Microsoft
Digital Defense
Report 2022
Illuminating the threat landscapeand empowering a digital defense.

01

ReportIntroduction

Microsoft Digital Defense Report 2022

Contents
The data, insights, and events in this report arefrom July 2021 through June 2022 (Microsoft
fiscal year 2022), unless otherwise noted.

For the best experience viewing andnavigating this report, we recommend
using Adobe Reader, available as a freedownload from the Adobe website.

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Report Introduction

02 Iran growing increasingly aggressive

The State of Cybercrime06

An overview of The State of Cybercrime
Introduction
Ransomware and extortion:
A nation-level threat
Ransomware insights fromfront-line responders
Cybercrime as a service
The evolving phishing threat landscape
A timeline of botnet disruption fromMicrosoft’s early days of collaboration
Cybercriminal abuse of infrastructure
Is hacktivism here to stay?

07
08

Nation State Threats

30

An overview of Nation State Threats
Introduction
Background on nation state data
Sample of nation state actors andtheir activities
The evolving threat landscape
The IT supply chain as a gateway
to the digital ecosystem
Rapid vulnerability exploitation
Russian state actors’ wartime cybertactics threaten Ukraine and beyond
China expanding global targetingfor competitive advantage

31
32
33

09
14
18
21
25
26
28

34
35
37
39
41
44

Cyber Influence
Operations

following power transition
North Korean cyber capabilities employedto achieve regime’s three main goals
Cyber mercenaries threaten
the stability of cyberspace
Operationalizing cybersecurity norms
for peace and security in cyberspace46

Devices and Infrastructure

56

An overview of Devices and Infrastructure
Introduction
Governments acting to improve criticalinfrastructure security and resilience
IoT and OT exposed: Trends and attacks
Supply chain and firmware hacking
Spotlight on firmware vulnerabilities
Reconnaissance-based OT attacks

57
58
59
62
65
66
68

Cyber Influence Operations

71

An overview of Cyber Influence Operations
Introduction
Trends in cyber influence operations
Influence operations during the COVID-19
pandemic and Russia’s invasion of Ukraine
Tracking the Russian Propaganda Index
Synthetic media
A holistic approach to protect
against cyber influence operations

72
73
74

49
52
53

76
78
80
83

Cyber
Resilience

Contributing
Teams

Cyber Resilience86

An overview of Cyber Resilience
Introduction
Cyber resiliency: A crucial
foundation of a connected society
The importance of modernizing
systems and architecture
Basic security posture is a determining
factor in advanced solution effectiveness
Maintaining identity health is fundamental
to organizational well-being

87
88

Operating system default security settings
Software supply chain centrality
Building resilience to emerging DDoS,
web application, and network attacks
Developing a balanced approachto data security and cyber resiliency
Resilience to cyber influence operations:
The human dimension
Fortifying the human factor with skilling
Insights from our ransomware
elimination program
Act now on quantum security implications
Integrating business, security, and IT for
greater resilience
The cyber resilience bell curve

Contributing Teams

89
90
92
93
96
97
98
101
102
103
104
105
106
108

110

02

ReportIntroduction

Microsoft Digital Defense Report 2022

Introduction by Tom Burt
Corporate Vice President, Customer Security & Trust“The trillions of signals we analyze
from our worldwide ecosystemof products and services reveal the
ferocity, scope, and scale of digital
threats across the globe ”

A snapshot of our landscape…

Scope and scale ofthreat landscape

Dismantlingcybercrime

Addressing
vulnerabilities

The volume of password
attacks has risen to an
estimated 921 attacks
every second – a 74%
increase in just one year.

To date, Microsoft
removed more than
10,000 domains usedby cybercriminals and
600 used by nation
state actors.

93% of our ransomware
incident response
engagements revealed
insufficient controls
on privilege access andlateral movement.

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

On February 23, 2022, the cybersecurity world
entered a new age, the age of the hybrid war.
On that day, hours before missiles were launched
and tanks rolled across borders, Russian actors
launched a massive destructive cyberattack
against Ukrainian government, technology, andfinancial sector targets. You can read more about
these attacks and the lessons to be learned
from them in the Nation State Threats chapterof this third annual edition of the Microsoft
Digital Defense Report (MDDR). Key among
those lessons is that the cloud provides the best
physical and logical security against cyberattacks
and enables advances in threat intelligence andend point protection that have proven their value
in Ukraine.
While any survey of the year’s developments incybersecurity must begin there, this year’s reportprovides a deep dive into much more. In thereport’s first chapter, we focus on activities ofcybercriminals, followed by nation state threats inchapter two. Both groups have greatly increased
the sophistication of their attacks which has
dramatically increased the impact of their actions.
While Russia drove headlines, Iranian actors
escalated their attacks following a transitionof presidential power, launching destructive
attacks targeting Israel, and ransomware andhack-and-leak operations targeting criticalinfrastructure in the United States. China also
increased its espionage efforts in Southeast
Asia and elsewhere in the global south, seeking
to counter US influence and steal critical dataand information.

Cyber
Resilience

Contributing
Teams

Foreign actors are also using highly effective
techniques to enable propaganda influence
operations in regions around the globe, as
covered in the third chapter. For example,
Russia has worked hard to convince its citizens,and the citizens of many other countries, thatits invasion of Ukraine was justified – while
also sowing propaganda discrediting COVID
vaccines in the West and simultaneously
promoting their effectiveness at home.
In addition, actors are increasingly targeting
Internet of Things (IoT) devices or Operational
Technology (OT) control devices as entry points
to networks and critical infrastructure which
is discussed in chapter four. Finally, in the lastchapter, we provide the insights and lessons
we have learned from over the past year
defending against attacks directed at Microsoft
and our customers as we review the year’s
developments in cyber resilience.
Each chapter provides the key lessons learned
and insights based on Microsoft’s uniquevantage point. The trillions of signals we analyze
from our worldwide ecosystem of products andservices reveal the ferocity, scope, and scaleof digital threats across the globe. Microsoft istaking action to defend our customers andthe digital ecosystem against these threats,and you can read about our technology that
identifies and blocks billions of phishingattempts, identity thefts, and other threats toour customers.

03

ReportIntroduction

Microsoft Digital Defense Report 2022

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Introduction by Tom Burt

The state of cybercrime

Nation state threatsContinued

Cybercriminals continue to act as sophisticatedprofit enterprises. Attackers are adapting andfinding new ways to implement their techniques,
increasing the complexity of how and where
they host campaign operation infrastructure.
At the same time, cybercriminals are becoming
more frugal. To lower their overhead and boost
the appearance of legitimacy, attackers arecompromising business networks and devices tohost phishing campaigns, malware, or even use
their computing power to mine cryptocurrency.

Nation state actors are launching increasingly
sophisticated cyberattacks designed to evadedetection and further their strategic priorities.
The advent of cyberweapon deployment in
the hybrid war in Ukraine is the dawn of a new
age of conflict. Russia has also supported its
war with information influence operations,using propaganda to impact opinions in Russia,
Ukraine, and globally. Outside Ukraine, nation
state actors have increased activity and havebegun using advancements in automation, cloudinfrastructure, and remote access technologies toattack a wider set of targets. Corporate IT supply
chains that enable access to ultimate targets
were frequently attacked. Cybersecurity hygiene
became even more critical as actors rapidly
exploited unpatched vulnerabilities, usedboth sophisticated and brute force techniques
to steal credentials, and obfuscated theiroperations by using opensource or legitimate
software. In addition, Iran joins Russia in theuse of destructive cyberweapons, including
ransomware, as a staple of their attacks.

We also use legal and technical means toseize and shut down infrastructure used bycybercriminals and nation state actors and notify
customers when they are being threatened
or attacked by a nation state actor. We work
to develop increasingly effective featuresand services that use AI/ML technology toidentify and block cyber threats and security
professionals defend against and identify
cyber-intrusions more rapidly and effectively.
Perhaps most importantly, throughout the MDDR
we offer our best advice on the steps individuals,organizations, and enterprises can take todefend against these increasing digital threats.
Adopting good cyber hygiene practices is thebest defense and can significantly reduce therisk of cyberattacks.

Find out more on p6“The advent ofcyberweapon
deployment in
the hybrid war
in Ukraine is thedawn of a new
age of conflict.”

These developments require urgent adoption ofa consistent, global framework that prioritizes
human rights and protects people from recklessstate behavior online. All nations must work
together to implement norms and rules forresponsible state conduct.
Find out more on p30

Cyber
Resilience

Contributing
Teams

Devices and infrastructure
The pandemic, coupled with rapid adoptionof internet-facing devices of all kinds as acomponent of accelerating digital transformation,
has greatly increased the attack surface of ourdigital world. As a result, cybercriminals andnation states are quickly taking advantage.
While the security of IT hardware and software
has strengthened in recent years, the security of
IoT and OT devices security has not kept pace.
Threat actors are exploiting these devices toestablish access on networks and enable lateral
movement, to establish a foothold in a supply
chain, or to disrupt the target organization’s
OT operations.
Find out more on p56

ReportIntroduction

04 Microsoft Digital Defense Report 2022

The State ofCybercrime

Introduction by Tom Burt

Nation State
Threats

Devices andInfrastructure

Cyber
Resilience

Cyber Influence
Operations

ContributingTeams

Our unique vantage pointContinued

Cyber influence operations
Nation states are increasingly using sophisticatedinfluence operations to distribute propaganda
and impact public opinion both domestically andinternationally. These campaigns erode trust,increase polarization, and threaten democratic
processes. Skilled Advanced Persistent
Manipulator actors are using traditional media
together with internet and social media to vastly
increase the scope, scale, and efficiency of theircampaigns, and the outsized impact they arehaving in the global information ecosystem.
In the past year, we have seen these operations
used as part of Russia’s hybrid war in Ukraine,
but have also seen Russia and other nations,
including China and Iran, increasingly deploy
propaganda operations powered by social media
to extend their global influence on a range
of issues.
Find out more on p71

37bn

email threats
blocked34.7bnCyber resilience
Security is a key enabler of technological success.
Innovation and enhanced productivity can only
be achieved by introducing security measuresthat make organizations as resilient as possible
against modern attacks. The pandemic has
challenged us at Microsoft to pivot our security
practices and technologies to protect ouremployees wherever they work. This past year,
threat actors continued to take advantage ofvulnerabilities exposed during the pandemic
and the shift to a hybrid work environment.
Since then, our principal challenge has been
managing the prevalence and complexity ofvarious attack methods and increased nation
state activity. In this chapter, we detail thechallenges we have faced, and the defenses
we have mobilized in response with our morethan 15,000 partners.
Find out more on p86

43tn

identity threats
blockedsignals synthesized daily, using sophisticateddata analytics and AI algorithms to understandand protect against digital threats andcriminal cyberactivity.

8,500+

engineers, researchers, data scientists,
cybersecurity experts, threat hunters,
geopolitical analysts, investigators, andfrontline responders across 77 countries.

2.5bn

endpoint signals
analyzed daily

15,000+partners in our security ecosystem who
increase cyber resilience for our customers.

July 1, 2021 through June 30, 2022

ReportIntroduction

05 Microsoft Digital Defense Report 2022

Introduction by Tom Burt
Continued

We believe Microsoft—independently andthrough close partnerships with others inprivate industry, government, and civil society—has a responsibility to protect the digitalsystems that underpin the social fabric of oursociety and promote safe, secure computing
environments for every person, wherever they
are located. This responsibility is the reason we
have published the MDDR each year since 2020.
The report is the culmination of Microsoft’s
vast data and comprehensive research. It shares
our unique insights on how the digital threat
landscape is evolving and the crucial actions thatcan be taken today to improve the security ofthe ecosystem.
We hope to instill a sense of urgency, so readerstake immediate action based on the data andinsights we present both here and in our manycybersecurity publications throughout the year.
As we consider the gravity of the threat to thedigital landscape—and its translation into thephysical world—it is important to remember that
we are all empowered to take action to protect
ourselves, our organizations, and enterprises
against digital threats.

The State ofCybercrime

Thank you for taking
the time to review
this year’s Microsoft
Digital Defense
Report. We hope
you will find thatit provides valuable
insight andrecommendations
to help us collectively
defend the digital
ecosystem.
Tom Burt
Corporate Vice President,
Customer Security & Trust

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

ContributingTeams

Our objective with this report is twofold:1To illuminate the evolving digital threat landscape for our customers,
partners, and stakeholders spanning the broader ecosystem, shining
a light on both new cyberattacks and evolving trends in historicallypersistent threats.

2  
To empower our customers and partners to improve theircyber resiliency and respond to these threats.

06 Microsoft Digital Defense Report 2022

The State ofCybercrime
As cyber defenses improve and more organizations
are taking a proactive approach to prevention,
attackers are adapting their techniques.

ReportIntroduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

ContributingTeams

An overview of The State of Cybercrime

07

Introduction 

08

Ransomware and extortion:
A nation-level threat 09

Ransomware insights fromfront-line responders

14

Cybercrime as a service 

18

The evolving phishing threat landscape 21

A timeline of botnet disruption fromMicrosoft’s early days of collaboration

25

Cybercriminal abuse of infrastructure26

Is hacktivism here to stay?

28

07

ReportIntroduction

Microsoft Digital Defense Report 2022

An overview of

The State of Cybercrime
As cyber defenses improveand more organizations aretaking a proactive approachto prevention, attackers are
adapting their techniques.
Cybercriminals continue to act as sophisticatedprofit enterprises. Attackers are adapting andfinding new ways to implement their techniques,
increasing the complexity of how and where
they host campaign operation infrastructure.
At the same time, cybercriminals are becoming
more frugal. To lower their overhead and boost
the appearance of legitimacy, attackers arecompromising business networks and devices tohost phishing campaigns, malware, or even use
their computing power to mine cryptocurrency.

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

p15

Cybercrime continues to rise as theindustrialization of the cybercrime
economy lowers the skill barrier toentry by providing greater accessto tools and infrastructure.

Human operated ransomware ismost prevalent, as one-third oftargets are successfully compromisedby criminals using these attacks and
5% of those are ransomed.

Find out more on p18

2,500

Understanding
theransomware
ransomware economyThe
threat ofandOperators
extortionis becoming more
audacious with attacks targetinggovernments, businesses, andcritical infrastructure.
Conti

HIVE

The RaaS operator develops and maintains the tools topower the ransomware operations, including the builders
that produce the ransomware payloads and payment portals
for communicating with victims.

BlackCat

LockBitBlack
MatterCyber Influence
Operations

REvil

Affiliates

A RaaS program (or syndicate) is an arrangement between
an operator and an affiliate. The RaaS operator develops andmaintains the tools to power the ransomware operations,
including the builders that produce the ransomware
payloads and payment portals for communicating withvictims. Many RaaS programs incorporate a suite ofextortion support offerings, including leak site hosting andintegration into ransom notes, as well as decryption
negotiation, payment pressure, and cryptocurrencytransaction services.

60
20
1

Affiliates are generally small groups of people “affiliated”
with one or more RaaS programs. Their role is to deploy the
RaaS program payloads. Affiliates move laterally in the
network, persist on systems, and exfiltrate data. Each affiliate
has unique characteristics, such as different ways of doing
data exfiltration.

Find out more on p9
Access brokers

Find out more on p9

Attackers increasingly threaten todisclose sensitive data to encourage
ransom payments.
Find out more on p10

The most effective
defense against
ransomware
includes multifactor
authentication, frequent
security patches, andZero Trust principles
across networkarchitecture.

Access brokers sell network access to other cybercriminals,
or gain access themselves via malware campaigns, brute
force, or vulnerability exploitation. Access broker entities
can range from large to small. Top tier access brokers
specialize in high-value network access, while lower tierbrokers on the dark web might have just 1–2 usable stolen
credentials for sale.

Organizations and individuals with weak cybersecurity
hygiene practices are at greater risk of having their network
Pre-ransomware
credentials stolen.

Find out more on p13

Cyber
Resilience

Contributing
Teams

Credential phishing
BEC Themes (January-June 202
schemes which
indiscriminately target
all inboxes areonscamtheGift cardrise and business
email
1.9%
compromise, including
Business
invoice fraud,poses ainformation
significant cybercrime
4.3%
risk for enterprises.
Payrollredirection

4.6%
Invoicefraud

9.3%
Find out more on p21

To disrupt the malicious
infrastructures ofcybercriminals andnation state actors,
Microsoft relies oninnovative legal
approaches and our
public and private
partnerships.

Ransomware

Find out more on p252022

08 Microsoft Digital Defense Report 2022

Introduction

ReportIntroduction

Cybercrime continues
to rise, with increases
in both random andtargeted attacks.

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

As cyber defenses improve and moregovernments and businesses take a proactive
approach to prevention, we see attackers using
two strategies to gain access required to facilitatecybercrime. One approach is a campaign withbroad targets that relies on volume. The otheruses surveillance and more selective targeting
to increase the rate of return. Even when revenue
generation is not the objective—such as nation
state activity for geopolitical purposes—both
random and targeted attacks are used. This past
year, cybercriminals continued to rely on social
engineering and exploitation of topical issues
to maximize the success of campaigns.
For example, while COVID-themed phishinglures were used less frequently, we observedlures soliciting donations to support thecitizens of Ukraine increasing.
Attackers are adapting and finding new ways
to implement their techniques, increasing
the complexity of how and where they host
campaign operation infrastructure. We haveobserved cybercriminals becoming morefrugal and attackers are no longer paying fortechnology. To lower their overhead and boost
the appearance of legitimacy, some attackers
increasingly seek to compromise businesses tohost phishing campaigns, malware, or even use
their computing power to mine cryptocurrency.

Cyber
Resilience

ContributingTeams

In this chapter, we also examine the rise inhacktivism, a disruption caused by private
citizens conducting cyberattacks to furthersocial or political goals. Thousands of individuals
around the world, both experts and novices, havemobilized since February 2022 to launch attacks
such as disabling websites and leaking stolen
data as part of the Russia-Ukraine war. It is too
soon to predict whether this trend will continue
after the end of active hostilities.
Organizations must regularly review andstrengthen access controls and implement
security strategies to defend against
cyberattacks. However, that is not all they
can do. We explain how our Digital Crimes
Unit (DCU) has used civil cases to seize malicious
infrastructure used by cybercriminals and nation
state actors. We must fight this threat together
through both public and private partnerships.
We hope that by sharing what we have learned
over the past 10 years, we will help others
understand and consider the proactive measuresthey can take to protect themselves and thewider ecosystem against the continually
growing threat of cybercrime.
Amy Hogan-Burney
General Manager, Digital Crimes Unit

09 Microsoft Digital Defense Report 2022

ReportIntroduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

p15

Ransomwareand extortion:
A nation-level threat
Ransomware attacks pose an increased
danger to all individuals as criticalinfrastructure, businesses of all sizes,
and state and local governments aretargeted by criminals leveraging a
growing cybercriminal ecosystem.
Over the past two years, high profile ransomware
incidents—such as those involving criticalinfrastructure, healthcare, and IT service
providers—have drawn considerable publicattention. As ransomware attacks have become
more audacious in scope, their effects havebecome more wide ranging. The following are
examples of attacks we’ve seen already in 2022:• In February, an attack on two companies
affected the payment processing
systems of hundreds of gas stations
in northern Germany.1• In March, an attack against Greece’s
postal service temporarily disrupted maildelivery and impacted the processing offinancial transactions.2• In late May, a ransomware attack against
Costa Rican government agencies forced
a national emergency to be declared after
hospitals were shut down and customs
and tax collection disrupted.3• Also in May, an attack caused flight delays andcancellations for one of India’s largest airlines,
leaving hundreds of passengers stranded.4
The success of these attacks and the extent
of their real-world impacts are the result of
an industrialization of the cybercrime economy,
enabling access to tooling and infrastructure andexpanding cybercriminal capabilities by lowering
their skill barrier to entry.
In recent years, ransomware has moved
from a model where a single “gang” would
both develop and distribute a ransomware
payload to the ransomware as a service (RaaS)
model. RaaS allows one group to manage thedevelopment of the ransomware payload andprovide services for payment and extortion via
data leakage to other cybercriminals—the ones
who actually launch the ransomware attacks—
referred to as “affiliates” for a cut of the profits.
This franchising of the cybercrime economy has
expanded the attacker pool. The industrializationof cybercriminal tooling has made it easier for
attackers to perform intrusions, exfiltrate data,
and deploy ransomware.
Human operated ransomware —a term coinedby Microsoft researchers to describe threats
driven by humans who make decisions at every
stage of the attacks based on what they discoverin their target’s network and delineate the threat
from commodity ransomware attacks—remains
a significant threat to organizations.
5

Human operated ransomware
targeting and rate of success model
Factors
Low barrier to entry

2,500

potential target
organizations

Access brokers sell accessto compromised networks
to ransomware-as-a-service
affiliates, who run theransomware attack

60

encounter activity
associated with known
ransomware attackers

RaaS affiliates
prioritize targets byintended impact orperceived profit

20

are successfullycompromised

Attackers take advantage
of any security weakness
they find in the network,
so attacks vary

falls victim
to a successful
ransomware event

The ransomware payload
is the culmination of achain of malicious activity

1

Model based on Microsoft Defender for Endpoint (EDR) data (January–June 2022).

10

Microsoft Digital Defense Report 2022

Ransomwareand extortion:
A nation-level threatContinued

Ransomware attacks have become even more
impactful as the adoption of a double extortion
monetization strategy has become a standardpractice. This involves exfiltrating data fromcompromised devices, encrypting the data on
the devices, and then posting or threatening topost the stolen data publicly to pressure victims
into paying a ransom.
Although most ransomware attackers
opportunistically deploy ransomware towhatever network they get access, somepurchase access from other cybercriminals,
leveraging connections between accessbrokers and ransomware operators.

Our unique breadth of signal
intelligence is gathered from multiple
sources—identity, email, endpoints,
and cloud—and provides insight into
the growing ransomware economy,complete with an affiliate system
which includes tools designed forless technically-abled attackers.

ReportIntroduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Expanding relationships between specialized
cybercriminals have increased the pace,sophistication, and success of ransomware
attacks. This has driven the evolution of thecybercriminal ecosystem into connected playerswith different techniques, goals, and skillsets that
support each other on initial access to targets,
payment services, and decryption or publication
tools or sites.
Ransomware operators can now purchase accessto organizations or government networks online
or obtain credentials and access via interpersonal
relationships with brokers whose main objective
is solely to monetize the access they have gained.
The operators then use the purchased access to
deploy a ransomware payload bought via dark
web marketplaces or forums. In many cases,
negotiations with victims are conducted by
the RaaS team, not the operators themselves.
These criminal transactions are seamless and theparticipants risk little chance of being arrested
and charged due to the anonymity of the dark
web and difficulty enforcing laws transnationally.
A sustainable and successful effort against
this threat will require a whole-of-government
strategy to be executed in close partnership withthe private sector.

Digital threat activity
is at an all-timehigh and the levelof sophistication
increases every day.

11

ReportIntroduction

Microsoft Digital Defense Report 2022

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Understanding the ransomware economy
The RaaS operator develops and maintains the tools topower the ransomware operations, including the builders
that produce the ransomware payloads and payment portals
for communicating with victims.

Operators

Conti

HIVE

Affiliates

Access brokers

BlackCat

LockBitBlack
MatterREvil

A RaaS program (or syndicate) is an arrangement between
an operator and an affiliate. The RaaS operator develops andmaintains the tools to power the ransomware operations,
including the builders that produce the ransomware
payloads and payment portals for communicating withvictims. Many RaaS programs incorporate a suite ofextortion support offerings, including leak site hostingand integration into ransom notes, as well as decryption
negotiation, payment pressure, and cryptocurrencytransaction services.
Affiliates are generally small groups of people “affiliated”
with one or more RaaS programs. Their role is to deploy the
RaaS program payloads. Affiliates move laterally in the
network, persist on systems, and exfiltrate data. Each affiliate
has unique characteristics, such as different ways of doing
data exfiltration.
Access brokers sell network access to other cybercriminals,
or gain access themselves via malware campaigns, brute
force, or vulnerability exploitation. Access broker entities
can range from large to small. Top tier access brokers
specialize in high-value network access, while lower tierbrokers on the dark web might have just 1–2 usable stolen
credentials for sale.
Organizations and individuals with weak cybersecurity
hygiene practices are at greater risk of having their network
credentials stolen.

Cyber
Resilience

Contributing
Teams

Contrary to how ransomware is sometimes
portrayed in the media, it is rare for a single
ransomware variant to be managed by one endto-end “ransomware gang.” Instead, there are
separate entities that build malware, gain accessto victims, deploy ransomware, and handle
extortion negotiations. The industrializationof the criminal ecosystem has led to:• Access brokers that break in and handoff access (access as a service).
• Malware developers that sell tooling.
• Criminal operators and affiliates that
conduct intrusions.
• Encryption and extortion service
providers that take over monetizationfrom affiliates (RaaS).
All human-operated ransomware campaigns
share common dependencies on security
weaknesses. Specifically, attackers usuallytake advantage of an organization’s poor
cyber hygiene, which often includes infrequent
patching and failure to implement multifactor
authentication (MFA).

ReportIntroduction

12 Microsoft Digital Defense Report 2022

Case study: The dissolution of Conti
Conti, one of the top ransomware variants
over the past two years, began shutting down
operations in mid-2022, with the Microsoft
Threat Intelligence Center (MSTIC) observing
a significant decrease in activity in late Marchand early April. We observed the last Conti
ransomware deployments in mid-April.
However, much like the shuttering of otherransomware operations, Conti’s dissolution did
not have a significant impact on ransomware
deployments, as MSTIC observed Conti affiliates
pivoting to deploy other ransomware payloads,
including BlackBasta, Lockbit 2.0, LockbitBlack,and HIVE. This is consistent with data fromprevious years and suggests that whenransomware gangs go offline, they re-emerge
months later or redistribute their technicalcapabilities and resources to new groups.

The State ofCybercrime

Our Microsoft threat intelligence teams trackransomware threat actors as individual groups(labeled as DEVs) based on their specific tools,
rather than tracking them by the malware theyuse. This meant that when Conti’s affiliates
dispersed, we were able to continue tracking
these DEVs through their use of other tools or
RaaS kits. For example:• DEV-0230, which is affiliated with Trickbot,
had been a prolific user of Conti. In late April,
MSTIC observed it using QuantumLocker.
• DEV-0237 shifted from Conti’s ransomware
kit to HIVE and Nokoyawa, including using
HIVE in the May 31 attack against Costa
Rican government agencies.
• DEV-0506, another prolific user of theConti ransomware kit, was observed
using BlackBasta.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

RaaS evolves the ransomware ecosystemand hinders attribution
Because human-operated ransomware is driven
by individual operators, attack patterns vary
based on the target and alternate throughout the
duration of an attack. In the past, we observed
a close relationship between the initial entry
vector, tools, and ransomware payload choices
in each campaign of a single ransomware strain.
This made attribution easier. The RaaS affiliate
model, however, decouples this relationship.
As a result, Microsoft tracks ransomware
affiliates deploying payloads in specific attacks,
rather than tracking the ransomware payload
developers as operators.

Cyber
Resilience

Contributing
Teams

Put another way, we no longer assume the
HIVE developer is the operator behind a HIVE
ransomware attack; it is more likely to be
an affiliate.
The cybersecurity industry has struggled toadequately capture this delineation between
developers and operators. The industry still often
reports a ransomware incident by its payload
name, giving the false impression that a single
entity, or ransomware gang, is behind all attacks
using that particular ransomware payload, andall incidents associated with it share common
techniques and infrastructure. To support
network defenders, it is important to learn more
about the stages that precede different affiliates’
attacks—such as data exfiltration and additional
persistence mechanisms—and the detection andprotection opportunities that might exist.

Example of an affiliate (DEV-0237) quickly shifting between RaaS programs
Ryuk 2020–Jun 2021
Conti Jul–Oct 2021
Hive Oct 2021–present
BlackCat Mar 2022–present
Nokoyawa May 2022–present
Agenda etc. June 2022 (experimenting)
2021
Jan

2022
Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Jan

Feb

Mar

Apr

May

After a RaaS program such as Conti is shut down, the ransomware affiliate shifts to another one (Hive)almost immediately.

Jun

More so than malware, attackers
need credentials to succeed in theiroperations. The successful humanoperated ransomware infection ofan entire organization relies on accessto a highly privileged account.

13

ReportIntroduction

Microsoft Digital Defense Report 2022

Spotlight on human-operated
ransomware attacks
Over the past year, Microsoft’s
ransomware experts conducted deep
investigations into more than 100 humanoperated ransomware incidents to trackattackers’ techniques and understandhow to better protect our customers.
It is important to note that the analysis weshare here is possible only for onboarded,
managed, devices. Non-onboarded, unmanaged
devices represent the least secure part of anorganization’s hardware assets.

Most prevalent ransomware
phase techniques:75%

Use admin tools.

75%

The State ofCybercrime

Attempt to tamper with discovered
security and backup products using
OS-built tools.

Devices andInfrastructure

Cyber Influence
Operations

The typical human-operated attack

A durable security strategy

Human-operated ransomware attacks can be
categorized into the pre-ransomware phaseand the ransomware deployment phase.
During the pre-ransomware phase, attackers
prepare to infiltrate the network by learning
about the organization’s typology andsecurity infrastructure.

Combating and preventing attacks of this nature
requires a shift in an organization’s mindset tofocus on the comprehensive protection required
to slow and stop attackers before they canmove from the pre-ransomware phase to theransomware deployment phase.

Stop the attackers before
they reach the ransomware
deployment phase

Deployment!

Pre-ransomware

Ransomware

This phase can range from a few
days to several weeks or months,
although it has been shortening
over the past two years.

This phasecan last only
minutes.

Attackers prepare to infiltrate
the network by learning as muchas possible about the topology
and security infrastructure.
Attackers may also exfiltrate
data in this phase.

Attackers aim
to encrypt asmuch data as
possible.

Use acquired elevated compromised
user account to spread malicious
payloads through SMB protocol.

99%

Nation State
Threats

Our investigations found most actors behind
human-operated ransomware attacks takeadvantage of similar security weaknesses andshare common attack patterns and techniques.

Enterprises must apply security best practices
consistently and aggressively to their networks,
with the goal of mitigating classes of attacks.
Due to the human decision making theseransomware attacks can generate multiple,
seemingly disparate security product alerts which
can easily get lost or not responded to in time.
Alert fatigue is real, and security operations
centers (SOCs) can make their lives easier bylooking at trends in their alerts or grouping alerts
into incidents so they can see the bigger picture.
SOCs can then mitigate alerts using hardening
capabilities like attack surface reduction rules.
Hardening against common threats can not
only reduce alert volume, but also stop many
attackers before they get access to networks.

Organizations must maintaincontinuous high standards of
security posture and network
hygiene to protect themselvesfrom human-operated
ransomware attacks.

Cyber
Resilience

Contributing
Teams

Actionable insights
Ransomware attackers are motivated byeasy profits, so adding to their cost via
security hardening is key in disrupting the
cybercriminal economy.
1

Build credential hygiene. More so thanmalware, attackers need credentials to
succeed in their operations. The successful
human-operated ransomware infection ofan entire organization relies on access toa highly privileged account like a Domain
Administrator, or abilities to edit a Group Policy.

2

Audit credential exposure.

3

Prioritize deployment of Active
Directory updates.

4

Prioritize cloud hardening.

5

Reduce the attack surface.

6

Harden internet-facing assets andunderstand your perimeter.

7

Reduce SOC alert fatigue by hardening yournetwork to reduce volume and preserve
bandwidth for high priority incidents.

Links to further information
RaaS: Understanding the cybercrime gig
economy and how to protect yourself |Microsoft Security Blog
Human-operated ransomware attacks:
A preventable disaster | Microsoft
Security Blog

ReportIntroduction

Ransomware incident and recovery
engagements by industryof Microsoft investigations
during ransomware recovery
engagements revealed
insufficient privilege accessand lateral movement controls.

93%
87%

86%

74%

Energy 8%

74%
65%

62%

Finance 8%

Consumer retail 16%

Education 8%

As new small groups and threats emerge,
defending teams must be aware of evolving
ransomware threats while protecting against
previously unknown ransomware malware
families. The rapid development approach
used by criminal groups led to the creation of
intelligent ransomware packaged in easy-to-use
kits. This allows greater flexibility in launchingwidespread attacks on a higher numberof targets.
The following pages provide a deeper look at themost commonly observed contributing factors to
weak protection against ransomware, grouped
into three categories of findings:
1. Weak identity controls
2. Ineffective security operations
3. Limited data protection

Summary of most common findings in ransomware response engagements

Lack of information
protection control

93%

ContributingTeams

No multifactor authentication

Government 8%

Cyber
Resilience

Insecure configurationof identity provider

Microsoft’s Security Service Line supports
customers through an entire cyberattack, frominvestigation to successful containment andrecovery activities. The response and recovery
services are offered via two highly integrated
teams, with one focusing on the investigation andgroundwork for recovery and the second one on
containment and recovery. This section presents
a summary of findings based on ransomware
engagements over the past year.

Cyber Influence
Operations

Insufficient privilege accessand lateral movement controls

Health 20%

Devices andInfrastructure

Manufacturing 28%

IT 4%Organizations worldwide experienced
a steady growth in human-operated
ransomware attacks beginning in 2019.
However, law enforcement operations
and geopolitical events in the lastyear had a significant impact on
cybercriminal organizations.

Nation State
Threats

Limited adoption of modern
security frameworks

Ransomware insightsfrom front-line
responders

The State ofCybercrime

Insufficient application
security practices

Microsoft Digital Defense Report 2022

Low maturity
security operations

14

The most common finding among ransomware incident response engagements was insufficient privilege accessand lateral movement controls.

15

ReportIntroduction

Microsoft Digital Defense Report 2022

The State ofCybercrimeRansomware insightsfrom front-line
responders

The three main contributing
factors seen in our onsite
response engagements:

Continued

Credential theft attacks remain
one of the top contributing factors

1

Weak identity controls:

Ineffective security
operations processes do not just2

present a window of opportunity
for attackers but significantly
impact the time to recoverEventually it boils down todata—organizations struggle
to implement an effective dataprotection strategy which aligns
with their business needs
3

Nation State
Threats1

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Weak identity controls

Human-operated ransomware continues to evolve and employ credential theft and lateral
movement methods traditionally associated with targeted attacks. Successful attacks are often
the result of long-running campaigns involving compromise of identity systems, like Active
Directory (AD), that allow human operators to steal credentials, access systems, and remain
persistent in the network.

Active Directory (AD) and Azure AD security

Privilege account securityof impacted customers did not employ AD
and Azure AD security best practices. This has
become a common attack vector as attackers
exploit misconfigurations and weaker security
postures in critical identity systems to gain
broader access and impact to businesses.

of engagements, MFA was not implemented forsensitive and high privileged accounts, leaving
a security gap for attackers to compromisecredentials and pivot further attacks using
legitimate credentials.

88%

Least privilege access and use of Privileged
Access Workstations (PAW)
None of the impacted organizations
implemented proper administrative credential
segregation and least privilege access principles
via dedicated workstations during themanagement of their critical identity and highvalue assets, such as proprietary systems andbusiness-critical applications.

88%
84%

Administrators across 84 percent oforganizations did not use privilege identity
controls such as just-in-time access to prevent
further nefarious use of compromised
privileged credentials.

16

ReportIntroduction

Microsoft Digital Defense Report 2022

Ransomware insightsfrom front-line
responders

2

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Ineffective security operations

Our data shows organizations which suffered ransomware attacks have significant gaps in theirsecurity operations, tooling, and information technology asset lifecycle management. Based on
the available data, the following gaps were most observed:

Continued

60%

Patching:

68%of impacted organizations did not have aneffective vulnerability and patch management
process, and a high dependence on manual
processes versus automated patching led to
critical openings. Manufacturing and criticalinfrastructure continue to struggle withmaintenance and patching of legacy
operational technology (OT) systems.
Lack of security operations tooling:
Most organizations reported a lack of endto-end security visibility due to a lack or
misconfiguration of security tools, leading to adecrease in detect and response effectiveness.

60%of organizations reported no use of an EDR
tool, a fundamental technology for detection
and response.
6

did not invest in security information andevent management (SIEM) technology leading
to monitoring silos, limited ability to detect
end-to-end threats and inefficient security
operations. Automation remains a key gap in
SOC tooling and processes, forcing SOC staff
to spend countless hours making sense of
security telemetry.

84%

of impacted organizations did not enable
integration of their multi-cloud environments
into their security operations tooling.
Response and recovery processes:

76%

Lack of an effective response plan was a criticalarea observed in 76 percent of impactedorganizations, preventing proper organizational
crisis readiness and negatively impacting time
to respond and recover.

Cyber
Resilience3

Contributing
Teams

Limited data protection

Many compromised organizations lacked
proper data protection processes leading
to a severe impact on recovery times
and the capability to return to business
operations. The most common gaps
encountered include:

Immutable backup:

44%

of organizations did not have immutablebackups for the impacted systems. Data also
shows administrators did not have backups andrecovery plans for critical assets such as AD.
Data loss prevention:
Attackers usually find their way to compromise
systems via exploiting vulnerabilities in
the organization, exfiltrating critical data
for extortion, intellectual property theft,or monetization.

92%

of impacted organizations did not implement
effective data loss prevention controls
to mitigate these risks, leading to critical
data loss.

17

ReportIntroduction

Microsoft Digital Defense Report 2022

Ransomware declined in someregions and increased in others
This year we observed a drop in theoverall number of ransomware cases
reported to our response teams in North
America and Europe compared to theprevious year. At the same time, cases
reported in Latin America increased.

While law enforcement
activities likely slowed
the frequency of attacks
in 2022, threat actors
might well develop new
strategies to avoid beingcaught in the future.

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

One interpretation of this observation iscybercriminals pivoted away from areas
perceived to have a higher risk of triggering
law enforcement scrutiny in favor of softer
targets. Since Microsoft did not observe a
substantial improvement in enterprise network
security worldwide to explain the decrease inransomware-related support calls, we believe
the most likely cause is a combination of law
enforcement activity in 2021 and 2022 which
increased the cost of criminal activity, along withsome geopolitical events of 2022.

While law enforcement activities likely slowed
the frequency of attacks in 2022, threat actors
might well develop new strategies to avoid beingcaught in the future. Moreover, tension between
Russia and the United States over Russia’s
invasion of Ukraine appears to have put an end
to Russia’s nascent cooperation in the global
fight against ransomware. After a brief period of
uncertainty following the REvil arrests, the UnitedStates and Russia ceased cooperation in pursuing
ransomware actors, which means cybercriminals
might view Russia as a safe haven once more.

One of the most prevalent RaaS operations
belongs to a Russian-speaking criminal groupknown as REvil (also known as Sodinokibi) thathas been active since 2019. In October 2021,
REvil’s servers were taken offline as part ofthe international law enforcement Operation
GoldDust.7 In January 2022, Russia arrested 14
alleged REvil members and raided 25 locations
associated with them.8 This was the first time
Russia acted against ransomware operatorson its soil.

Looking ahead, we predict the pace ofransomware activities will depend on theoutcome of some key questions:

2X

Ransomware attacks decreased
in some regions, but ransom
demands more than doubled.

1. Will governments take action to prevent
ransomware criminals from operating within
their borders, or seek to disrupt actors
operating from foreign soil?
2. Will ransomware groups change tactics toremove the need for ransomware and resort
to extortion style attacks?
3. Will organizations be able to modernize andtransform their IT operations faster thancriminals can exploit vulnerabilities?
4. Will advancements in tracking and tracing
ransom payments force ransom recipients
to change tactics and negotiations?

Cyber
Resilience

Contributing
Teams

Actionable insights
1

Focus on holistic security strategies, as allof the ransomware families take advantageof the same security weaknesses to impact
a network.

2

Update and maintain security basics toincrease defense-in-depth base levelof protection and modernize security
operations. Moving to the cloud allows
you to detect threats more quickly andrespond faster.

Links to further information
Protect your organization fromransomware | Microsoft Security
7 ways to harden your environment
against compromise | Microsoft
Security Blog
Improving AI-based defenses to disrupt
human-operated ransomware | Microsoft
365 Defender Research Team
Security Insider: Explore the latest
cybersecurity insights and updates |Microsoft Security

18 Microsoft Digital Defense Report 2022

Cybercrime
as a service
Cybercrime as a service (CaaS) is a
growing and evolving threat to customers
worldwide. The Microsoft Digital Crimes
Unit (DCU) observed continued growthof the CaaS ecosystem with an increasing
number of online services facilitating
various cybercrimes, including BEC
and human-operated ransomware.
Phishing continues to be a preferredattack method as cybercriminals
can acquire significant value fromsuccessfully stealing and selling
access to stolen accounts.
In response to the expanding CaaS market,
DCU enhanced its listening systems to detectand identify CaaS offerings across the entire
ecosystem of internet, deep web, vetted forums,9
dedicated websites, online discussion forums,
and messaging platforms.

ReportIntroduction

The State ofCybercrime

Cybercriminals are now collaborating across timezones and languages to deliver specific results.
For example, one CaaS website administeredby an individual in Asia maintains operations
in Europe, and creates malicious accounts in
Africa. The multi-jurisdictional nature of these
operations present complex law and enforcement
challenges. In response, DCU focuses its efforts
on disabling malicious criminal infrastructureused to facilitate CaaS attacks and collaboratingwith law enforcement agencies around the world
to hold criminals accountable.
Cybercriminals are increasingly using analytics tomaximize reach, scope, and gain. Like legitimate
businesses, CaaS websites must ensure thevalidity of products and services to maintain asolid reputation. For example, CaaS websites
routinely automate access to compromised
accounts to ensure the validity of compromised
credentials. Cybercriminals will discontinue salesof specific accounts when passwords are reset or
vulnerabilities patched. Increasingly, we identified
CaaS websites providing buyers with on-demandverification as a quality control process. As aresult, buyers can feel confident the CaaS website
sells active accounts and passwords while
reducing potential costs to the CaaS merchantif the stolen credentials are remediated prior
to sale.
DCU also observed CaaS websites offeringbuyers the option to purchase compromised
accounts from specific geographic locations,designated online service providers, andspecifically targeted individuals, professions,and industries. Frequently ordered accounts
focus on professionals or departments that

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

process invoicing, such as CFOs or “Accounts
Receivable.” Similarly, industries participating inpublic contracting are often targeted due to thequantity of information that is made available
through the public bidding process.
DCU investigations into CaaS surfaced
a number of key trends:
The number and sophistication of services
is increasing.
One example is the evolution of web shells
which typically consist of compromised web
servers used to automate phishing attacks.
DCU observed CaaS resellers simplifying the
upload of phishing kits or malware throughspecialized web-dashboards. CaaS sellers often
subsequently attempt to sell additional services
to the threat actor through the dashboard
such as spam message services and specialized
spam recipient lists based on defined attributes
including geographic location or profession.
In some instances, we observed a single web
shell being used in multiple attack campaigns,
which suggests threat actors might maintainpersistent access to the compromised server.
We also observed an increase in anonymization
services available as part of the CaaS ecosystem
as well as offers for virtual private networks(VPN) and virtual private server (VPS) accounts.
In most instances, the VPN/VPS offered were
initially procured through stolen credit cards.
CaaS websites also offered a larger number ofremote desktop protocol (RDP), secure shell(SSH), and cPanels for use as a platform toorchestrate cybercrime attacks. CaaS merchants

Cyber
Resilience

Contributing
Teams

configure the RDP, SSH, and cPanels withappropriate tools and scripts to facilitate
various types of cyberattacks.
Homoglyph domain creation services
are increasingly requiring payment
in cryptocurrencies.
Homoglyph domains impersonate legitimate
domain names by utilizing characters that are
identical or nearly identical in appearance toanother character. The aim is to deceive theviewer into thinking the homoglyph domain
is the genuine domain. These domains are aubiquitous threat and a gateway for a significant
amount of cybercrime. CaaS sites now sellcustom homoglyph domain names, which allows
buyers to request specific company and domainnames to impersonate. After payment is received,
the CaaS merchants use a homoglyph generator
tool to select the domain name and then register
the malicious homoglyph. Payment for thisservice is almost exclusively in cryptocurrency.

2,750,000

site registrations successfully
blocked by DCU this year to getahead of criminal actors thatplanned to use them to engage
in global cybercrime.

19

Microsoft Digital Defense Report 2022

Cybercrime
as a service
Continued

CaaS sellers increasingly offer
compromised credentials for purchase.
Compromised credentials enable unauthorizedaccess to user accounts including email
messaging service, corporate file sharing
resources, and OneDrive for Business.
If administrator credentials are compromised,
unauthorized users could gain access toconfidential files, Azure resources, andcompany user accounts. In many instances,
DCU investigations identified unauthorized useof the same credential across multiple servers
as a means to automate verifying credentials.
This pattern suggests the compromised usermight be a victim of multiple phishing attacks orhave device malware allowing botnet keyloggers
to collect credentials.

ReportIntroduction

The State ofCybercrime

is a virtual machine, gathering details about thebrowser and hardware being used, and more.
If all checks pass, traffic is sent to a landing pageused for phishing.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

PhaaS, cybercriminals offer multiple services within
a single subscription. In general, a purchaser needs
to take only three actions:End-to-end cybercrime services are selling
subscriptions to managed services.
Typically, each step in the commission of
an online crime can expose threat actors
if operational security is poor. The risk of
exposure and identification increases if services
are purchased from multiple CaaS sites.
DCU observed a concerning trend in the dark
web whereby there is an increase in services
offering to anonymize software code andgenericize website text to reduce exposure. Endto-end cybercrime subscription service providers
manage all services and guarantee results whichfurther reduce exposure risks to the subscribing
OCN. The reduced risk has increased the
popularity of these end-to-end services.

CaaS services and products with enhanced
features are emerging to avoid detection.

Phishing as a service (PhaaS) is one example
of an end-to-end cybercrime service. PhaaS is
an evolution of prior services known as fully
undetectable services (FUD) and is offered on a
subscription basis. Typical PhaaS terms include
keeping phishing websites active for a month.

One CaaS seller offers phishing kits withincreased layers of complexity and anonymization
features designed to circumvent detection andprevention systems for as little as $6 USD perday. The service offers a series of redirects that
perform checks before allowing traffic to the nextlayer or site. One of these runs over 90 checks
for fingerprinting the device, including whether it

DCU also identified a CaaS merchant offering
distributed denial of service (DDoS) on a
subscription model. This model outsources
the creation and maintenance of the botnet
necessary to carry out attacks to the CaaS
merchant. Each DDoS subscription customer
receives an encrypted service to enhance
operational security and one year of 24/7

1

Select aphishing site
template/designfrom among thehundreds offered.

2

Attackers aim
to encrypt as
Provide an email
much data as
address to receive
possiblecredentials
obtained fromphishing victims.

3

Pay the PhaaS
merchant incryptocurrency.

Once these steps are completed, the PhaaS merchant creates services with three or four layers of redirect andhosting resources to target specific users. The campaign is subsequently launched, and victim credentials are
harvested, verified, and sent to the email address provided by the purchaser. For a premium, many PhaaS
merchants offer to host phishing sites on the public blockchain so they can be accessed by any browser andredirects can point users to a resource on the distributed ledger.

support. The DDoS subscription service offers
different architectures and attack methods, so
a purchaser simply selects a resource to attack
and the seller provides access to an array ofcompromised devices on their botnet to conduct
the attack. The cost for the DDoS subscription is amere $500 USD.

DCU’s work to develop tools and techniques
which identify and disrupt CaaS cybercriminals is
ongoing. The evolution of CaaS services presents
significant challenges, particularly in disrupting
cryptocurrency payments.

20

Microsoft Digital Defense Report 2022

Criminal use of
cryptocurrencies
As the adoption of cryptocurrency
becomes mainstream, criminals are
increasingly using it to evade law
enforcement and anti-money laundering(AML) measures. This heightens thechallenge for law enforcement to track
and trace cryptocurrency payments
to cybercriminals.
Worldwide spending on blockchain solutions
grew by approximately 340 percent over the last
four years, while new cryptocurrency wallets grewby around 270 percent. There are more than
83 million unique wallets globally, and the total
market capitalization of all cryptocurrencies wasapproximately $1.1 trillion USD as of July 28, 2022.10

ReportIntroduction

The State ofCybercrime

Tracking ransomware payments
Ransomware is one of the largest sources ofillicitly gained cryptocurrency. In an effort todisrupt malicious technical infrastructure used inransomware attacks—for example, the disruptionof Zloader in April 202211—Microsoft’s DCU
tracks criminal wallets to enable cryptocurrency
tracking and recovery capabilities.
DCU investigators have observed ransomware
actors evolving their communication tactics withvictims to conceal the money trail. Originally,
cybercriminals included Bitcoin addresses in theirransom notes. However, this made it easy tofollow payment transactions on the blockchain,so ransomware actors stopped including walletaddresses and instead appended email addresses
or links to chat websites to communicate ransom
payment addresses to victims. Some actors
even created unique webpages and logins foreach victim to prevent security researchers andlaw enforcement from obtaining the criminals’
wallet addresses by pretending to be victims.
Despite criminals’ efforts to hide their tracks,
some ransom payments can still be recovered
by working with law enforcement and crypto
analysis companies that can track movementon the blockchain.
Trending: DEX laundering of illicit proceeds

Source: Twitter.com—@PeckShieldAlert (PeckShield
is a China-based blockchain security company).

