information from someone who is not

right. If a customer becomes a date, even better! Being

perceived as an obvious target.

an entrepreneur seems to be a trending characteristic.
According to a Shopify survey published last year, from

Back to that overlap between professional and person-

April 2020 to July 2021, Tinder registered a 25% increase in

al. As we go through cultural changes around how wementions of users’ entrepreneurial experiences in theircommunicate, work, and live, we can’t ignore how ourbio, which seems to be a characteristic appreciated byonline and offline lives have merged, creating new risks

71% of the app’s users.

that must be avoided by establishing clear rules.

While these apps do not allow commercial activities, aIf businesses expect employees to be available anytime,

conversation with someone self-described as a gym ad-they must be prepared to end Bring Your Own Device

dict can easily lead to being sold a personal trainer ser-policies to ensure a clear division between personal

vice; a wine exporter can try to sell a few bottles; a cof-and private life. This means giving employees dedicat-

fee shop owner will be thrilled to connect with someone

ed work devices – not just laptops, but smartphones asover a coffee.

well. Companies ensure that both they and their employees know the consequences of using the same de-

But while this could be seen as a creative solution, it canvice for both work and private life.

create real problems. Blurring use cases for apps acrossthe personal and professional can have serious conse-

Other priorities stand out too. Companies should stop

quences. Falling for a phishing scam on WhatsApp can

providing configuration profiles that employees can in-prompt the download of malware that steals both per-stall on their personal iOS devices to access their work

sonal and work messages. Dating app scammers andemail and other work platforms. On top of this, it is es-

criminals might abuse someone’s aim to network andsential to implement clear password rules to discourage

sell in order to acquire information about a business.

employees from using the same password for personal

Even in an office environment, sharing information on-

and work accounts and require multifactor authentica-line that is intended for friends but that colleagues mighttion. The future is full of amazing technologies, collab-

access – such as pictures on Facebook or your presence

oration tools, and more humanized online social expe-

on mobile apps such as Grindr or Happn – might end up

riences, but they will continue to blur the thin line thatwith unwanted attention or be used for stalking, doxing

divides different spheres of life.

or professional gain.
But there’s more. Just recently, Meta disciplined or fired
more than two dozen workers for allegedly misusing internal systems to hijack users’ accounts, in some cases
in exchange for thousands of dollars. While this might

www.welivesecurity.com

8

3

HYBRID PLAY: LEVELINGTHE PLAYING FIELD IN
ONLINE VIDEO GAMING
AND BEYOND
Does VALORANT’s approach to cheating signal a turning point in how we deal
with the continued hacks afflicting our hybrid world of work and play?

FIRST SOCIAL APPS, NOW GAMING?
So far, we can see how the growth of cloud-powered
apps like Telegram and Teams has created megacommunities out of their users. Many of these apps
have opened the door to personal self-expression
and the types of risk-taking notorious on social media platforms. Oversharing, connecting with strangers, clickbait, and phishing are now part and parcelof our work, and social and gaming lives; the lines
are far too blurred in our hybrid lives for the risks todisappear.
But what about the free server space in the cloud,
where millions of gamers, educators, and students

Rene Holt
ESET Security Writer

are participating in a brave new world of digital possibility and risk? In Discord’s now well-establishedplatform, we find a kind of “natural selection” manipulated by moderators and bots, and an “evolution”
happening in real time as communities adapt to newmembers’ expectations for performance, fun, profitability, gameplay, fairness, and security.

www.welivesecurity.com

9

HYBRID PLAY: Leveling the playing field in online video gaming and beyond

THE GAMEPLAY ATTRACTION
What is Discord?
Born as a communication platform for the gamer
community, Discord offers any community a cloudserver with text and voice channels, along withscreen sharing and file upload capabilities. Eachcommunity can set its own rules for and moderate
how members interact with each other. Discordeven offers developers a programming interface
for creating bots and webhooks. Because of its
rich collaboration features, threat actors haveincreasingly been abusing Discord for malware
distribution, data exfiltration, and Command andControl (C&C) communication.

VALORANT is attractive because it demands accountability. If a player dodges the queue, goes Away From
Keyboard (AFK), or commits friendly fire, the game
may impose a penalty of a timeout or a loss of points.
Repeated offenses merit increasing penalties.
The game also demands fairness. Players can go up
against each other in Competitive matches only if they
are of similar rank and skill. Smurfing, where experienced players go on a killing spree of amateurs to boost
their stats, is limited by requiring Account Level 20 toplay competitively.
Finally, VALORANT promotes skill and teamwork. As
novices, players hone their aim, the different Agents’special abilities, and their familiarity with the gameTo highlight the changes taking place in the gaming

maps. But as more experienced players, who each havespace, let’s look at what the members of one of Discord’s

a similarly high level of aim, teamwork and strategy be-largest gaming communities have been up to in theircome increasingly critical to winning matches.

hybrid lives – sharing their passion for VALORANT while
fighting against the tide of cheating spreading acrossthe gaming landscape.

PROTECTING THE GAME WITH
ANTI-CHEAT SOFTWAREVALORANT: GAINING POPULARITY IN
A HYBRID WORLDAll of this effort to promote fair, competitive gameplay
is safeguarded by requiring players to run the anti-cheat
software Vanguard at the same time as VALORANT. Van-

For some businesses, 2020 brought lockdowns that trig-

guard uses a kernel-mode driver to identify vulnerable

gered a renewed look at the cloud as a transformation

drivers on the gamer’s computer and either block themneeded for business continuity. But for others, like Riotfrom running or prevent VALORANT from running. Since

Games, who had already been using the cloud as thethis driver runs when the computer boots up, it can de-core enabler for their business model, plans rolled aheadtect attempts to load cheats prior to starting the game.

with Riot Games releasing VALORANT, a free-to-play

Vanguard also has a user-mode client application thatonline multiplayer first-person shooter. Two years later,

monitors gameplay for the use of cheats such as aimbots.

around 700,000 fans are playing this game daily, and amillion have joined the official VALORANT Discord server

Cheating is also handled by the security features built into

– making it the most popular server since August 2022.

VALORANT. For example, the game uses a Fog of War system to prevent wallhacks, where cheaters see opponents

Does the rapid growth of VALORANT’s popularity in-through walls. The punishment for cheating could go as

dicate uniquely attractive gameplay? If yes, how has

far as a hardware ban of the cheater’s computer.

VALORANT approached the perennial problem of cheating? Finally, how will this approach affect other parts ofour hybrid, cloud-enabled world, and is there a link?

www.welivesecurity.com

10

HYBRID PLAY: Leveling the playing field in online video gaming and beyond

The discussions around this aggressive approach toof cheating. Cheats are the plague of the esports world,

the tech’s implementation and how players feel about

just as malware is of the internet. Indeed, the relation-

the implications to the independent function of their

ship runs deeper because the development of cheats

PCs have been active. Although some may criticize an-requires the same tools and know-how used by vulner-

ti-cheat software as spyware, putting the Vanguard

ability researchers and malware developers. Some evenclient application under the microscope of a detection

consider cheat development as the gateway drug toand response tool like ESET Inspect reveals a different

malware development.

picture. The ESET Inspect console only flags Vanguard
injecting a thread into the virtual address space of theThis places anti-cheat software in a comparable role to

VALORANT process, thus giving Vanguard a deep looksecurity software and, indeed, in the same role of con-into VALORANT. Considering the purpose of anti-cheat

fronting some of the same exploitation techniques usedsoftware, this is an entirely unsuspicious action.

by malware authors. Tackling the problem of cheats
thus has strong parallels with tackling the problem of

Figure 1 shows vgc.exe, the Vanguard client executable,

malware, requiring the identification and monitoring oftriggering a CodeInjection event affecting valorant.

the techniques used to gain an illicit advantage or con-exe, the game executable.

trol over another.

Ultimately, the attractiveness of VALORANT lies in its

As we progress in a world transformed by the continued

focus on skill development, teamwork, and strategy to

cloudification of traditionally offline activities, holding

win matches – a focus that is secured by its strong ap-

cheaters and hackers accountable will be critical to se-proach against cheating and sabotage.

curing that progress. Only in this way can the excitement of the game, or whatever hybrid activity we par-RIPPLING EFFECTS IN A HYBRID
WORLD

ticipate in, keep its unalloyed appeal.

The shift from playing games offline to an age of online
multiplayer games and esports has dragged in the curse

Figure 1. ESET Inspect reveals Vanguard injecting a thread into the VALORANT process

www.welivesecurity.com

11

CONCLUSION
With multiple cloud-powered apps in both our hands

All these cloud-powered apps, platforms, and environ-and pockets, we have crossed a threshold – one that isments have created mega communities out of their us-

taking us to a new dimension of how we work, socialize,

ers, with one of the largest being gamers. And whereand play. However, we are not just passive spectators

are the gamers? Well, probably on Discord servers forcaught up in a web of virtual environments, but active

their favorite games. But just as the cyberbattle against

participants who create our own communities and in-hacks threatening our hybrid lives persists, so does thefluence the shapes of others. Escaping this hybrid life isbattle against cheating in games. It is a phenomenon

almost unimaginable, perhaps leaving only one option:

looking at itself in the mirror.

striking forth boldly … but with caution.
Can the gaming community’s response to cheating be
After all, we’ve seen the slew of security issues affecting

instructive for our own hybrid world? Using anti-cheatbusiness apps like Teams, Zoom, and Slack. Even though

software is one approach, but are there broader impli-

remedied, we should not think these types of issues

cations to in-game surveillance by algorithms that mon-have been tidied up and are of no further concern. The

itor behavior, relationships, and playing patterns? The

hybrid workplace we live in is imbued with the power ofsame question is potentially applicable beyond gaming,

metamorphosis. What began as work apps have trans-

regardless of the cloud-powered environment we might

formed into social communication platforms, meaning

belong too.

that a whole new vector for security and privacy risks
has penetrated this landscape.

By running through these popular cloud-powered apps,

With the move of business into the social sphere, theseshown how deeply we have become entrenched in ourplatforms, environments, and games, we hope to haveplatforms have their work cut out. But they are not alone

hybrid lives. Although fusion can improve our humanin this task. They represent one force competing inside aand social experience, it is a reminder that well-defined

melting pot of platforms. Popular communication apps

limits can help ensure we continue to enjoy the benefits

like Facebook, Telegram, and Bumble are another force.

via a continued focus on privacy and security, just like

Originally social apps but, again, imbued with the pow-

we do in the physical world.

er of metamorphosis. We see them being repurposed
for business users, bringing both success and new cyberrisks in their wake.

www.welivesecurity.com

12