Masters of Imitation: How Modern Hackers channeled the "Art" of the Forger

TL;DR

The cybersecurity landscape has entered the "Age of Imitation." Taking a page from infamous art forger Elmyr de Hory, modern attackers are using AI and malware-free techniques to mimic legitimate network behavior. With 81% of attacks now utilizing "Living-off-the-Land" (LotL) tactics, organizations must look beyond signatures and use Network Detection and Response (NDR) to spot the subtle behavioral "fingerprints" of digital impostors.

The art world has spent decades unmasking impostors, and the history of high-stakes forgery offers a startlingly accurate blueprint for modern cybersecurity.

During the 1960s, Elmyr de Hory became the world’s most infamous art forger by passing off over a thousand counterfeit masterpieces by Picasso, Matisse, and Renoir. He didn't just copy paintings; he exploited the trust of experts by using old canvases, period-accurate pigments, and reputable provenance.

Today, Security Operations Centers (SOCs) face a digital mirror of this challenge. We are firmly in the Age of Imitation, where attackers—armed with AI—no longer rely on blatant malware. Instead, they master the art of the familiar, posing as trusted users and masking malicious intent within ordinary network traffic.

The Rise of Mimicry: 81% of Attacks are Malware-Free

Just as de Hory's work slipped past experts who relied on trusted signatures, modern attackers are bypassing traditional defenses. According to CrowdStrike’s 2026 Global Threat Report, 81% of attacks are now malware-free.

These "Living-off-the-Land" (LotL) tactics involve using legitimate tools and credentials already present in the environment. By avoiding the deployment of suspicious files, attackers make their presence nearly indistinguishable from everyday administrative tasks.

The Field Guide to Network Fakery

Cyberattackers have developed a sophisticated "gallery" of deceptive techniques designed to fool even the most vigilant defenders:

1. Agentic AI-Assisted Actors

De Hory used a complex global network of dealers and pseudonyms to sell his forgeries. Modern attackers use Agentic AI—autonomous or semi-autonomous agents—to do the same at scale. These agents:

Generate fake identities and believable exploit code.
Observe network behavior to "tune" their traffic, ensuring C2 (Command and Control) communications coincide with legitimate spikes in activity.
Use legitimate agents as orchestrators to automate and scale attacks.

2. Supply Chain and Cloud Impostors

In a digital twist on de Hory's reused canvases, attackers now compromise software supply chains. Research into the Shai Hulud v2 worm revealed how attackers modified hundreds of software packages to harvest developer credentials. By impersonating legitimate updates, these "fakes" propagate through trusted internal shares, making the origin of the exploit nearly impossible to trace.

3. Cloaked Tunnels and Rogue Infrastructure

To evade detection, de Hory moved constantly from city to city. Modern hackers employ "Rogue Infrastructure," spinning up lookalike servers and domains to lure users. Recent research shows actors using fake Microsoft Teams meeting messages to lead victims to credential-harvesting sites that mirror legitimate login pages. Attackers also use IP tunnels to hide malicious conversations inside allowed protocols, often lying dormant for months before striking.

Exposing the Fakes with Network Detection and Response (NDR)

History shows that forgers are eventually caught when experts stop looking at the signature and start looking at the style. De Hory was exposed when experts compared multiple works and identified stylistic fingerprints he couldn't hide.

Similarly, Network Detection and Response (NDR) allows SOCs to identify the "digital brushwork" of an attacker. NDR exposes malicious activity by:

Detecting Behavioral Anomalies: Identifying deviations from established baselines, such as atypical data transfers or lateral movements that occur even when using "legitimate" credentials.
Revealing Protocol Inconsistencies: Spotting mismatches like traffic to homograph domains (lookalike characters in URLs) or encrypted sessions with suspicious certificate details.
Providing Context: Enriching raw traffic with metadata to help analysts separate real threats from background noise, allowing them to test hypotheses about an ongoing attack.

Conclusion

As we navigate the Age of Imitation, mimicry has become the new normal. Attackers are no longer just "hacking" systems; they are imitating them. To defend the modern enterprise, security teams must move beyond static signatures and adopt a layered defense that includes behavioral visibility. By watching for the subtle patterns that even AI cannot perfectly mask, defenders can unmask the digital de Horys of the 21st century before they complete their "masterpiece."

Source: The Hacker News | Masters of Imitation: How Hackers and Art Forgers Perfect the Art of Deception