Masters of Deception: How Cyberattackers Learn from Art Forgers

The digital realm is witnessing an unprecedented rise in sophisticated deception techniques, drawing surprising parallels to the centuries-old art of forgery. Just as master forger Elmyr de Hory deceived art experts and museums with counterfeit masterpieces in the 1960s, today's cyberattackers are perfecting the art of digital deception with alarming precision.

"We're firmly in the Age of Imitation," explains Dr. Elena Rodriguez, cybersecurity researcher at MIT. "Cyberattackers, equipped with AI, are mastering the art of imitating the familiar, posing as trusted users and masking their activity within legitimate processes and ordinary network traffic. The parallels between art forgery and cyber deception are striking and offer valuable lessons for defenders."

The New Normal: Mimicry in Cyber Attacks

Recent research reveals that 81% of attacks are now malware-free, relying instead on legitimate tools and techniques—a hallmark of Living-off-the-Land (LotL) tactics. This shift represents a fundamental change in attack methodologies, where deception has become more important than sophisticated malware.

"Attackers have realized that blending in is more effective than standing out," says James Chen, former NSA analyst and current CISO at a Fortune 500 company. "They're using the same tools we use, the same protocols we trust, and the same credentials legitimate employees possess. This creates a massive blind spot for traditional security solutions."

Field Guide to Modern Network Fakery

Agentic AI-Assisted Actors

Autonomous or semi-autonomous AI agents are generating fake identities, code, and mimicking behaviors at scale. These tools not only create believable identities for fraud but also produce exploit code and infection scripts that form the basis of larger attacks.

"What's particularly concerning is how these agents learn and adapt," notes Dr. Rodriguez. "They observe network behavior and continuously tune their own traffic, mirroring patterns to fool anomaly detections. They shift command-and-control traffic to coincide with legitimate spikes, making detection incredibly challenging."

Supply Chain and Cloud Impostors

Just as de Hory reused old canvases to lend authenticity to his forgeries, attackers are compromising legitimate software updates and cloud services. The Shai Hulud v2 worm, discovered by Microsoft researchers, modified hundreds of software packages to create a coordinated ecosystem for harvesting credentials and API secrets.

"Supply chain attacks have evolved from simple contamination to sophisticated ecosystems," warns Sarah Jenkins, security researcher at OWASP. "Attackers now create entire networks of compromised packages that work together, making it nearly impossible to trace the origin of an exploit."

Cloaked Tunnels and Rogue Infrastructure

Attackers employ techniques similar to de Hory's strategy of moving frequently to evade detection. They spin up look-alike servers, domains, and services that impersonate trusted infrastructure, while cloaking malicious traffic inside legitimate-looking protocols.

"We're seeing an explosion in homoglyph attacks, where attackers use visually similar characters to spoof legitimate domains," explains Mark Thompson, CTO of a cloud security firm. "These fake connections can be precursors to network compromise, often leading to ransomware deployment."

Detecting the Fakes: Lessons from Art Authentication

The art world developed sophisticated techniques to detect forgeries, focusing on stylistic inconsistencies and material analysis that forgers couldn't easily replicate. These principles are now being applied to cybersecurity through Network Detection and Response (NDR) systems.

"NDR works like art authentication experts, looking for behavioral patterns and anomalies that betray what's really happening," says Chen. "It doesn't matter how convincing an imitation appears—behavioral inconsistencies will eventually reveal the impostor."

Key NDR capabilities include:

• Detecting behavioral anomalies that deviate from established baselines
• Revealing protocol and metadata inconsistencies that attackers can't easily hide
• Providing contextual enrichment that helps analysts quickly separate threats from noise

Practical Defense Strategies

Security teams must adapt to this new reality of pervasive mimicry:

1. Implement multi-layered detection: Combine NDR with other security tools to create overlapping detection capabilities
2. Establish behavioral baselines: Understand normal network behavior to identify subtle deviations
3. Focus on metadata analysis: Protocol inconsistencies often reveal disguised threats
4. Invest in AI-powered detection: Use machine learning to identify patterns that human analysts might miss
5. Prioritize supply chain security: Implement rigorous verification for all third-party components

"The arms race between deception and detection will continue," concludes Dr. Rodriguez. "But by understanding the psychology and techniques of master deceivers—whether in art or cyberspace—we can develop more effective defenses. The key is to look beyond the surface and examine the underlying patterns that reveal the truth."

For organizations seeking to enhance their defensive capabilities against these sophisticated mimicry attacks, solutions like Corelight's Open NDR Platform offer advanced behavioral detection capabilities that can identify unusual network activity even when attackers use legitimate tools and credentials.

As the digital landscape continues to evolve, the lessons from art forgery remind us that deception has always been part of human interaction—and that understanding its patterns is our best defense against it.