A key issue for cybercriminals is theconversion of cryptocurrency to fiat currency.
Cybercriminals have several potential avenues
for conversion, each of which carries a different
degree of risk. One method used to reduce risk
is to launder proceeds through a decentralizedexchange (DEX) before cashing out via available

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Tracking illicitly gained cryptocurrency
Curve

72.19

ETH

AscendEX.com
46.77

ETH

Uniswap V3

AscendEX.com
stolen funds
2021-12-11

Using the cryptocurrency investigative tool Chainalysis, Microsoft’s Digital Crimes Unit discovered the AcendEX
hackers swapped their stolen funds at a smaller DEX called Curve in addition to Uniswap. This diagram illustrates
the laundering routes the team uncovered. Each circle represents a cluster of wallets and the numbers on each line
represent the total amount of Ethereum transmitted for laundering purposes.

cash-out options, such as centralized exchanges(CEX), peer-to-peer (P2P) and over the counter(OTC) exchanges. DEXes are an attractive
laundering location because they often do notfollow AML measures.

In December 2021, hackers attacked the global
cryptocurrency trading platform AscendEx
and stole approximately $77.7 million USD in
cryptocurrency belonging to its customers.12
AscendEx hired blockchain analytics firms andcontacted other CEXs so the wallets receiving
stolen funds could be blacklisted. Additionally,
addresses where the coins were sent werelabeled as such on the Ethereum blockchain
explorer Etherscan.13 In order to circumventthe alerting and blacklisting, the hackers sent
$1.5 million USD in Ethereum to Uniswap, one of
the world’s largest DEXs, on February 18, 2022.14
The adoption of stronger AML measures by DEXs
could blunt laundering activity on their platforms

and force cybercriminals to use other obfuscation
methods like coin tumbling or unlicensed
exchanges. As an example, Uniswap recently
announced it will start to use blacklists to blockwallets known to be involved in illicit activities
from transacting on the exchange.15
Actionable insights
1

If you are a victim of cybercrime who has
paid the criminal using cryptocurrency,
contact local law enforcement who might
be able to help track and recover lost funds.

2

Become familiar with the ALM measuresin place when selecting a DEX.

Links to further information
Hardware-based threat defense against
increasingly complex cryptojackers |Microsoft 365 Defender Research TeamReportIntroduction

Microsoft Digital Defense Report 2022

phishing emails blocked per week.

The median time for an attacker
to begin moving laterally withinyour corporate network once a
device is compromised.17

Cyber
Resilience

Contributing
Teams

531,000

In addition to the URLs blocked
by Defender for Office, our Digital
Crimes Unit directed the takedownof 531,000 unique phishing URLs
hosted outside of Microsoft.

Detected phish emails
800
700
600
500
400
300
200
100
Jun 2022

May 2022

Apr 2022

Mar 2022

Feb 2022

Jan 20220
Dec 2021

In addition to campaigns with broader targets,
phishing for credentials, donations, and personal
information, attackers are targeting selective
businesses for larger payouts. Email phishingattacks against businesses for financial gain
are collectively referred to as BEC attacks.

900

Nov 2021

Microsoft 365 credentials remain one of the mosthighly sought-after account types for attackers.
Once login credentials are compromised,attackers can log in to corporate-tied computer
systems to facilitate infection with malware andransomware, steal confidential company dataand information by accessing SharePoint files,
and continue the spread of phish by sending
additional malicious emails using Outlook,among other actions.

Oct 2021

710 million

1hr 42m

Cyber Influence
Operations

The techniques used in phishing attacks
continue to increase in complexity. In response
to countermeasures, attackers adapt new ways
to implement their techniques and increase
the complexity of how and where they host
campaign operation infrastructure. This meansorganizations must regularly reassess theirstrategy for implementing security solutions toblock malicious emails and strengthen access
control for individual user accounts.

Sep 2021

Using data from Defender for Office, we see
malicious email and compromised identity
activity. Azure Active Directory Identity
Protection provides still more information
through compromised identity event alerts.
Using Defender for Cloud Apps, we seecompromised identity data access events, andMicrosoft 365 Defender (M365D) provides
cross-product correlation. The lateral movement
metric comes from Defender for Endpoint (attack
behavior alerts and events), Defender for Office(malicious email) and again M365D for crossproduct correlation).

The median time it takes for
an attacker to access yourprivate data if you fall victim
to a phishing email.16

Aug 2021

Credential phishing schemes are on
the rise and remain a substantial threat
to users everywhere because they
indiscriminately target all inboxes.
Among the threats our researchers
track and protect against, the volume ofphishing attacks is orders of magnitude
greater than all other threats.

1hr 12m

Devices andInfrastructure

Microsoft detects millions of BEC emails every
month, equivalent to 0.6 percent of all phishingemails observed. A report from IC318 published in
May 2022 indicates an upward trend in exposed
losses due to BEC attacks.

Jul 2021

The evolving phishing
threat landscapeNation State
Threats

The State ofCybercrime

Millions

21

The number of phish detections per week continue to rise. The decrease in December–January is an expectedseasonal drop, also reported in last year’s report. Source: Exchange Online Protection signals.

ReportIntroduction

Microsoft Digital Defense Report 2022

Only a few days after the start of the war in
Ukraine in late February 2022, the numberof detected phishing emails containing
Ethereum addresses encountered acrossenterprise customers increased dramatically.
Total encounters peaked in the first week ofMarch when half a million phishing emails
contained an Ethereum wallet address. Prior to
the start of the war, the number of Ethereum
wallet addresses across other emails detected
as phish was significantly less, averaging a few
thousand emails per day.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

600

500
Thousands

Continued

400
300
200
100

Jun 2022

May 2022

Apr 2022

Mar 2022

Feb 2022

Jan 2022

Dec 2021

Nov 2021

Oct 20210
Jul 2021

We continue to observe a steady year-over-yearincrease in phishing emails. The shift to remote
work in 2020 and 2021 saw a substantial increasein phishing attacks aiming to capitalize on thechanging work environment. Phish operators
are quick to adopt new email templates usinglures aligned with major world events such as
the COVID-19 pandemic and themes linked
to collaboration and productivity tools such
as Google Drive or OneDrive file sharing.
While COVID-19 themes have diminished, thewar in Ukraine became a new lure starting inearly March 2022. Our researchers observed astaggering increase of emails impersonating
legitimate organizations soliciting cryptocurrency
donations in Bitcoin and Ethereum, allegedly tosupport Ukrainian citizens.

The State ofCybercrime

Phishing emails with Ethereum wallet addresses

Sep 2021

The evolving phishing
threat landscapeAug 2021

22

Total emails detected as phish containing Ethereum wallet addresses increased at the start of the Ukraine-Russia
conflict and tapered off after the initial push.

More than ever, phishers are relying on legitimate
infrastructure to operate, driving a rise inphishing campaigns aimed at compromisingvarious aspects of an operation so they do
not have to purchase, host, or operate theirown. For example, malicious emails might
originate from compromised sender accounts.
Attackers benefit from using these email
addresses which have a higher reputation scoreand are seen as more trustworthy than newly
created accounts and domains. In some moreadvanced phishing campaigns, we observed
attackers preferring to send and spoof fromdomains which have DMARC19 incorrectly set up
with a “no action” policy, opening the door foremail spoofing.

Large phish operations tend to use cloudservices and cloud virtual machines (VMs) tooperationalize large scale attacks. Attackers canfully automate the process of deploying anddelivering emails from VMs using SMTP
email relays or cloud email infrastructure tobenefit from the high deliverability rates andpositive reputation of these legitimate services.
If malicious email is allowed to be sent throughthese cloud services, defenders must rely onstrong email filtering capabilities to block emails
from entering their environment.

Cyber
Resilience

Contributing
Teams

Microsoft accounts remain a top target forphishing operators, as evidenced by thenumerous phishing landing pages whichimpersonate the Microsoft 365 login page.
For example, phishers attempt to match theMicrosoft login experience in their phish kits
by generating a unique URL customized to
the recipient. This URL points to a malicious
webpage developed to harvest credentials, but
a parameter in the URL will contain the specificrecipient’s email address. Once the target
navigates to the page, the phish kit will prepopulate user login data and a corporate logo
customized to the email recipient, mirroring theappearance of the targeted company’s custom
Microsoft 365 login page.
Phishing page impersonating a Microsoft
login with dynamic content

23ReportIntroduction

Microsoft Digital Defense Report 2022

Spotlight on businessemail compromise
Cybercriminals are developing
increasingly complex schemes andtechniques to defeat security settings
and target individuals, businesses,
and organizations. We are investing
significant resources to further
enhance our BEC enforcement
program in response.
BEC is the costliest financial cybercrime, with anestimated $2.4 billion USD in adjusted losses
in 2021, representing more than 59 percent of
the top five internet crime losses globally.20 To
understand the scope of the problem and how
best to protect users against BEC, Microsoft
security researchers have been tracking themost common themes used in attacks.
BEC themes (January–June 2022)
Gift card scam 1.9%

Business information 4.3%
Payroll redirection 4.6%

Invoice fraud 9.3%

BEC lure 79.9%

BEC themes by percentage of occurrence

The State ofCybercrime

BEC trends
As a point of entry, BEC attackers normally
attempt to start a conversation with potential
victims to establish rapport. Posing as acolleague or business acquaintance, the attacker
gradually leads the conversation in the directionof a monetary transfer. The introduction email,which we track as a BEC lure, represents close to
80 percent of detected BEC emails. Other trends
identified by Microsoft security researchers overthe past year include:• The most frequently used techniques in BEC
attacks observed in 2022 were spoofing21
and impersonation.22• The BEC subtype causing the most financial
damage to victims was invoice fraud (based onvolume and requested dollar amounts seen in
our BEC campaign investigations).
• Business information theft such as accounts
payable reports and customer contacts enableattackers to craft convincing invoice fraud.
• Most payroll redirection requests were sentfrom free email services and seldom fromcompromised accounts. Email volume fromthese sources spiked around the first andfifteenth of each month, the most common
pay dates.
• Despite being well-known avenues for fraud,gift card scams comprised only 1.9 percent of
the BEC attacks detected.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Actionable insights
Defending against phish
To reduce your organization’s exposure to phish, IT administrators
are encouraged to implement the following policies and features:
1

Require the use of MFA across all accounts
to limit unauthorized access.

2

Enable conditional access features forhighly privileged accounts to block
access from countries, regions, and IPs
that do not typically generate traffic at
your organization.

3

4

5

Consider using physical security keys
for executives, employees involved in
payment or purchase activities, and otherprivileged accounts.
Enforce the use of browsers which support
services such as Microsoft SmartScreen
to analyze URLs for suspicious behaviors
and blocks access to known malicious
websites.23
Use a machine-learning based security
solution that quarantines high probability
phish and detonates URLs andattachments in a sandbox before email
reaches the inbox, such as Microsoft
Defender for Office 365.24

6Enable impersonation andspoofing protection features acrossyour organization.

7

Configure DomainKeys Identified Mail
(DKIM) and Domain-based Message
Authentication Reporting & Conformance(DMARC) action policies to prevent
delivery of non-authenticated emails thatmight be spoofing reputable senders.

8

Audit tenant and user created allow
rules and remove broad domain andIP based exceptions. These rules often
take precedence and can allow known
malicious emails through email filtering.

9

Regularly run phishing simulators togauge the potential risk across yourorganization and to identify and educate
vulnerable users.

Links to further information
From cookie theft to BEC: Attackers use
AiTM phishing sites as entry point tofurther financial fraud | Microsoft 365
Defender Research Team, Microsoft
Threat Intelligence Center (MSTIC)

24

ReportIntroduction

Microsoft Digital Defense Report 2022

Homoglyph deception
BEC and phishing are common social
engineering tactics. Social engineering
plays a significant role in crime,
persuading a target to interact
with the criminal by gaining trust.
In physical commerce, trademarks are used
to secure trust in the origin of a product orservice, and counterfeit products are an abuseof the trademark. Similarly, cybercriminals poseas a contact familiar to the target during aphishing attack, using homoglyphs to deceive
potential victims.

The State ofCybercrime

Cyber
Cyber Influence
Influence
Operations
Operations

Cyber
Resilience

Account compromised

Target receives
phishing email

Malicious linkto imposter
Office 365% of domains showing
homoglyph technique

sub l for I

25%

A homoglyph is a domain name used for emailcommunication in BEC, in which a characteris replaced by one that is identical or nearly
identical in appearance, in order to deceive
the target.

sub i for l

12%

sub q for g

7%

sub rn for m

6%

sub .cam for .com

6%

Homoglyph techniques used in BEC attempts

sub 0 for o5%

sub ll for l3%

sub ii for i2%

sub vv for w

2%

sub l for ll

2%

sub e for a2%

sub nn for m

1%

sub ll for I, sub l for i1%

sub o for u

1%

The second phase is the fraud phase,where attackers use compromised credentials
to engage in sophisticated social engineering
using homoglyph email domains.

Devices andInfrastructure

Contributing
Teams

Progression of a BEC attack

Technique

BEC generally has two phases, the first of which
involves compromise of credentials. These typesof credential leaks can be a result of phishingattacks or large data breaches. The credentials
are then sold or traded on the dark web.

Nation State
Threats

Analysis of over 1,700 homoglyph domains between
January–July 2022. While 170 homoglyph techniques
were used, 75% of domains used just 14 techniques.

Fraud phase

Credentials
harvested

Establish
malicious
infrastructure

Account email
monitored

A homoglyph in action
A homoglyph domain that looks identical to a
mail domain the victim recognizes is registeredon a mail provider with a username that is
identical. A hijacked email is then sent from thehijacked domain with new payment instructions.
Leveraging open-source intelligence andaccess to email threads, the criminal identifies
individuals who have responsibility forinvoicing and payments. They then create
an impersonation of an email address of theindividual sending invoices. This impersonationis composed of an identical username andmail domain that is a homoglyph of thegenuine sender.
The attacker copies an email chain containing
a legitimate invoice, then changes the invoice
to contain their own bank details. This new,modified invoice is then resent from thehomoglyph impersonation email to the target.
Because the context makes sense and the email
looks genuine, often the target follows thefraudulent instructions.

Imposter email
and wire fraud

Actionable insights
1

Enforce the use of browsers that support
services to analyze URLs for suspicious
behaviors and blocks access to known
malicious websites such as Safe Links
and SmartScreen.25

2

Use a machine-learning based security
solution that quarantines high probability
phish and detonates URLs and attachments
in a sandbox before email reaches the inbox.

Links to further information
Internet Crime Complaint Center (IC3) |Business Email Compromise:
The $43 Billion Scam
Spoof intelligence insight—
Office 365 | Microsoft Docs
Impersonation insight—
Office 365 | Microsoft Docs

25

ReportIntroduction

Microsoft Digital Defense Report 2022

A timeline of botnet disruption fromMicrosoft’s early days of collaboration
For more than a decade, DCU has worked toproactively stop cybercrime resulting in 26 malware
and nation state disruptions. As the DCU teamuses more advanced tactics and tools to shut downthese illicit operations, we see the cybercriminals
also evolve their approaches in an attempt to staya step head. Here is a timeline showing a sampleof the botnets disrupted by DCU and the strategies
Microsoft adopted to shut them down.

2008

2009

The State ofCybercrime

Microsoft Digital Crimes Unit
is formed
Collaboration: Designed to thwart
cybercrime impacting the Microsoft
ecosystem through close integration
across a team of investigators,
lawyers, and engineers.
Microsoft approach: The goal is
to better understand the technicalaspects of various malware andprovide these insights to Microsoft’s
legal team to develop an effective
disruption strategy.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Sirefef/Zero Access botnet

Continued focus on disruption

Description: An advertising botnet
designed to direct people to dangerous
websites that would install malware or
steal personal information; infected
more than two million computers andcost advertisers more than $2.7 million
USD per month; primarily in US andWestern Europe.

Description: Microsoft disrupted
the infrastructure of seventhreat actors over the past year,
preventing them from distributing
additional malware, controlling
victims’ computers, and targeting
additional victims.

Collaboration: Worked closely with
the FBI and Europol’s Cybercrime
Center to bring down the peer-topeer infrastructure.
Microsoft response: Joined the Zero
Access network, replaced the criminal
C2 servers, and successfully seized
download server domains.

2011

Contributing
Teams

2013

2019

Collaboration: In partnershipwith internet service providers,
governments, law enforcement,
and private industry, Microsoft
shared information to remediateover 17 million malware
victims worldwide.

2022

Conficker botnet

Waledac botnet

Rustock botnet

Trickbot botnet

Looking ahead

Description: A fast-spreading worm
targeting the Windows OS, infecting
millions of computers and devices in
a common network; created network
outages worldwide.

Description: A complex spambotnet with US domains thatcollected email addresses anddistributed spam that infected up to
90,000 computers across the world.26

Description: A backdoor trojan
spam email bot using internet
providers as primary C2s; designed
to sell pharmaceuticals.

Collaboration: Formation of
the Conficker Working Group,
the first consortium of its kind.
Microsoft partnered with 16organizations across the globe
to defeat the bot.

Collaboration: Creation of anotherconsortium, the Microsoft Malware
Protection Center (MMPC) with afocus on close collaboration withacademics.27

Collaboration: Microsoft
forged a partnership with Pfizer
Pharmaceuticals to understand the
drugs sold by Rustock and worked
closely with Dutch law enforcement
officials.29

Description: A sophisticatedbotnet with fragmented
infrastructure across the globe
that targeted the financial services
industry; compromised IoT devices.

Microsoft response: Microsoft
used tiered disruption approachof C2 and surprised bad actors
by seizing US-based domains
without notice.28 Microsoft granted
temporary ownership of nearly 280
domains used by Waledac’s servers.

Microsoft response: Microsoft
worked with US Marshalls and law
enforcement in the Netherlands totake down the C2 servers in thatcountry. Registered and blocked
all future domain generator
algorithms (DGAs).

DCU continues to innovate
and is looking to use
its experience in botnet
disruptions to conduct
coordinated operations
that go beyond malware.
Our continued success requires
creative engineering, sharing
of information, innovative
legal theories, and public
and private partnerships.

Microsoft response: The
group collaborated across many
international jurisdictions and was
successful bringing Conficker down.

Collaboration: Microsoft
partnered with the Financial
Services Information Sharing andAnalysis Center (FS-ISAC) to bring
down Trickbot.30
Microsoft response: DCU built
a system to identify and track
bot infrastructure and generated
notifications for active internet
providers, taking into accountspecific laws in various countries.

26

ReportIntroduction

Microsoft Digital Defense Report 2022

Cybercriminal abuseof infrastructureInternet gateways
as criminal commandand control infrastructure
IoT devices are becoming an increasingly
popular target for cybercriminals usingwidespread botnets. When routers areunpatched and left exposed directly tothe internet, threat actors can abuse
them to gain access to networks,
execute malicious attacks, and evensupport their operations.
The Microsoft Defender for IoT team conducts
research on equipment ranging from legacy
industrial control system controllers to cuttingedge IoT sensors. The team investigates IoT- andOT-specific malware to contribute to the shared
list of indicators of compromise.
Routers are particularly vulnerable attack vectors
because they are ubiquitous across internetconnected homes and organizations. We havebeen tracking the activity of MikroTik routers, a
popular router around the world residentially andcommercially, identifying how they are utilized forcommand and control (C2), domain name system(DNS) attacks, and crypto mining hijacking.

The State ofCybercrime

More specifically, we identified how Trickbot
operators utilize compromised MikroTik routersand reconfigure them to act as part of their C2
infrastructure. The popularity of these devices
compounds the severity of their abuse by
Trickbot, and their unique hardware and software
enable threat actors to evade traditional security
measures, expand their infrastructure, andcompromise more devices and networks.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Trickbot attack chain

Attacker

Commandand control

Sets upmalicious domains

Distribution of exposed MikroTik routers
around the world
Number of exposed
MikroTik routers

93,8681

Compromised
IoT device

Targetnetwork

Exposed routers are at risk of having potential
vulnerabilities exploited.

By tracking and analyzing traffic containing
secure shell (SSH) commands, we observed
attackers using MikroTik routers tocommunicate with Trickbot infrastructure after
obtaining legitimate credentials to devices.
These credentials can be obtained through brute
force attacks, exploiting known vulnerabilities
with readily available patches, and using
default passwords. Once a device is accessed,
the attacker issues a unique command that

Scans for MikroTik
devices that are exposedto the internet

Steals device
credentials andmaintains persistence

Executes traffic
redirectioncommandInstalls Trickbot on
target network
via a campaign

Performs recon
to obtain network
information

Communicates with
C2 via router; drops
payloads, steals info

Trickbot attack chain showing the use of MikroTik IoT devices as proxy servers for C2.

redirects traffic between two ports in the router,establishing the line of communication between
Trickbot-affected devices and the C2.

We have aggregated our knowledge of thevarious methods of attacking MikroTik devices,
beyond just Trickbot, as well as known common
vulnerabilities and exposures (CVEs) into an
open-source tool for MikroTik devices, which can
extract the forensic artifacts related to attacks onthese devices.31

Devices acting as reverse proxies for malware
C2 are not just unique to Trickbot and MikroTik
routers. In collaboration with the Microsoft
RiskIQ team, we traced back to the C2 involved
and, through observing SSL certificates,
identified Ubiquiti and LigoWave devices
that are impacted as well.32 This is a strong
indication that IoT devices are becoming active
components of nation state coordinated attacks
and a popular target for cybercriminals usingwidespread botnets.

27

ReportIntroduction

Microsoft Digital Defense Report 2022

Crypto criminals
abusing IoT devices
Gateway devices are an increasingly
valuable target for threat actors as thenumber of known vulnerabilities hasgrown consistently from year to year.
They are being used for crypto mining
and other types of malicious activity.
As cryptocurrency has become more popular,
many individuals and organizations have invested
computational power and network resourcesfrom devices such as routers to mine coins on
the blockchain. However, mining cryptocurrency
is a time- and resource-intensive processwith a low probability of success. To increase
the likelihood of mining a coin, miners pool
together in distributed, cooperative networks,
receiving hashes relative to the percentage ofthe coin they succeeded in mining with theirconnected resources.

The State ofCybercrime

In the past year, Microsoft observed a growing
number of attacks that abuse routers for
redirecting cryptocurrency mining efforts.
Cybercriminals compromise routers connected
to mining pools and redirect mining traffic
to their associated IP addresses with DNS
poisoning attacks, which alters the DNS settingsof targeted devices. Affected routers register
the wrong IP address to a given domain name,sending their mining resources—or hashes—topools used by threat actors. These pools mightmine anonymous coins associated with criminal
activities or use legitimate hashes generated byminers to acquire a percentage of the coin thatthey mined, thus reaping the rewards.

With more than half of known
vulnerabilities found in 2021 lacking apatch, updating and securing routerson corporate and private networks
remains a significant challenge fordevice owners and administrators.

Compromising devices for illegal crypto mining.
MinersCriminal’s pool
DNS Poisoning

MinersMinersPool

ASIC

Routers
Miner

MinersPortion of hashes fromoriginal pool are stolen
Cryptocurrency
by threat actors, or
resources are transferredto their pool, or routers
have malware on themthat steal resources
for mining.

DNS poisoning of gateway devices compromises legitimate mining activities and redirects resources
to criminal mining activities.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Virtual machines ascriminal infrastructure
The widespread move to the cloudincludes cybercriminals who leverage
private assets of unwitting victims
obtained through phishing or
distributing malware credential stealers.
Many cybercriminals are choosing to
set up their malicious infrastructures
on cloud-based virtual machines (VMs),
containers, and microservices.
Once the cybercriminal has access, a sequence of
events can occur to set up infrastructure—suchas a series of virtual machines through scripting
and automated processes. These scripted,
automated processes are used to launch
malicious activity including large scale email
spam attacks, phishing attacks, and web pages
hosting nefarious content. It can even include
setting up a scaled virtual environment carryingout cryptocurrency mining, causing the end
victim a bill of hundreds of thousands of dollars
at the end of the month.
Cybercriminals understand their malicious activity
has a limited life span before it is detected andshut down. As a result, they have scaled up andnow operate proactively with contingencies topof mind. They have been observed preparing
compromised accounts ahead of time andmonitoring their environments. As soon as anaccount (set up using hundreds of thousands ofvirtual machines) is detected, they traverse to

Cyber
Resilience

ContributingTeams

the next account—already prepared by scripts tobe immediately activated—and their malicious
activity continues with little to no interruption.
Like cloud infrastructure, on-premises
infrastructure can be used in attacks with
virtual local environments that are unknown tothe on-premises user. This requires the initialaccess point to remain open and accessible.
On-premises private assets have also been
abused by cybercriminals to initiate an onward
chain of cloud infrastructure, set up to obfuscate
their origin to avoid suspicious infrastructure
creation detection.
Actionable insights
1

Implement good cyber hygiene andprovide cybersecurity training for
employees with guidance for avoiding
being socially engineered.

2

Conduct regular automated user activity
anomaly checks through detections at
scale to help reduce these types of attacks.

3

Update and secure routers on corporate
and private networks.

28

ReportIntroduction

Microsoft Digital Defense Report 2022

Is hacktivism
here to stay?
While hacktivism is not a newphenomenon, the war in Ukraine saw
a surge of volunteer hackers, including
some directed by governments to deploy
cyber tools to damage the reputation
or assets of political opponents,organizations, and even nation states.
In February 2022, the Ukrainian government
called on private civilians around the world
to conduct cyberattacks on Russia as part ofits 300,000 strong “IT Army.”33 At the sametime, established hacktivist groups such as
Anonymous, Ghostsec, Against the West,
Belarusian Cyber Partisans, and RaidForum2
began conducting attacks in support of Ukraine.
Other groups, including some of the Conti
ransomware gang, sided with Russia.34
In the months that followed, Anonymous’s
activities were highly visible. Hackers acting
in the group’s name—or in that of one of its
affiliates—temporarily disabled thousands ofRussian and Belarusian websites, leaked hundredsof gigabytes of stolen data, hacked Russian TV
channels to play pro-Ukrainian content, andeven offered to pay Bitcoin for surrendered
Russian tanks.

The State ofCybercrime

The rise of citizen hackers
Social media platforms enabled the rapid
organization and mobilization of thousandsof would-be citizen hackers, who were
provided directions for conducting easily
executable attacks such as DDoS attacks.
Organizers leveraged Twitter, Telegram, andprivate forums to rally hackers, organize
operations, and disseminate hacking
instruction manuals.
However, most of these hackers likely have
limited skills, even with instruction. This suggests
two potential futures: one in which hundreds
or thousands of individuals with rudimentary
technical capabilities use attack templates
to conduct future coordinated or individual
hacktivist attacks against targets, or a second
future where the eventual end of hostilities
in Ukraine sees them leaving their hacktivism
behind, at least until the next political or social
issue inspires them to action.
Politicization of hackers
The greater risk posed by this politicalmobilization is the deployment of tech-savvy
hackers who might continue to conduct
cyberattacks against foreign government targets
to support their own national priorities, either
on a self-initiated basis or at the behest of
their government.
Iran, China, and Russia already use hacktivism
as a feeder for recruitment into their statehacking groups. For example, in April 2022, thepro-Russian hacking group Killnet launched
DDoS attacks against Czech railroads, regional

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

airports, and Czechia’s civil service server, eventhough Czechia is not directly involved in thewar.35 At the same time, some governments
might use hacktivism as a cover for traditional
cyberespionage or sabotage operations—for
example, Iranian activities against Israel.
In an environment of increased DDoS attacks
linked to hacktivism, the technology industry is
challenged to quickly decipher the difference
between normal and abnormal traffic flow
to a website. Microsoft and its partners havedeveloped a collection of tools which distinguishmalicious DDoS traffic and trace it back to its
origin. In addition, Microsoft’s Azure platform canidentify machines on the platform that produce
extraordinarily high levels of outbound trafficand shut them down.

Cyber
Resiliencein place to stop these types of changes fromoccurring in the source file packages and users
should maintain awareness of potential impact.

Social media platforms enabled theorganization and mobilization of
thousands of would-be citizen hackers,
who were provided directions for
conducting easily executable attacks
such as DDoS attacks.
Actionable insights
1

The technology industry must cometogether to design a comprehensive
response to this new threat.

2

Leading technology companies, including
Microsoft, have tools to identify malicious
traffic associated with DDoS attacks anddisable the responsible machines.

3

Open source users should keep aheightened watch during times ofgeopolitical strife.

Emergence of protestware
Protestware has emerged as a direct result of
emotional reactions to the war between Russia
and Ukraine. Some open source softwaredevelopers used the popularity of their software
as a means to speak up or take action against
an unfolding geopolitical situation. This included
harmless text files opened on a desktop or abrowser to spread messages of peace, but also
included targeted attacks based on IP address
geolocation and destructive actions such as
wiping a hard drive. As other global events
unfold, we can expect to see protestware surface
again in the future. Since these are generallycases where well-respected open-source
maintainers are deciding to make personalstatements using their own open sourcecomponents, there is currently no protection

ContributingTeams

29 Microsoft Digital Defense Report 2022

ReportIntroduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Endnotes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

https://www.reuters.com/business/energy/shell-re-routes-oil-supplies-after-cyberattackgerman-logistics-firm-2022-02-01/
https://www.bleepingcomputer.com/news/security/greeces-public-postal-service-offline-due-toransomware-attack/https://www.bleepingcomputer.com/news/security/costa-rica-s-public-health-agency-hit-byhive-ransomware/; https://www.reuters.com/world/americas/cyber-attack-costa-rica-growsmore-agencies-hit-president-says-2022-05-16/
https://www.bleepingcomputer.com/news/security/spicejet-airline-passengers-stranded-afterransomware-attack/https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-apreventable-disaster/
Endpoint detection and response. https://www.microsoft.com/en-us/security/business/threat-protection/
https://www.washingtonpost.com/national-security/cyber-command-revilransomware/2021/11/03/528e03e6-3517-11ec-9bc4-86107e7b0ab1_story.html
https://www.bbc.com/news/technology-59998925
A Vetted Forum is an online discussion forum that requires an existing member to vouch for the
addition of a new member.
https://www.statista.com/statistics/800426/worldwide-blockchain-solutions-spending/;
https://www.blockchain.com/charts/my-wallet-n-users; https://coinmarketcap.com
https://blogs.microsoft.com/on-the-issues/2022/04/13/zloader-botnet-disrupted-malware-ukraine/
https://www.coindesk.com/business/2021/12/13/crypto-exchange-ascendex-hacked-lossesestimated-at-77m/ ; https://www.zdnet.com/article/after-77-million-hack-crypto-platformascendex-to-reimburse-customers/
https://etherscan.io/address/0x73326b6764187b7176ed3c00109ddc1e6264eb8b
https://finance.yahoo.com/news/ethereum-worth-over-1-5m-160249300.html
https://news.bitcoin.com/decentralized-finance-crypto-exchange-uniswap-starts-blockingaddresses-linked-to-blocked-activities/
Data source: Defender for Office (malicious email/compromised identity activity), Azure Active
Directory Identity Protection (compromised identity events/alerts), Defender for Cloud Apps
(compromised identity data access events), and M365D (cross product correlation).
	

18 https://www.ic3.gov/Media/Y2022/PSA220504
19 Domain-based Message Authentication, Reporting and Conformance: An email authentication,
policy, and reporting protocol designed to give email domain owners the ability to protect their
domain from unauthorized use.
20 https://www.ic3.gov/Media/PDF/AnnualReport/2021_IC3Report.pdf
21 https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/learn-about-spoofintelligence?view=o365-worldwide
22 https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/impersonationinsight?view=o365-worldwide
23 https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defendersmartscreen/microsoft-defender-smartscreen-overview
24 https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-defender-office-365
25 https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defendersmartscreen/microsoft-defender-smartscreen-overview
26 Microsoft Corporation v. John Does 1-27, et. al., No. 1:10CV156, (E.D.Va. Feb 22, 2010).
27 See Bowden, Mark. Worm: The First Digital World War. Grove/Atlantic, Inc., Sep 27, 2011.
28 Specifically, Rule 65 of the Federal Rules of Civil Procedure allows a party to seek such remedy if: 1) the
party will suffer immediate and irreparable harm if the relief is not granted, and 2) the party attempts
to provide the other side notice in a timely manner. Moreover, the law requires that a balancing test be
applied, one which balances the defendant’s right to notice against the quantum of harm to the public.
29 Microsoft Corporation v. John Does 1-11, et. al., No. 2:11cv222, (W.D. Wa. Feb 9, 2011).
30 Microsoft Corp. v. Does, No. 1:20-cv-01171 (AJT/IDD), 2021 U.S. Dist. LEXIS 258143, at *1(E.D. Va. Aug. 12, 2021).
31 https://github.com/microsoft/routeros-scanner
32 RiskIQ: Ubiquiti Devices Compromised and Used as Malware C2 Reverse Proxies | RiskIQ
Community Edition
33 https://www.theguardian.com/world/2022/mar/18/amateur-hackers-warned-against-joiningukraines-it-army
34 https://therecord.media/russia-or-ukraine-hacking-groups-take-sides/
35 https://www.expats.cz/czech-news/article/pro-russian-hackers-target-czech-websites-in-aseries-of-attacks

30 Microsoft Digital Defense Report 2022

Nation State
Threats
Nation state actors are launching increasingly
sophisticated cyberattacks to evade detection
and further their strategic priorities.

ReportIntroduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

ContributingTeams

An overview of Nation State Threats

31

Introduction

32

Background on nation state data

33

Sample of nation state actors andtheir activities

34

The evolving threat landscape35

The IT supply chain as a gateway
to the digital ecosystem

37

Rapid vulnerability exploitation

39

Russian state actors’ wartime cybertactics threaten Ukraine and beyond

41

China expanding global targetingfor competitive advantage

44

Iran growing increasingly aggressive
following power transition

46

North Korean cyber capabilities employedto achieve regime’s three main goals
49
Cyber mercenaries threaten
the stability of cyberspace

52

Operationalizing cybersecurity norms
for peace and security in cyberspace

53

31

Microsoft Digital Defense Report 2022

An overview of

Nation State Threats
Nation state actors arelaunching increasingly
sophisticated cyberattacks
to evade detection and further
their strategic priorities.
The advent of cyberweapon
deployment in the hybrid
war in Ukraine is the dawnof a new age of conflict.
Russia has also supported its war withinformation influence operations, using
propaganda to impact opinions in Russia, in
Ukraine, and globally. This first full-scale hybrid
conflict has taught other important lessons.
First, the security of digital operations and data
can be best protected – both in cyberspace
and in physical space – by moving to the cloud.
Initial Russian attacks targeted on-premises
services with wiper malware, and targeted
physical data centers with one of the firstmissiles launched.

ReportIntroduction

The State ofCybercrime

Ukraine responded by rapidly moving workloads
and data to hyperscale clouds hosted in data
centers outside Ukraine. Second, advances incyber threat intelligence and endpoint protection
powered by the data and advanced AI and ML
services in the cloud have helped Ukraine defend
against Russian cyberattacks.
Elsewhere, nation state actors have increased
activity and are using advancements in
automation, cloud infrastructure, and remote
access technologies to attack a wider setof targets. Corporate IT supply chains thatenable access to ultimate targets were
frequently attacked. Cyber security hygiene
became even more critical as actors rapidly
exploited unpatched vulnerabilities, used bothsophisticated and brute force techniques to steal
credentials, and obfuscated their operations
by using opensource or legitimate software.
And Iran joins Russia in use of destructive
cyberweapons, including ransomware,
as a staple of their attacks.
These developments require urgent adoptionof a consistent, global framework that prioritizes
human rights and protects people from recklessstate behavior online. All nations must work to
implement agreed upon norms and rules forresponsible state conduct.
 	Defending Ukraine: Early Lessons fromthe Cyber War — Microsoft On the Issues

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Increased targeting of criticalinfrastructure particularly IT sector,
financial services, transportation systems,
and communications infrastructure.
Find out more on p35

NOBELIUM

China expanding
global targeting
especially smaller
nations inSoutheast
Asia, to gain
intelligenceand competitive
advantage.

Find out more on p44

Contributing
Teams

Iran grew increasingly aggressive
following power transition, expanded
ransomware attacks beyond regional
adversaries to US and EU victims,
and targeted high profile US criticalinfrastructure.
Find out more on p46

IT supply chain being
used as a gateway toaccess targets.

Find out more on p36

Cyber
Resilience

Identification and rapid exploitation of
unpatched vulnerabilities has become akey tactic. Rapid deployment of security
updates is key to defense.
Vulnerability
publicly
disclosedPatchreleased

14 days

60 days

Exploitationin wild

POC code releasedon GitHub

Find out more on p39

North Korea targeted defense and aerospacecompanies, cryptocurrency, news outlets,
defectors, and aid organizations, to achieve
regime’s goals: to build defense, bolster the
economy, and ensure domestic stability.
Find out more on p49

Cyber mercenaries threaten the stability of cyberspace as this growing industry ofprivate companies is developing and selling advanced tools, techniques, and services
to enable their clients (often governments) to break into networks and devices.
Find out more on p52

32

Microsoft Digital Defense Report 2022

Introduction
Following high-profile
attacks in 2020 and 2021,
nation state threat actors
spent significant resources
adapting to new security
protections implemented
by organizations to defend
against sophisticated threats.

ReportIntroduction

The State ofCybercrime

Much like enterprise organizations, adversaries
began using advancements in automation, cloudinfrastructure, and remote access technologies
to extend their attacks against a wider set oftargets. These tactical adjustments resulted in
new approaches and large scale attacks against
corporate supply chains. IT security hygiene
took on an even higher degree of importanceas actors developed new ways to rapidly exploit
unpatched vulnerabilities, expanded techniques
for compromising corporate networks, andobfuscated their operations by using opensourceor legitimate software. New attack techniques
provided new and harder-to-detect vectors
to gain access to a target’s network. Finally,
as wartime physical attacks escalated, we
saw cyberattacks take a prominent role inmilitary activity.
The conflict in Ukraine has provided an alltoo-poignant example of how cyberattacks
evolve to impact the world in parallel withmilitary conflict on the ground. Power systems,
telecommunication systems, media, andother critical infrastructure all became targetsof both physical attacks and cyberattacks.
Network compromise attempts commonly
observed as part of espionage and information
exfiltration campaigns became focused in hybrid
war on destructive wiper malware attacks against
critical infrastructure systems. Connecting thesecurity of these systems to the cloud resulted
in early detection and disruption of potentiallydevastating attacks.1

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

For the first time in a major cyber event,behavioral detections leveraging machinelearning used known attack patterns to
successfully identify and stop further attacks
without prior knowledge of the underlying
malware—even before humans were awareof the threats. We also confirmed the valueof sharing threat intelligence in real-time with
defenders protecting these systems, giving
them vital information to anticipate anddefend against active attacks.
Nation state threat actors around the worldcontinue to expand their operations in new
and old ways. China, North Korea, Iran, andRussia all carried out attacks on Microsoft
customers. The IT services supply chain became
a common target as actors shifted the focus
to upstream services that can be access points
to multiple organizations. We expect actors
to continue to exploit trusted relationships
in enterprise supply chains, emphasizing theimportance of comprehensive enforcementof authentication rules, diligent patching,
and account configuration for remote accessinfrastructure, and frequent audits of partner
relationships to verify authenticity.
Nation state actors, much like ransomware andcriminal operators, have responded to increased
exposure by moving toward targeting poorly
configured or unpatched enterprise systems(VPN/VPS infrastructure, on-premises servers,
third-party software) to perform living-offthe-land attacks. Many have increased use ofcommodity malware and open source red teamtools to obfuscate their malicious activity.

Cyber
Resilience

ContributingTeams

As a result, maintaining a strong baseline of IT
security hygiene through prioritized patching,enabling anti-tamper features, using attack
surface management tools like RiskIQ to get
an outside-in view of an attack surface, andenabling multifactor authentication acrossthe full enterprise have become baseline
fundamentals to proactively defend against
many sophisticated actors.
Nation state actors have also increased
use of ransomware as a tactic in their attacks,
often reusing ransom malware created by thatcriminal ecosystem in their attacks. We haveseen both Iran- and North Korea-based actors,
leveraging commodity ransomware tools todamage targeted systems, often including
critical infrastructure, within regional rivals.
Finally, we have seen the growing threat ofcyber mercenaries developing and selling
tools, techniques, and services to extend
exploits against vulnerable third-party solutions.
The sophistication and agility of attacks by nation
state actors will continue to evolve each year.
Organizations must respond by being informedof these actor changes and evolve defenses
in parallel.
John Lambert
Corporate Vice President and DistinguishedEngineer, Microsoft Threat Intelligence Center

33

Microsoft Digital Defense Report 2022

ReportIntroduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Background on
nation state data
Nation state threats are cyber threat
activities that originate in a specific country
with the apparent intent of furthering
national interests. Nation state actors
present some of the most advanced andpersistent threats our customers face,
including intellectual property theft,espionage, surveillance, credential theft,destructive attacks, and more.
We invest significant resources in discovering,understanding, and countering these threats.
When an organization or individual accountholder is targeted or compromised by observed
nation state activities, Microsoft delivers analert in the form of a nation state notification(NSN) directly to the customer, including theinformation they need to investigate the activity.
As of June 2022, we had delivered over 67,000
NSNs since we began in 2018.
Microsoft NSN alert data are presented inthis chapter to provide a view of measurable
activity. The level of nation state activity shownin the charts is based on the number of NSNs
Microsoft issued to customers in response to
the detection of nation state actors targetingor compromising at least one account in thecustomer organization.

The four primary nation states whose threat
groups we include in this report are Russia,
China, Iran, and North Korea. These represent
the countries of origin for the most commonly
observed actors targeting Microsoft customers
over the past year. The report also includes ourobservations about threat groups from Lebanon
and from cyber mercenaries, or private sector
offensive actors for hire.

Microsoft identifies nation state groups bychemical element names (such as NOBELIUM),
just some of which are shown on the following
page. We use DEV-#### designations as atemporary name given to an unknown, emerging,or developing cluster of threat activity, allowing
us to track it as a unique set of information until
we reach a high degree of confidence about theorigin or identity of the actor behind the activity.

Once it meets the criteria, a DEV is converted
to a named actor or merged with existing actors.
Throughout this chapter, we cite examples ofnation state and DEV groups to provide a deeper
view into attack targets, techniques, and analysis
of motivations. Although many of these groups
use the same tools as cybercriminals, theypresent unique threats in the form of bespoke
malware, the ability to discover and capitalize
on zero-day vulnerabilities, and legal impunity.

ReportIntroduction

34 Microsoft Digital Defense Report 2022

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Sample of nation state actors and their activities

Iran

RussiaNo
NOBELIUM

Sr
STRONTIUM

Sg
SEABORGIUM

Ir
IRIDIUMKey

IT, government,
think tanks,
highereducation
APT29
Government,
defense, thinktanks, higher
education
Fancy BearAc
ACTINIUMBr
BROMINEP

Ukrainian government,
military, law
enforcement

PHOSPHORUS

Criticalinfrastructure,operational
technology
Sandworm

SymbolACTIVITYGROUP

Commonly
targeted sectors
Industryreferences

Charming Kitten

Gamaredon

LebanonEnergy, aviation, criticalmanufacturing, defense
industrial baseEnergeticBear

Po

Israeli defense
industry, IT

Bh

IT, shipping
companies, Middle
East governments

BOHRIUM

Tortoiseshell

POLONIUM

North Korea

Intelligence/
Defensepersonnel, thinktanks
Callisto GroupMedia, human rights
activists, politicians,
and US transportationand energy

China

Ra

Government,
education,
defenseRADIUMGa
GALLIUM

Ni
NICKEL

Communications
infrastructure,
IT, government,
education
SoftCell

Gd
GADOLINIUM

Government.
NGOs
APT15
Vixen Panda

Telecommunications,NGOs, government
APT40

Ce

Government,
defense, energy,
aerospace

CERIUM

Cn

Cryptocurrency andrelated technology
companies

COPERNICIUM APT38,
Beagle Boyz

Pu

Science andtechnology,
defense, industrial

PLUTONIUM

Andariel, Dark Seoul,
Silent Chollima

Os

Think tanks,
academics,
NGOs, government

OSMIUM

Konni

Zn

Government,
defense, scienceand technology

ZINC

Lazarus35

ReportIntroduction

Microsoft Digital Defense Report 2022

The evolving
threat landscape
Microsoft’s mission to track nation state
actor activity and notify customers
when we see them being targeted orcompromised is rooted in our mission
to protect our customers from attacks.
This notification is a crucial part of ourcommitment to informing customers whether
observed attacks are successfully prevented
by our security product protections, or if theattacks are effective because of unknown
security weaknesses. Tracking notifications overtime helps Microsoft identify evolving threat
trends by actors and focus product protections
on proactively mitigating threats to customers
across our cloud services.
This tracking also allows us to share dataand insights about what we see. The analysts
tracking these actors and following their attacks
rely on a combination of technical indicatorsand geopolitical expertise to understandthe motivations of the actors, combining
technical and global context into new insights.
This curation provides a unique view into thepriorities of nation state cyber actors and how
their motivations might mirror the political,
military, and economic priorities of the nation
states employing them.

The State ofCybercrime

Political developments in the past year haveshaped the priorities and risk tolerance ofstate-sponsored threat groups worldwide.
As geopolitical relationships have broken
down and hawkish elements have acquired
more control in some nations, cyber actors
have become more brazen and aggressive.
For example:• Russia relentlessly targeted the Ukrainian
government and the country’s criticalinfrastructure to complement its on-theground military action.2• Iran aggressively sought inroads into US
critical infrastructure such as port authorities.
••
Although nation state actors can be technicallysophisticated and employ a wide variety oftactics, their attacks can often be mitigated bygood cyber hygiene. Many of these actors rely on
relatively low-tech means, such as spear-phishingemails, to deliver sophisticated malware insteadof investing in developing customized exploits
or using targeted social engineering to achieve
their objectives.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Industry sectors targeted by nation state actors
Communications

Other

2%

20%

Information technology

22%Intergovernmentalorganizations

2%
Transportation2%
Healthcare

2%
Media

Think tanks/NGOs

4%

17%

Finance

5%

Government

10%

Education

14%

Nation state groups targeted a range of sectors. Russian and Iranian state actors targeted the IT industry as ameans to access the IT firms’ customers. Think tanks, nongovernmental organizations (NGOs), universities, andgovernment agencies remained other common targets of nation state actors.

Nation state actors have a variety of objectives
that can result in targeting specific groupsof organizations or individuals. In the lastyear, supply chain attacks have increased,with a particular focus on IT companies.
By compromising IT service providers, threat
actors are often able to reach their original
target through a trusted relationship with thecompany that manages connected systems,

or potentially execute attacks on a much larger
scale by compromising hundreds of downstream
customers in one attack. After the IT sector, themost frequently targeted entities were thinktanks, academics attached to universities, andgovernment officials. These are desirable “softtargets” for espionage to collect intelligenceon geopolitical issues.

36

ReportIntroduction

Microsoft Digital Defense Report 2022

The State ofCybercrime

The evolving threat landscapeNation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Nation state actors’ geographic targeting

Continued

Critical infrastructure trends
34%

18%

20%

40%

1000

45
40

NSNs

800

35
30

600

25 %
20

400

15

Most

10

200

5

0

Jul 2018–Jun 2019

Jul 2019–Jun 2020

Critical infrastructure

Noncritical infrastructure

Jul 2020–Jun 2021

Jul 2021–Jun 2022

Least

Percentage critical infrastructure of total NSNs

Nation state groups’ targeting of critical infrastructure3 increased in the past year, with actors’ focusing on
companies in the IT sector, financial services, transportation systems, and communications infrastructure.

“Before the invasion of Ukraine, governments thought thatdata needed to stay inside a country in order to be secure.
After the invasion, migrating data to the cloud and moving
outside territorial borders is now a part of resiliency
planning and good governance.”
Cristin Flynn Goodwin,
Associate General Counsel, Customer Security & Trust0

Nation state groups’ cyber targeting spanned theglobe this past year, with a particularly heavy focus on
US and British enterprises. Organizations in Israel, theUAE, Canada, Germany, India, Switzerland, and Japan
were also among some of the most frequently targeted,according to our NSN data.

Actionable insights
1

Identify and protect your potential highvalue data targets, at-risk technologies,
information, and business operations
which might align with the strategic
priorities of nation state groups.

2

Enable cloud protections to provide
identification and mitigation of known
and novel threats to your network at scale.

37

Microsoft Digital Defense Report 2022

The IT supply chain
as a gateway to thedigital ecosystem
Nation state targeting of IT service
providers might enable the threat actors
to exploit other organizations of interestby taking advantage of trust and accessgranted to these supply chain providers.
In the past year, nation state cyber threat
groups targeted IT services providers to
attack third-party targets and gain accessto downstream clients in government,
policy, and critical infrastructure sectors.
IT service providers are attractive intermediarytargets as they serve hundreds of direct andthousands of indirect clients of interest toforeign intelligence services. If exploited, theroutine business practices and the delegatedadministrative privileges these firms enjoy, mightallow malicious actors to access and manipulate
IT service provider client networks without
immediately triggering alerts.
In the past year, NOBELIUM attempted tocompromise and leverage privileged accounts
at cloud solutions and other managed services
providers to attempt targeted downstream
access into primarily US and European
government and policy customers.

ReportIntroduction

The State ofCybercrime

NOBELIUM demonstrated how a “compromise
one to compromise many” approach could
be directed against a perceived geopolitical
adversary. This past year, the threat actor pursued
both third-party and direct intrusions into
sensitive organizations based in member statesof the North Atlantic Treaty Organization (NATO),
which the Russian government perceives as anexistential threat. Between July 2021 and early
June 2022, 48 percent of Microsoft’s customer
notifications of Russian threat activity against
online services customers went to IT sector
firms based in NATO member countries, likely asintermediary access points. Overall, 90 percent
of notifications about Russian threat activity
during the same period went to customers basedin NATO member states, primarily in the IT,
think tanks and nongovernmental organizations(NGOs), and government sectors, suggestinga strategy of pursuing multiple means of initialaccess to these targets.

There has been a shift from
exploiting the software supply chain
to exploiting the IT services supply
chain, targeting cloud solutions andmanaged services providers to reachdownstream customers.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Approaches to compromise– Path 1– Path 2

Social engineering

Managed services
provider/Cloud
services provider

IT provider/Cloud
services provider

Stolen credentials
from on-premises

NOBELIUM

Cloud
services provider
Azure active directory trust relationship

On-premises accessGovernment
target #1

IT provider

Remote access solutions

Managed services
providerGovernment
target #2

This diagram depicts NOBELIUM’s multi-vectored approach to compromising its ultimate targets and the collateral
damage to other victims along the way. In addition to the actions shown above, NOBELIUM launched password
spray and phishing attacks against the entities involved, even targeting the personal account of at least one
government employee as another potential route to compromise.

38 Microsoft Digital Defense Report 2022

The IT supply chain
as a gateway to thedigital ecosystem
Continued

Throughout the year, Microsoft ThreatIntelligence Center (MSTIC) detected anincreasing number of Iranian state and Iranaffiliated actors compromising IT companies.
In many cases, actors were detected stealing
sign-in credentials to gain access to downstream
clients for a range of objectives, from intelligencecollection to retaliatory destructive attacks.
• In July and August 2021, DEV-0228
compromised an Israeli business software
provider to later compromise downstream
customers in the Israeli defense, energy,
and legal sectors.4• From August to September 2021, Microsoft
detected a spike in Iranian state actors
targeting IT companies based in India. The lackof pressing geopolitical issues that would haveprompted such a shift suggests this targeting
is for indirect access to subsidiaries and clientsoutside India.

ReportIntroduction

The State ofCybercrime• In January 2022, DEV-0198, a group we
assess is affiliated with the government of
Iran, compromised an Israeli cloud solutions
provider. Microsoft assesses the actor
likely used compromised credentials fromthe provider to authenticate into an Israeli
logistics company. MSTIC observed the sameactor attempting to conduct a destructive
cyberattack against the logistics company
later that month.
• In April 2022, POLONIUM, a Lebanon-based
group we assess collaborated with Iranianstate groups on IT supply chain techniques,
compromised another Israeli IT company
to gain access to Israeli defense and legalorganizations.5
This past year of activity demonstrates thatthreat actors like NOBELIUM and DEV-0228
are getting to know the landscape of anorganization’s trusted relationships better thanthe organizations themselves. This increased
threat emphasizes the need for organizations
to understand and harden the borders and entry
points of their digital estates. It also underscores
the importance for IT service providers to
rigorously monitor their own cybersecurity
health. For example, organizations should
implement multifactor authentication andconditional access policies that make it harderfor malicious actors to capture privileged
accounts or spread throughout a network.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Conducting a thorough review and auditof partner relationships helps minimize any
unnecessary permissions between yourorganization and upstream providers andimmediately remove access for any relationshipsthat look unfamiliar. Increasing familiarity withactivity logs and reviewing available activity
makes it easier to spot anomalies that could
spark further investigation.

Nation state targeting of third parties
enables them to exploit sensitive
organizations by taking advantageof trust and access in a supply chain.

Cyber
Resilience

Contributing
Teams

Actionable insights
1

Review and audit upstream and downstream
service provider relationships and delegatedprivilege accesses to minimize unnecessary
permissions. Remove access for any partner
relationships that look unfamiliar or have notyet been audited.6

2

Enable logging and review all authentication
activity for remote access infrastructure andvirtual private networks (VPNs), with a focus
on accounts configured with single factor
authentication, to confirm authenticity andinvestigate anomalous activity.

3

Enable MFA for all accounts (including
service accounts) and ensure MFA is
enforced for all remote connectivity.

4

Use passwordless solutions tosecure accounts.7

Links to further information
NOBELIUM targeting delegatedadministrative privileges to facilitate
broader attacks | Microsoft ThreatIntelligence Center (MSTIC)
Iranian targeting of IT sector on the rise
| Microsoft Threat Intelligence Center(MSTIC), Microsoft Digital Security Unit
Exposing POLONIUM activity andinfrastructure targeting Israeliorganizations | Microsoft ThreatIntelligence Center (MSTIC)

39

ReportIntroduction

Microsoft Digital Defense Report 2022

The State ofCybercrime

Rapid vulnerability
exploitation

This ensures that vulnerabilities are identified,and patches developed in a timely manner
to protect customers from previously
unknown threats.

As organizations strengthen theircybersecurity postures, nation state
actors respond by pursuing new andunique tactics to deliver attacks andevade detection. The identification andexploitation of previously unknown
vulnerabilities—known as zero-day
vulnerabilities—is a key tactic in this effort.

Many organizations assume they are less likely
to be a victim of zero-day exploit attacks if
vulnerability management is integral to their
network security. However, the commoditizationof exploits is leading them to come at a much
faster rate. Zero-day exploits are often discoveredby other actors and reused broadly in a shortperiod of time, leaving unpatched systems at
risk. Even though zero-day exploitation can bedifficult to detect, actors’ post-exploit actions areoften easier to detect and, if coming from fully
patched software, can act as a warning sign ofa compromise.

250
24

200

Cyber Influence
Operations

17

Jul–Dec 2021

Jan–Jun 2022

11

Jul–Dec 2020

14

Jan–Jun 2021

Jul–Dec 2019

Jul–Dec 2018

12

Jan–Jun 2019

Jul–Dec 201715

Jan–Jun 2018

10

10

Jul–Dec 201611

Jul–Dec 2015

018

Jan–Jun 2016

50

6 6
19 3

Jan–Jun 2017100

8

Jan–Jun 2020

150

Cyber
Resilience

Contributing
Teams

Speed and scale of vulnerability commoditization

33

Jul–Dec 2014

As cyber threat actors—both nation stateand criminal—become more adept atleveraging these vulnerabilities, we haveobserved a reduction in the time between
the announcement of a vulnerability andthe commoditization of that vulnerability.
This makes it essential that organizations patch
exploits immediately. Similarly, it is criticalthat organizations or individuals that uncover
new vulnerabilities responsibly disclose orreport them to affected vendors as soon as
possible, in line with coordinated vulnerability
disclosure procedures.

Devices andInfrastructure

Numbers of publicly disclosed zero-day exploits from the
List of Common Vulnerabilities and Disclosures (CVEs).

Risk

Vulnerability
publicly
disclosedPatchreleased

120 days

14 days

60 days

Exploitationin wild

POC code releasedon GitHub

Days

Available inscanning tools

On average, it takes only 14 days for an exploit to be available in the wild after a vulnerability is publicly disclosed.
This view provides an analysis of the timelines of exploitation of zero-day vulnerabilities, along with the number ofsystems vulnerable to the given exploit and active on the internet from the time of first public disclosure.

Patches released for zero-day vulnerabilities

Jan–Jun 2015

Zero-day vulnerabilities are a particularly
effective means for initial exploitation and, once
publicly exposed, vulnerabilities can be rapidly
reused by other nation state and criminal actors.
The number of publicly disclosed zero-day
vulnerabilities over the past year is on par withthose from the previous year, which was thehighest on record.

Nation State
Threats

While zero-day vulnerability attacks
tend to initially target a limited set oforganizations, they are quickly adopted
into the larger threat actor ecosystem.
This kicks off a race for threat actors
to exploit the vulnerability as widely as
possible before their potential targets
install patches.
While we observe many nation state actors
developing exploits from unknown vulnerabilities,
China-based nation state threat actors are
particularly proficient at discovering anddeveloping zero-day exploits. China’s vulnerability
reporting regulation went into effect September

2021, marking a first in the world for a government
to require the reporting of vulnerabilities intoa government authority for review prior to thevulnerability being shared with the product orservice owner. This new regulation might enable
elements in the Chinese government to stockpile
reported vulnerabilities toward weaponizingthem. The increased use of zero days over the lastyear from China-based actors likely reflects thefirst full year of China’s vulnerability disclosure
requirements for the Chinese security community
and a major step in the use of zero-day exploits as
a state priority. The vulnerabilities described below
were first developed and deployed by Chinabased nation state actors in attacks, before being
discovered and spread among other actors in thelarger threat ecosystem.

40 Microsoft Digital Defense Report 2022

Rapid vulnerability
exploitation
Continued

Even organizations thatare not a target of nation
state attacks have a limited
period to patch zero-day
vulnerabilities in impacted
systems before they are
exploited by the broader
actor ecosystem.

ReportIntroduction

The State ofCybercrime

These examples of newly identified vulnerabilities
demonstrate that organizations have on average
60 days from the time a vulnerability is patched
and a proof of concept (POC) code is madeavailable online, and often picked up by otheractors for reuse. Similarly, organizations haveon average 120 days before a vulnerability isavailable in automated vulnerability scanningand exploitation tools such as Metasploit—
which often result in the exploit being used
on a massive scale. This highlights that evenorganizations that are not a target of nation state
threat actors have a limited period to patch zeroday vulnerabilities in impacted systems before
the vulnerabilities are exploited by the broader
actor ecosystem.
CVE-2021-35211 SolarWinds Serv-U
In July 2021, SolarWinds released a security
advisory for CVE-2021-35211, crediting Microsoft
with the notification.8 At the time, we discovered
nation state aligned threat actor DEV-0322
actively exploiting the SolarWinds Serv-U
vulnerability. Our RiskIQ team observed 12,646 IP
addresses hosting internet connected versions of
the impacted devices between June 15 and July 9.
CVE-2021-40539 Zoho ManageEngine
ADSelfService Plus
In September 2021, our researchers observed
China-affiliated actors exploiting Zoho
ManageEngine at several US-based entities.
The vulnerability was publicly reported
on September 6 as CVE-2021-40539 Zoho
ManageEngine ADSelfService Plus, whichorganizations typically use to handle password
resets.9 DEV-0322 exploited the vulnerability

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

later in September, using it as an initial vector
to gain a foothold in networks and performing
additional actions including credential dumping,installing custom binaries, and dropping malware
to maintain persistence. At the time of disclosure,
RiskIQ observed 4,011 instances of these systems
active and on the internet.
CVE-2021-44077 Zoho ManageEngine
ServiceDesk Plus
In late October 2021, we observed DEV-0322
leveraging a vulnerability (CVE-2021-44077)
in a second Zoho ManageEngine product,
ServiceDesk Plus—an IT help-desk softwarewith asset management. DEV-0322 used
this vulnerability to target and compromise
entities in healthcare, information technology,
higher education, and critical manufacturingsectors. On December 2, the Federal Bureau of
Investigation (FBI) and the Cybersecurity andInfrastructure Security Agency (CISA) issued ajoint advisory warning to the public about nation
state threat actors leveraging the vulnerability.
At the time of disclosure, RiskIQ observed
7,956 instances of these systems active andon the internet.

Cyber
Resilience

61,559 instances of these systems active andon the internet, at the time of disclosure.
We continued to observe exploitation activity
into November 2021.
CVE-2022-26134 Confluence
A China-affiliated actor likely had the zero-day
exploit code for the Confluence vulnerability(CVE-2022-26134) four days before thevulnerability was publicly disclosed on June 2,and likely leveraged it against a US-based entity.
At the time of disclosure, RiskIQ observed 53,621
instances of vulnerable Confluence systems on
the internet.

Vulnerabilities are being picked up and
exploited on a massive scale, and inincreasingly shorter timeframes.
Actionable insights
1

Prioritize patching of zero-day
vulnerabilities as soon as they are
released; don’t wait for the patch
management cycle to deploy.

2

Document and inventory all
enterprise hardware and software
assets to determine risk and to quickly
determine when to act on patches.

CVE-2021-42321 Microsoft Exchange
A zero-day exploit for an Exchange vulnerability
CVE-2021-42321 was revealed during the Tianfu
Cup, an international cybersecurity summit andhacking competition held October 16 and 17,
2021 in Chengdu, China. Security researchers at
Microsoft observed the exploit for the Exchange
vulnerability used in the wild on October 21, only
three days after the vulnerability was revealed.
At the time of disclosure, RiskIQ observed

Contributing
Teams

41

Microsoft Digital Defense Report 2022

Russian state actors’
wartime cyber tactics
threaten Ukraine
and beyond
This year saw Russian state actors launchingcyber operations to complement military
action during Russia’s invasion of Ukraine,
often using the same tactics and techniques
deployed against targets outside of Ukraine.
It is critical that organizations worldwide
take measures to harden cybersecurity
against digital threats stemming from
Russia-aligned threat actors.
The situation on the ground continues
to fluctuate as the military conflict persists,
and Ukraine and its allies should be prepared
to defend themselves if Russian state cyber
operators increase the frequency or intensityof intrusions in line with military objectives.
During the first four months of the war,
Microsoft observed threat actors associatedwith the Russian military launch multiple waves
of destructive cyberattacks against nearly 50
distinct Ukrainian agencies and enterprises
and espionage-focused intrusions against
many others. Excluding operations against
online services customers, 64 percent of
Russian threat activity against known targets
was directed at Ukraine-based organizations
between late February and June.

ReportIntroduction

The State ofCybercrime

In each operation, Russian threat actors
employed many of the tactics, techniques,and procedures (TTPs) we observed being used
before invasion against targets both within andoutside of Ukraine. These actors intended todestroy data and put Ukrainian government
agencies off balance in the initial period of theconflict. They have since sought to derail thetransport of military and humanitarian assistanceto Ukraine, disrupt public access to services andmedia, and steal information of longer-term
intelligence or economic value to Russia.
Targeting transportation threatens an area of
critical importance to Ukrainian citizens trying
to survive the conflict. According to a UNICEFsponsored survey in May, respondents inconflict-affected urban areas were most worried
about transport and fuel, supply disruptions,security, and limited access to food, medical
services, and financial services.10 In June, theUN Crisis Coordinator for Ukraine said at least
15.7 million people in Ukraine were in urgent
need of humanitarian assistance, and thenumber would grow as the war continues.11
Outside of Ukraine, Microsoft detected
Russian network intrusion efforts against
128 organizations in 42 countries between
late February and June. The United States was
Russia’s number one target. Poland, throughwhich much of the international military andhumanitarian assistance to Ukraine transits,
was also a significant target during this period.
Threat actors affiliated with the Russian statepursued organizations in Baltic countries andcomputer networks in Denmark, Norway, Finland,
and Sweden in April and May as well.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Most targeted industry sectors in Ukraine since the invasion
Information technology

10%Consumer retail

3%

Energy

8%

Other

21%
Media

9%

Nuclear

Transportation

3%

7%
Communications

7%
Financial

5%

Government

27%

Federal, state, and local government organizations in Ukraine have remained priority targets for Russian state andstate-affiliated threat groups throughout the conflict. The focus on transportation, energy, financial, and media
sector organizations highlight the risk that these cyber operations pose to services on which Ukrainian citizens rely.

42

Microsoft Digital Defense Report 2022

Russian state actors’
wartime cyber tactics
threaten Ukraine
and beyond
Continued

We have seen an increase in similar
activity targeting the foreign ministries ofNATO countries.
Russian state threat groups remained interested
in compromising critical infrastructure bothwithin and outside of Ukraine this past year.
IRIDIUM deployed the Industroyer2 malware in a
failed effort to leave millions of people in Ukraine
without power. Outside of Ukraine, BROMINE
conducted intrusions against organizations
involved in manufacturing, and industrial control
systems in early 2022.

ReportIntroduction

The State ofCybercrime

utilized compromised or spoofed accounts
at targeted organizations or within the same
industry and compelling themes to lure victims.
NOBELIUM used compromised diplomatic
accounts to send phishing mail disguised as
diplomatic communications to foreign ministry
employees across the globe. STRONTIUM createdspoof accounts based on publicly available
names of account holders at think tanks in the
United States and sent phishing messages togain access to accounts at those think tanks.
SEABORGIUM phished using lures related toreporting on the Ukraine conflict to gain initialaccess to accounts at international affairs thinktanks in the Nordic countries.
Exploitation of IT services supply chain to
impact downstream customers

Spear phishing with malicious attachments
or links

In late 2021, Russian state actors compromised
IT services providers and used the accessto facilitate website defacements and thedeployment of Whispergate destructive malware
by DEV-0586 in January.12 DEV-0586 also
compromised the network of an IT firm that built
resource management systems for Ukraine’s
Ministry of Defense and other organizations in
the communications and transportation sectors,
indicating the group was exploring third-party
attack options in those sectors as well.

Russian state and Russia-affiliated groups like
ACTINIUM, NOBELIUM, STRONTIUM, DEV0257, SEABORGIUM, and IRIDIUM all usedphishing campaigns to gain initial access todesired accounts and networks in organizations
within and outside Ukraine. Many campaigns

Worldwide, but especially in the United Statesand Western Europe, NOBELIUM targeted IT
services providers to gain access to governmentand other sensitive networks throughout
2021–2022 (see the discussion of supply chain
vulnerabilities earlier in this chapter).

Russian state and state-affiliated actors directedcyber operations against Ukraine, its allies, andother targets of intelligence value this year using
many of the following TTPs:

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Cyber
Resilience
Resilience

Contributing
Teams

Russia: Top targeted countries and industry sectors

Information
technology 29%

United States 55%
Nongovernmentalorganizations 18%

RussiaUnited Kingdom 8%
Canada 3%

Government agencies
and services 12%

Education 12%

Germany 3%
Switzerland 2%
Ukraine 2%

Other 27%

Financial services 5%

Other 24%

Despite an intensified focus on Ukraine-based organizations since early 2022, enterprises based in North America
and Western Europe were still the online service customers Russian actors targeted most. NOBELIUM’s campaign
against the IT sector made it the most targeted sector this past year.

43

Microsoft Digital Defense Report 2022

Russian state actors’
wartime cyber tactics
threaten Ukraine
and beyond
Continued

Exploitation of public-facing applications
to gain initial access to networks
Since at least late 2021, STRONTIUM worked
to develop and refine its capabilities to exploit
public-facing services, such as Microsoft
Exchange servers, to steal information.
STRONTIUM exploited unpatched Exchange
servers to access Ukrainian government accounts
as well as military and defense industry-relatedorganizations in the United States, Lebanon, Peru,
and Romania, and other government agencies
based in Armenia, Bosnia, Kosovo, and Malaysia.
DEV-0586, also affiliated with the Russian military,
exploited Confluence server vulnerabilities togain initial access to government and IT sector
organizations in Ukraine and other Eastern
European countries.

Russian state and affiliated threat
actors use many of the same TTPs tocompromise organizations of interest
during times of war and peace.

ReportIntroduction

The State ofCybercrime

Use of administrative accounts and protocols,
and native utilities for network discovery andlateral movement
After gaining initial access to a network,
Microsoft observed Russian state actors
leveraging legitimate accounts and software
utilities used to perform basic maintenancetasks to evade detection for as long as
possible. They relied on compromised
identities with administrative capabilities andvalid administration protocols, tools, andmethods to move laterally within networks
without immediately attracting the attention of
automated monitors and network defenders.

Nation State
Threats

Cyber Influence
Operations

Actionable insights
1

2

3

Basic cyber hygiene and employment of endpoint
detection and response tools can help mitigate
the negative impact of these types of operations
in peacetime as well as during times of war.

The unpredictability of the ongoing
conflict demands that organizations
worldwide take measures to harden
cybersecurity against digital threats
stemming from Russian state andRussia-affiliated threat actors.

Devices andInfrastructure

4

Minimize credential theft and accountabuse by protecting the identitiesof your users by implementing MFA
identity protection tools and enforcing
least privilege access to secure themost sensitive and privileged accounts
and systems.
Apply updates to ensure all your systems
get the highest level of protection as soon
as possible and are kept up to date.
Deploy anti-malware, endpoint detection,and identity protection solutions acrossyour organization. A combination of
defense-in-depth security solutions, pairedwith trained and capable personnel, canempower your organization to identify,
detect, and prevent intrusions impacting
your business.
Enable investigations and recovery in theevent you detect or receive notification ofa threat to your environment by backing
up critical systems and enabling logging.
Establishing an incident response plan isstrongly encouraged.

Cyber
Resilience

Contributing
Teams

Links to further information
Defending Ukraine: Early Lessons fromthe Cyber War | Microsoft On the Issues
The hybrid war in Ukraine | Microsoft On
the Issues
Cyber threat activity in Ukraine: analysis
and resources | Microsoft Security
Response Center (MSRC)
Disrupting cyberattacks targeting
Ukraine | Microsoft On the Issues
Malware attacks targeting Ukraine
government | Microsoft On the Issues
MagicWeb: NOBELIUM’s post-compromise
trick to authenticate as anyone | Microsoft
Threat Intelligence Center (MSTIC),
Detection and Response Team (DART),
Microsoft 365 Defender Research Team

44 Microsoft Digital Defense Report 2022

China expanding
global targeting forcompetitive advantage
In today’s complex geopolitical climate,
Chinese state and state-affiliated threat
actors conducting cyber operations often
aim to further the country’s strategic military,economic, and foreign relations goals as partof China’s objective to attain competitive
advantage. In the last year, Microsoft
has observed widespread Chinese threat
activity targeting countries around the world.
Since mid-2021, China has been maneuvering
to ensure economic and financial stability amid
the worst COVID-19 surge in two years.13 China
continued to juggle their position on geopoliticalevents, such as the struggle to balance their“limitless” partnership with Russia,14 and maintaintheir position on the world stage.15 In addition,
China’s stance against the United States andits allies over Taiwan16 and the South China
sea continued to strain foreign relations
with many countries.17

Chinese state and state-affiliated threat
groups increased targeting of smaller
nations around the globe with a focus
on Southeast Asia to gain competitive
advantage on all fronts.

ReportIntroduction

The State ofCybercrimeCountries targeted by Chinese stateand state-affiliated groups

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

China: Top targeted countries and industry sectors

Nongovernmentalorganizations 28%

United States 54%
Digital print andbroadcast media 17%

China
China also continued expanding its economic
influence globally through previously established
Belt and Road Initiatives (BRI), attempting torevive a comprehensive investment frameworkwith the EU,18 and negotiating a new regional
trade agreement with 15 countries in Asia
Pacific known as the Regional Comprehensive
Economic Partnership.19 Microsoft assesses China
will continue to utilize cyber collection as a tool
to help advance its strategic political, military,and economic goals due to observed cyber
operations and the breadth of entities targeted.
Cyber targeting likely to advance economic
and military interests.
Microsoft observed widespread targeting of
smaller nations around the world by Chinesestate and state-affiliated threat groups,
suggesting China is likely using cyberespionage
as a component of its global economic andmilitary influence.

United Kingdom 7%
Canada 5%

Taiwan 5%

Italy 3%

Other 26%

Information
technology 10%
Education 9%
Government agencies
and services 9%

Other 27%

Think tanks/NGOs, media, IT, government, and education sectors were among the most targeted sectors
for China-based threat groups, probably for persistent intelligence collection and reconnaissance.

The span of targets included, but were notlimited to, countries in Africa, the Caribbean,
the Middle East, Oceania, and South Asia, with aparticular focus on those countries in Southeast
Asia, and the Pacific Islands.
In line with China’s BRI strategy, China-based
threat groups targeted entities in Afghanistan,
Kazakhstan, Mauritius, Namibia, and Trinidad andTobago.20 For example, Trinidad and Tobago was
the first Caribbean country to endorse China’s
BRI strategy in 2018, and China considers it animportant partner in the region. NICKEL has
had persistent network operations targeting
Trinidad and Tobago since 2021. For instance, inMarch 2022, NICKEL conducted reconnaissanceactivities targeting a government agency, likely
for intelligence collection purposes.

45

Microsoft Digital Defense Report 2022

China expanding
global targeting forcompetitive advantage
Continued

Meanwhile, Microsoft observed Chinese stateand state-affiliated threat groups focusing their
network operations against entities in Southeast
Asia and expanding to Pacific Island countries as
China shifted its military and economic priorities
to cope with the challenges of the United States’
renewed interest in the region. In January 2022,
Microsoft observed RADIUM targeting an energy
company and an energy-associated government
agency in Vietnam, and an Indonesian
government agency. RADIUM’s activities likelyaligned with China’s strategic goals in the South
China Sea.21 In late February and early March,
GALLIUM compromised more than 100 accounts
affiliated with a prominent intergovernmentalorganization (IGO) in the Southeast Asia region.
The timing of GALLIUM’s targeting of the IGO in
the region coincided with the announcement ofa scheduled meeting between the United States
and regional leaders. GALLIUM actors were likely
tasked to monitor communications and collectintelligence before the event.
As China expanded its influence in Pacific Island
countries, Chinese threat groups’ activities
followed. In April, China and the Solomon
Islands signed a security agreement intended to“promote peace and security.” The agreement
potentially allows China to deploy armed police

ReportIntroduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

and military to the Solomon Islands.22 In May,
China hosted the second China-Pacific Island
Countries (PICs) Foreign Ministers’ Meeting inFiji and proposed to advance a “comprehensive
strategic partnership” to further political, cultural,social, security, and climate change interests andalso to fight the pandemic.23 Around the sametime in May, Microsoft identified GADOLINIUM’s
malware on Solomon Islands government
systems. RADIUM also ran malicious code on
systems of a telecommunications company inPapua New Guinea. We assess these activities
were likely for intelligence collection purposes
to support China’s overall regional strategy.

government, diplomatic, and NGO sectors togain new insights, likely in pursuit of economic
espionage or traditional intelligence collection
objectives. Since Microsoft’s disruption, NICKEL
has targeted several government agencies,
likely trying to regain lost access. Between lateMarch and May 2022, NICKEL re-compromised
at least five government agencies across theglobe. This suggests the group had additional
entry points to those entities or regained accessthrough new C2 domains. NICKEL’s persistence inrepeatedly compromising the same government
agencies globally indicates the importance of thetask at a high level.

Microsoft disrupts NICKEL operations, but thethreat group shows its persistence.

China is being more assertivewith their stance on foreign policy.
We assess cyber-enabled economic
espionage and intelligence collection
will likely continue.

In December 2021, the Microsoft Digital Crimes
Unit (DCU) filed pleadings with the US District
Court for the Eastern District of Virginia seeking
authority to seize 42 command and control (C2)domains controlled by NICKEL. These C2 domains
were used in operations against governments,
diplomatic entities, and NGOs across Central andSouth America, the Caribbean, Europe, and North
America since September 2019.24 Through these
operations, NICKEL achieved long-term access toseveral entities and consistently exfiltrated datafrom some victims since late 2019.
As China continues to establish bilateral
economic relations with more countries—
often in agreements associated with BRI—
China’s global influence will continue to grow.
We assess Chinese state and state-affiliatedthreat actors will pursue targets in their

Cyber
Resilience

Contributing
Teams

Actionable insights
1

Boost cyber defense to mitigate cyberthreats proactively. The persistenceof Chinese threat actors requiresorganizations to identify, protect, detect,and respond possible intrusions in atimely fashion.

2

Threat actors abuse scheduled tasks25 as
a common method of persistence anddefense evasion, ensure your environment
employs additional security guidelines
to protect against this commonly usedtechnique.26

3

We continue to observe the use of web
shells as an initial vector into targeted
networks.27 Organizations should harden
their systems against web shells attacks
that can provide attackers access to run
remote commands.28

Links to further information
NICKEL targeting governmentorganizations across Latin America andEurope | Microsoft Threat Intelligence
Center (MSTIC), Microsoft Digital Security
Unit (DSU)
Protecting people from recent
cyberattacks | Microsoft On the Issues

46 Microsoft Digital Defense Report 2022

Iran growing
increasingly
aggressive following
power transition
Microsoft has observed Iranian stategroups and affiliated actors increase thepace and scope of cyberattacks against
Israel, expand ransomware attacks
beyond regional adversaries to US and EU
victims, and target high profile US criticalinfrastructure to at least pre-position forpotential destructive cyberattacks.
Iranian state actors’ growing cyber aggression
has followed a transition of its presidential
power. In the summer of 2021, hardline President
Ibrahim Raisi replaced moderate President
Hassan Rouhani. In sharp contrast to Raisi, who
is a protégé of the Supreme Leader and a close
ally of the Islamic Revolutionary Guard Corps(IRGC), former President Rouhani’s penchantfor diplomacy often brought him at odds with
the Supreme Leader and IRGC senior leaders.29
The hawkish views of the Raisi administration
appear to have raised the willingness of Iranian
actors to take bolder action against Israel and theWest, particularly the United States, despite theresumption of diplomatic engagement to revive
the nuclear deal with Iran.

ReportIntroduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Increased pace and scope of Iraniancyberattacks against Israel

Iranian threat to US and Israeli criticalinfrastructure mounted throughout the year

Within weeks of Raisi completing the formationof his foreign policy team,30 Iranian state actors
resumed destructive cyberattacks against
Israel at a faster pace than the prior year.
These ransomware and hack-and-leak attacks
were conducted every few weeks beginningin September and involved at least three Iranaffiliated actors, suggesting the attacks might
have been part of a nationwide campaign ofretaliation against Israel. In at least one case,
Microsoft assessed a ransomware attack
against an Israeli organization in late 2021 wasmeant to conceal an underlying data deletionattack. Microsoft malware analysis determined
the ransomware delivered to the victim wasprogrammed to execute wiper malware
following encryption.

Iranian state actors Microsoft assesses areaffiliated with the IRGC (PHOSPHORUS and
DEV-0198) targeted high-profile US and Israeli
critical infrastructure from late 2021 to mid-2022.
The likely aim was to provide Tehran with options
to retaliate against the same sectors that senior
IRGC officials blamed the United States and Israel
for disrupting in Iran.31 We assess this activity is
tied to statements in late October 2021 by IRGC
General Gholamreza Jalali, head of Iran’s Passive
Defense Organization, who echoed accusations
from other influential figures within the regime
that the United States and Israel conductedcyberattacks on Iran’s ports, railways, and fuelingstations.32 Jalali delivered this accusation asecond time in prepared remarks during a staged
Friday prayer speech at a podium with the imageof a missile striking the words “USA,” suggesting
his seniors held the same view.33

By 2022, Iranian cyberattacks escalated in target
selection and form of attacks. In February,
DEV-0198 attempted to conduct a destructive
attack against Israeli critical infrastructure.
Microsoft also assesses an Iran-affiliated actor
was most likely responsible for a sophisticatedcyberattack that set off emergency rocket sirens
in Israel in June probably by using software that
adjusts audio over IP networks.

PHOSPHORUS began widespread scanningof US organizations in October 2021 for
unpatched Fortinet and ProxyShell vulnerabilities.
Once compromised, these unpatched systems
were used to execute ransomware attacks, inseveral cases against critical infrastructure in
the United States and other Western nations.
These marked the first confirmed cases of Iranianstate affiliated ransomware attacks outside theMiddle East. Following the cyberattack against
Iran’s fueling stations in late October, Microsoft
observed a spike in Iranian ransomware
attacks against US companies, suggesting
possible correlation.

Cyber
Resilience

ContributingTeams

At the same time, PHOSPHORUS moved into
directed targeting, often via spear phishing, of
high-profile US critical infrastructure companies
including major seaports and airports of entry,transit systems, utility companies, and oil andgas companies. This targeting, often conducted
via spear phishing, lasted until mid-2022.
The targets directly align with the sectors Tehran
has blamed the United States and Israel for
attacking in Iran, and likely provided Iran with
options for retaliation. The compromise of near
identical targets would provide an opportunity
to deter such future attacks, while seeking to
avoid escalation by signaling the cause of attacks
without admitting guilt.
Resurgence of Iranian infrastructure targeting
56%

24%

19%

39%

250

100

200

80

150

60

100

40

50

20

0

Jul 18–Jun 19 Jul 19–Jun 20 Jul 20–Jun 21 Jul 21–Jun 22

Criticalinfrastructure

Noncriticalinfrastructure%0Percent criticalinfrastructureof total NSNs

Iranian targeting of critical infrastructure increased
to the highest levels observed since late 2018 to early2019. We used US Presidential Policy Directive 21(PPD-21) to determine whether a company fit thecriteria of critical infrastructure. (July 2021–June 2022).

47

ReportIntroduction

Microsoft Digital Defense Report 2022

Iran growing
increasingly
aggressive following
power transition

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Iranian critical infrastructure targeting by country

Iranian threat groups are likely to remain a threat
to US and Israeli transportation and energy
companies, particularly as diplomatic efforts
to revive the Iranian nuclear deal wane andWashington, