Cyberattackers, increasingly state-linked criminal groups, are not merely extracting information. They are orchestrating multifaceted campaigns designed to disrupt operations, extract leverage, and erode competitive advantage.
Putting an exclamation point on the emerging threats, the U.S. State Department launched the Bureau of Emerging Threats on Monday (March 23) to counter cyberattacks from criminals including Iran-affiliated groups.
Enterprise systems offer cybercriminals asymmetric leverage. They are trusted by design, often undermonitored, and deeply integrated. But a single vulnerability in a VPN, firewall, or virtualization layer can unlock entire networks to cause cascading disruptions.
See also: Middle East Conflict Raises Cyber Risk for Businesses
The medical device company Stryker, for example, suffered a cyberattack this month that wiped more than 200,000 devices worldwide by exploiting the company’s own Microsoft system.
“Stryker is currently experiencing a Global Systems Issues. As a precaution, we are closing the 1941 facility [the headquarters in Michigan] for the day. Please stay off the network and refrain from using your computer and connecting to WiFi on phones until systems are restored. For work phones it’s recommended to remove the Stryker Management profile,” read a sign reportedly posted on the company’s headquarters March 11.
On Monday, the company reported in a Form 8-K filing to the U.S. Securities and Exchange Commission (SEC) that it had contained the situation.
The growing focus by criminals on security and networking appliances reveals an uncomfortable truth: the tools designed to defend organizations are often their weakest link. Edge devices like a company’s routers, firewalls and VPN gateways are critical yet frequently neglected.
See also: Supply Chain Cyberattack Puts Enterprise Trade Secrets at Risk
Further, attackers are bypassing hardened technical defenses altogether by targeting the one variable that remains inherently unpredictable: human behavior.
Social engineering is not new, but its scale, sophistication and strategic role have intensified. Among the most notable developments is the rise of “vishing,” or voice phishing, to manipulate employees. These campaigns are not opportunistic; they are researched, scripted and executed with a level of precision that rivals legitimate business interactions.
What makes the attacks particularly dangerous is their role as the first step in a larger chain. Vishing is rarely the end goal; it is the gateway. Once inside, attackers can deploy malware, exfiltrate data, or position themselves for future disruption. The initial interaction may take minutes, but its consequences can unfold over weeks or months.
This gets to the center of a paradox for security leaders. The more robust the technical perimeter becomes, the more attractive human targets are. They operate under varying levels of stress, context and experience. Attackers understand this variability and design their tactics accordingly. An organization’s cybersecurity posture is ultimately defined not by its technology stack, but by its employees’ judgment under pressure.