Microsoft Digital Defense Report 2022

Cybercrime continues to rise, driven by dramatic increases in both random and targeted attacks. We have observed increasingly diverse threats in the digital landscape with developments in cyberattack methods and criminal infrastructure used to augment the kinetic war during the Russian invasion of Ukraine.

Ransomware attacks pose an increased danger to all individuals as critical infrastructure, businesses of all sizes, and state and local governments are targeted by criminals leveraging a growing cybercriminal ecosystem. As ransomware attacks have become more audacious in scope, their effects have become more wide-ranging. A sustainable and successful effort against this threat will require a whole-of-government strategy to be executed in close partnership with the private sector.

Upon analysis of our response and recovery engagements, we consistently found weak identity controls, ineffective security operations, and incomplete data protection strategies among the impacted organizations.

This year saw a significant increase in indiscriminate phishing and credential theft to gain information which is sold and used in targeted attacks such as ransomware, data exfiltration and extortion, and business email compromise.

Cybercrime as a service (CaaS) is a growing and evolving threat to customers worldwide. The Microsoft Digital Crimes Unit (DCU) observed continued growth of the CaaS ecosystem with an increasing number of online services facilitating cybercrimes, including business email compromise (BEC) and human-operated ransomware. CaaS sellers increasingly offer compromised credentials for purchase and we’re seeing more CaaS services and products with enhanced features to avoid detection.

Attackers are finding new ways to implement techniques and host their operational infrastructure, such as compromising businesses to host phishing campaigns, malware, or use their computing power to mine cryptocurrency. Internet of Things (IoT) devices are becoming an increasingly popular target for cybercriminals using widespread botnets. When routers are unpatched and left exposed directly to the internet, threat actors can abuse them to gain access to networks, execute malicious attacks, and even support their operations.

Hacktivism was on the rise over the past year, with private citizens conducting cyberattacks to further social or political goals. Thousands of individuals were mobilized to launch attacks as part of the Russia-Ukraine war. While it remains to be seen whether this trend will continue, the technology industry must come together to design a comprehensive response to this new threat.

In the past year, there has been a shift among nation state cyber threat groups from exploiting the software supply chain to exploiting the IT services supply chain, targeting cloud solutions and managed services providers to reach downstream customers in government, policy, and critical infrastructure sectors.

As organizations strengthen their cybersecurity postures, nation state actors have responded by pursuing new and unique tactics to deliver attacks and evade detection. The identification and exploitation of zero-day vulnerabilities is a key tactic in this effort. The number of publicly disclosed zero-day vulnerabilities over the past year is on par with those from the previous year, which was the highest on record. Many organizations assume that they are less likely to be a victim of zero-day exploit attacks if vulnerability management is integral to their network security. However, the commoditization of exploits is leading them to come at a much faster rate. Zero-day exploits are often discovered by other actors and reused broadly in a short period of time, leaving unpatched systems at risk.

We have seen a growing industry of private sector offensive actors, or cyber mercenaries, that develop and sell tools, techniques, and services to clients – often governments – to break into networks, computers, phones, and internet-connected devices. While an asset for nation state actors, these entities often endanger dissidents, human rights defenders, journalists, civil society advocates, and other private citizens. These cyber mercenaries are providing advanced “surveillance as a service” capabilities which many of the nation states would not have been able to develop alone.

There is an increasing sense of urgency to respond to the rising level of threats in the digital ecosystem. The geopolitical motivations of threat actors have demonstrated that states have escalated their use of offensive cyber operations to destabilize governments and impact global trade operations. As these threats increase and evolve, it’s crucial to build cyber resilience into the fabric of the organization.

As we have seen, many cyberattacks are successful simply because basic security hygiene has not been followed. The minimum standards every organization should adopt are: