Putting cyber threat intelligence into geopolitical context

Now a director of intelligence analysis for the Microsoft Threat Analysis Center (MTAC), Fanta and her team conduct strategic analysis of nation state cyber threat activity; essentially placing cyber threat intelligence in geopolitical context to uncover the possible “why” behind the activity.

By identifying and communicating out the “why” of a particular threat actor campaign, Fanta explains, we can better prepare and protect customers who might be vulnerable targets. For example, in the run-up to Russia’s full-scale invasion of Ukraine in 2022, our Microsoft Threat intelligence team identified Ukrainian customers at risk for cyberattack in the event of conflict escalation, based on the sectors that a nation at war would want to hit to weaken its adversary and the locations of unpatched and vulnerable systems. Establishing that monitoring practice and tipping our Ukrainian partners to vulnerabilities in advance helped threat hunting teams harden vulnerabilities, spot anomalous activity, and push product protections faster.

Unpacking the potential “whys” behind nation state intrusions involves bringing what we know about geopolitical developments, history, foreign policy goals, and current events to discussions of cyber tactics, techniques, and procedures (TTPs), and victimology. A typical day for Fanta includes following the latest international and cybersecurity news and reviewing the latest Microsoft Threat Intelligence findings with her threat-hunting colleagues, who bring different perspectives to their investigations.

Recently, Fanta and her team have been observing a rapid evolution of cyberwarfare tactics on the battlefields of Ukraine (for additional insight on hybrid warfare trends emerging from Ukraine, see 7 emerging hybrid warfare trends from Russia’s cyber war.

“This is the first time we’ve seen the deployment of cyberattacks as part of broader warfighting on this scale,” she says, “and we didn’t anticipate how big a role nonstate actors—cyber volunteers, hacktivists, and the private sector—would play in this conflict.”

To illustrate, Fanta shares how new partnerships between public and private entities have helped Ukraine defend its networks and information spaces. By hunting for threat activity, writing code to fortify security products, and blogging to raise awareness about malicious incidents of compromise (IOCs) and tactics, techniques, and procedures (TTPs), the collective efforts of Ukrainian cybersecurity professionals and international public and private communities have made work harder for threat actors attacking Ukrainian networks.