Blog Cyber Deception Uphill

How deception stops cyber threats before they land

The invisible war over your crown jewels

Picture this. A European financial institution discovers that an attacker has had access to their SWIFT* system for months. Not to steal money, but to study transaction patterns for a large fraud still to come. That is close to what happened during a major SWIFT fraud in 2016*, where attackers moved $81 million by abusing compromised credentials*. The awkward part: the bank ran SIEM and EDR and had a SOC team*, and the attack surfaced only once the money had left.

Or take the SolarWinds attack in 2020*, where a state-sponsored group (probably APT29*) stayed unnoticed for months inside government and corporate networks. The attacker used living-off-the-land techniques* and stolen credentials, so the traditional tooling raised no alarms until it was too late.

Deception technology* could have made a difference in both cases. Realistic fake environments give an organisation the chance to detect the attack before it succeeds.

“The first time we tested this at a customer, we were surprised ourselves at how quickly attackers walked into the trap,” a security architect told me. “Within a week we had detected three serious attempts, all of them before they could do any damage.”

Deception is no miracle cure. Here too you have to know what you are doing and where you place the traps. Experience says it offers the best chance of catching an attack early.

The problem: why traditional security fails against targeted attacks

1. The quiet theft of the crown jewels

During the 2020 attack on a large law firm, attackers turned out to have had access to confidential M&A documents for months without the EDR or the SIEM noticing. The attacker used no malware, only legitimate tools such as RDP and SharePoint. The same pattern as SolarWinds, where living-off-the-land techniques kept the activity below the detection line.

“We ran CrowdStrike and had a SOC team, and the attack was found only once the damage was done. The problem wasn’t a lack of tools. We simply weren’t seeing what we needed to see.”

2. Financial institutions as stepping stones

In the 2016 SWIFT fraud, attackers used a compromised service provider to get into a bank’s network. From there they moved laterally to other financial institutions, abusing secured SWIFT connections to transfer money. The fraud came to light when the central bank reported suspicious transactions.

The same thing showed up in the 2019 attack on a European bank: attackers use legitimate systems as a springboard, while traditional tooling has no view of the intent behind the activity.

“Our SIEM saw the transactions. What it didn’t see was that they were part of a larger attack.”

3. Sabotage of critical infrastructure

In the 2021 attack on a US water treatment plant, an attacker tried to sabotage SCADA systems through TeamViewer access obtained via a third party. As with SolarWinds, the attacker used stolen credentials and legitimate OT protocols, so EDR and SIEM stayed quiet.

The attack was detected when a fake PLC controller, a deception trap, was approached. That happened before the attacker could shut down the pumps.

“Without deception we would have been blind to this attack. The attacker was using tools that were already in our network, which is why our EDR didn’t see him.”

The answer: how deception stops attacks before they succeed

1. Fake R&D documents and databases against theft

In the 2021 attack on a pharmaceutical company, R&D data about a new drug was stolen. Against that pattern, an organisation can place honeytraps around its crown jewels. Think of fake documents named “Clinical_trial_results_Q3.xlsx” or “New_drug_formula.docx”. The moment an attacker tries to open one, an alert fires and the security team can protect the real data.

“We didn’t know who was spying on us. Thanks to the deception trap we did know that someone was trying to take our crown jewels.”

Put plainly: if you want to know what is really happening in your network, deception is one of the few tools that tells you, without you having to get hacked first to find out.

2. Fake SWIFT and interbank connections against financial fraud

In the 2016 SWIFT fraud, fake SWIFT servers and false transaction logs could have surfaced the attack earlier. When an attacker comes in through a compromised service provider, he walks into the fake environment first. The team can then block the attack before any money moves.

“The attacker thought he had access to our real system. In reality every step he took was monitored. We knew exactly what he was after and which techniques he used, and therefore how to protect ourselves against it.”

3. Fake SCADA and OT systems for critical infrastructure

In the 2021 attack on the US water treatment plant, fake PLC controllers and fake HMI interfaces could have caught the attack before the attacker reached the pumps. The moment someone tries to approach those systems, the attack is detected within seconds and the team can shield the real ones.

“Without deception we would have been blind to this attack. The attacker was already in our network and moving laterally with legitimate protocols. Our EDR didn’t see him. The extra deception layer did.”

Three lessons for organisations that want to stop targeted attacks

1. Place your traps where attackers are likely to look

Financial institutions: fake SWIFT servers, false transaction logs and honeytraps in correspondent banking systems, as in the 2016 SWIFT fraud.

Critical infrastructure: fake SCADA systems, fake PLCs and canary tokens in OT networks, as in the 2021 water treatment attack.

Knowledge-intensive companies: honeytokens in R&D documents, false database entries and fake API keys in cloud environments, as in the 2021 pharmaceutical attacks.

“Deception is there to detect the attacks your SIEM and EDR miss, rather than to stop every attack.”

2. Use deception to generate threat intelligence

When an attacker walks into a trap, the system automatically delivers information about:

  • Which tools he uses (Cobalt Strike, Metasploit, or legitimate tools such as PowerShell, as in SolarWinds)
  • Which TTPs he applies (lateral movement over WMI or RDP, as in the 2017 Maersk attack)
  • Which C2 servers he tries to reach

That information goes straight into:

  • Firewall rules (block traffic to this C2 domain)
  • EDR policies (block PowerShell scripts calling these specific functions)
  • SOC training on new attack patterns

“Every time an attacker walks into our deception environment we learn something new about how he works. That improves our defence, for this attack and for the next one.”

3. Integrate deception with your SIEM and SOAR for automatic response

When a trap fires, it should raise an incident automatically in your:

  • SIEM (Splunk, QRadar, Microsoft Sentinel)
  • SOAR (Phantom, Demisto, Fortinet SOAR)
  • EDR or XDR (CrowdStrike, SentinelOne)

An insurance company integrated their deception layer with Splunk ES. When an attacker touched a honeytoken, a high-priority incident was created automatically, with the context attached: IP address, tools used, timestamp. The SOC team responded within 10 minutes.

“The integration with our SIEM means we know that an attack is running and also exactly how to respond.”

Conclusion: defence that starts earlier

Theft of intellectual property, financial fraud, sabotage of critical infrastructure: in each of these, traditional security tends to arrive late.

Deception technology offers a way to detect attacks in their early stages, while there is still time to stop them.

For organisations that want to get ahead of this, the first steps are:

  1. Identify your critical assets: sensitive data, financial systems, OT infrastructure
  2. Place deception traps where attackers are likely to look
  3. Integrate with your existing tooling for automatic detection and response

“The best defence is knowing where the attacker is, before he knows that you have already spotted him. That is what deception gives you: sight of the invisible threat.”

Footnotes

SWIFT system: the global network banks use for international transfers. Attackers target it because it opens onto large money flows.

SWIFT fraud 2016: an attack in which hackers stole $81 million from Bangladesh Bank by initiating false SWIFT transactions. It showed how late traditional security reacts to advanced fraud.

Compromised credentials: stolen login details (passwords, API keys) that let attackers into systems legitimately, without detection.

SIEM (Security Information and Event Management): a system that collects and analyses log files to detect threats. Strong on known attacks, weaker on unknown ones.

EDR (Endpoint Detection and Response): a tool that monitors endpoints such as laptops and servers for suspicious activity. It often detects an attack once it has already started.

SOC team (Security Operations Center): a team of security specialists monitoring threats and responding to incidents around the clock.

SolarWinds attack (2020): a supply chain attack in which hackers, probably Russian, used compromised software updates to reach government and corporate networks. It went unnoticed for months.

APT29 (Cozy Bear): a Russian state-sponsored group known for targeted attacks on governments and critical infrastructure, often using living-off-the-land techniques.

Living-off-the-land techniques: to avoid detection, attackers use legitimate tools such as PowerShell and WMI that are already present in a network. Traditional security rarely flags this as suspicious.

Sources

Selling this to a board

Explaining deception to a security team is one conversation. Explaining it to the people who sign for it is another. That second one is what I do. Get in touch if your team is having it.

 

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Posts