The 2023 Microsoft Digital Defense Report, spearheaded by Tom Burt, Corporate Vice President of Customer Security & Trust, provides an extensive examination of the evolving cyber threat landscape from July 2022 to June 2023. This fourth annual edition emphasizes the necessity for improved cyber defenses due to the increasing sophistication and frequency of cyber attacks, impacting trust in technology and the need for heightened security across all levels.
Key Developments in Cybercrime
The report identifies several significant trends and incidents within the realm of cybercrime:
Ransomware and Extortion
- Human-Operated Ransomware: There has been a 200% increase in human-operated ransomware attacks. These attacks are characterized by “hands-on keyboard” techniques, where attackers manually manipulate systems, using tools already present on the target system to evade detection. This method, known as “living off the land,” allows them to blend in with regular system activity. Remote encryption, where files are encrypted on one system and the encrypted versions are sent back to the target system, has also become prevalent, making it harder for traditional security measures to detect and stop the attacks.
- Data Exfiltration: Data exfiltration has doubled since November 2022. Attackers not only encrypt data but also steal it, using it to threaten victims with public release if ransoms are not paid. This tactic, known as double extortion, increases the pressure on victims to pay the ransom.
- Top Ransomware Variants: The most prevalent ransomware variants include Magniber, Lockbit, Hive, and BlackCat. Magniber, an automated ransomware variant linked to the Storm-0381 group, has expanded its reach globally since its resurgence.
- Industries Targeted: Critical infrastructure sectors, including healthcare, energy, and transportation, were the most frequently targeted. The education and manufacturing sectors also saw significant ransomware activity, often due to vulnerabilities in widely used software like PaperCut and Zoho ManageEngine.
Phishing and Identity Attacks
- Adversary-in-the-Middle (AiTM) Phishing: High-volume AiTM phishing campaigns have surged, aiming to bypass MFA by stealing session cookies and credentials through malicious proxy servers. These campaigns often involve millions of phishing emails sent within a short period, demonstrating the scale and sophistication of these attacks.
- Business Email Compromise (BEC): BEC attacks have risen dramatically, with over 156,000 daily attempts. These attacks involve the compromise of legitimate business email accounts to conduct unauthorized transactions or gather sensitive information. Methods include email conversation hijacking, where attackers insert themselves into ongoing email threads to trick recipients into divulging sensitive information or transferring funds.
Distributed Denial of Service (DDoS)
- Cloud Computing Exploitation: Cybercriminals are leveraging cloud computing resources to launch massive DDoS attacks. By using virtual machines to generate hundreds of millions of requests per second, attackers can overwhelm target systems. The scale of these attacks necessitates the use of cloud-based defenses, which can handle the immense volume of traffic.
Cryptojacking
- Cryptojacking: The unauthorized use of victims’ devices to mine cryptocurrency has been on the rise. Attackers exploit vulnerabilities in software to install mining malware, often slowing down systems and consuming significant computational resources. This activity often goes undetected, as it does not typically trigger traditional security alerts.
Nation-State Threats
The report delves into the activities of nation-state actors, highlighting their sophisticated and aggressive cyber espionage efforts:
- Russia: Continues to use cyberweapons in its conflict with Ukraine, employing destructive malware and cyber espionage tactics. This includes targeting Ukrainian infrastructure and government systems to disrupt operations and gather intelligence.
- China: Chinese actors, such as Volt Typhoon, have infiltrated critical infrastructure networks in Guam and the US using advanced “living off the land” techniques. These actors focus on long-term infiltration and intelligence gathering.
- Iran: Increased use of cyberweapons against Albania and Israel, employing pressure tactics and cyber espionage. Iranian actors have targeted critical infrastructure and government systems to exert political pressure and gather sensitive information.
- North Korea: Engages in cyber espionage and financial cybercrime, targeting various global entities. North Korean actors have been involved in high-profile attacks on cryptocurrency exchanges and financial institutions to generate revenue for the regime.
Critical Cybersecurity Challenges
IoT and OT Security
- Vulnerabilities: IoT and OT devices remain highly vulnerable to cyber attacks due to inadequate security measures and outdated systems. Many devices lack basic security features, making them easy targets for attackers.
- Supply Chain Resilience: Emphasis on enhancing supply chain security to mitigate risks associated with third-party vendors and interconnected systems. Supply chain attacks can have cascading effects, impacting multiple organizations and sectors.
Innovations in Security and Resilience
Artificial Intelligence (AI)
- AI in Cyber Defense: AI is playing a crucial role in detecting and mitigating cyber threats. Microsoft’s AI systems analyze over 65 trillion signals daily, tracking more than 300 threat actors. AI enhances the ability to detect anomalies and respond to threats in real-time.
- Responsible AI Development: Collaboration between public and private sectors to ensure the ethical use of AI in cybersecurity. This includes developing guidelines and standards for AI deployment in security applications.
Collective Defense
The report underscores the importance of collaboration across various sectors to strengthen cyber defenses:
- Cybercrime Atlas: The global Cybercrime Atlas initiative aims to revolutionize cybercrime intelligence and collaboration by mapping out the networks and tactics of cybercriminal organizations. This initiative enhances the ability to track and disrupt cybercrime operations.
- Public-Private Partnerships: Strong partnerships between government agencies, private sector entities, academia, and non-profits are essential for building resilient defenses. Collaborative efforts enable sharing of threat intelligence, best practices, and resources.
Conclusion
The Microsoft Digital Defense Report 2023 highlights the dynamic and evolving nature of cyber threats, calling for heightened awareness, advanced security measures, and continuous adaptation. The insights provided aim to help organizations build stronger defenses and navigate the increasingly digital world securely.
Key Recommendations
- Enable Multifactor Authentication (MFA): Crucial for protecting against compromised user passwords. MFA adds an extra layer of security by requiring additional verification, making it significantly harder for attackers to gain unauthorized access.
- Apply Zero Trust Principles: Limit the impact of an attack by verifying users and devices, using least privilege access, and assuming breach. This approach ensures that every access request is thoroughly vetted and minimizes the risk of lateral movement within the network.
- Explicitly Verify: Continuously validate the identity of users and the health of devices before granting access.
- Use Least Privilege Access: Provide only the necessary permissions to users, reducing the potential damage of compromised accounts.
- Assume Breach: Monitor and respond to threats as if the network is already compromised, enhancing detection and mitigation capabilities.
- Use Extended Detection and Response (XDR) and Antimalware: Implement software to detect and automatically block attacks. XDR integrates data from multiple security tools, providing comprehensive visibility and faster response to threats.
- Keep Systems Up to Date: Ensure all systems are patched and updated to prevent vulnerabilities. Regular updates and patch management are essential to protect against known exploits.
- Protect Data: Know the location of critical data and implement appropriate defenses. Data protection strategies should include encryption, access controls, and regular backups.
- Modernize Cybersecurity Skills: Invest in training and development to ensure the cybersecurity workforce is equipped with the latest skills and knowledge. This includes leveraging AI to augment human capabilities.
- Strengthen Supply Chain Security: Assess and improve the security posture of third-party vendors and partners. Implement stringent security requirements and continuous monitoring to mitigate supply chain risks.
- Engage in Public-Private Partnerships: Collaborate with government agencies, industry peers, and non-profits to share intelligence, best practices, and resources. Joint efforts enhance the collective ability to defend against sophisticated cyber threats.
Credit for the information in the Article: https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2023
