Identity is the new battleground

Cyberattacks by nation-state actors are on the rise. Despite their vast resources, these adversaries often rely on simple tactics to steal easily guessed passwords. By so doing, they can gain fast and easy access to customer accounts. In the case of enterprise attacks, penetrating an organization’s network allows nation-state actors to gain a foothold they can use to move either vertically, across similar users and resources, or horizontally, gaining access to more valuable credentials and resources.

Spear-phishing, social engineering attacks, and large-scale password sprays are basic nation-state actor tactics used to steal or guess passwords. Microsoft gains insight into attackers’ tradecraft and successes by observing what tactics and techniques they invest in and find success with. If user credentials are poorly managed or left vulnerable without crucial safeguards like multi-factor authentication (MFA) and passwordless features, nation-states will keep using the same simple tactics.

The need to enforce MFA adoption or go passwordless cannot be overstated, because the simplicity and low cost of identity-focused attacks make them convenient and effective for actors. While MFA is not the only identity and access management tool organizations should use, it can provide a powerful deterrent to attacks.

Abusing credentials is a fixture of NOBELIUM, a nation-state adversary linked to Russia. However, other adversaries, such as Iran-linked DEV 0343 rely on password sprays too. Activity from DEV-0343 has been observed across defense companies producing military-grade radars, drone technology, satellite systems, and emergency response communication systems. Further activity has targeted regional ports of entry in the Persian Gulf, and several maritime and cargo transportation companies with a business focus in the Middle East.

Enable multi-factor authentication: By so doing, they mitigate the risk of passwords falling into the wrong hands. Even better, eliminate passwords altogether by using passwordless MFA.

Audit account privileges: Privileged-access accounts, if hijacked, become a powerful weapon attackers can use to gain greater access to networks and resources. Security teams should audit access privileges frequently, using the principle of least-privilege granted to enable employees to get jobs done.

Review, harden, and monitor all tenant administrator accounts: Security teams should thoroughly review all tenant administrator users or accounts tied to delegated administrative privileges to verify the authenticity of users and activities. They should then disable or remove any unused delegated administrative privileges.

Establish and enforce a security baseline to reduce risk: Nation-states play the long game and have the funding, will, and scale to develop new attack strategies and techniques. Every network-hardening initiative delayed due to bandwidth or bureaucracy works in their favor. Security teams should prioritize implementing zero-trust practices like MFA and passwordless upgrades. They can begin with privileged accounts to gain protection quickly, then expand in incremental and continuous phases.

The dominant narrative seems to be that there are massive numbers of novel ransomware threats outstripping defenders’ capabilities. However, Microsoft analysis shows this is incorrect. There’s also a perception that certain ransomware groups are a single monolithic entity, which is also incorrect. What exists is a cyber-criminal economy where different players in commoditized attack chains make deliberate choices. They are driven by an economic model to maximize profit based on how they each exploit the information they have access to. The graphic below shows how different groups profit from various cyberattack strategies and information from data breaches.

Understand that ransomware thrives on default or compromised credentials: As a result, security teams should accelerate safeguards like implementing passwordless MFA on all user accounts and prioritizing executive, administrator and other privileged roles.

Identify how to spot telltale anomalies in time to act: Early logins, file movement, and other behaviors that introduce ransomware can seem nondescript. Nonetheless, teams need to monitor for anomalies and act on them swiftly.

Have a ransomware response plan and conduct recovery exercises: We live in the era of cloud sync-and-share, but data copies are different from entire IT systems and data bases. Teams should visualize and practice what full restorations look like.

Manage alerts and move fast on mitigation: While everyone fears ransomware attacks, security teams’ primary focus should be on strengthening weak security configurations that allow the attack to succeed. They should manage security configurations so alerts and detections are being responded to properly.

Endpoint threats:
Microsoft Defender for Endpoint blocked more than 9.6 billion malware threats targeting enterprise and consumer customer devices, between January and December 2021.

E-mail threats:
Microsoft Defender for Office 365 blocked more than 35.7 billion phishing and other malicious e-mails targeting enterprise and consumer customers, between January and December 2021.

Identity threats:
Microsoft (Azure Active Directory) detected and blocked more than 25.6 billion attempts to hijack enterprise customer accounts by brute-forcing stolen passwords, between January and December 2021.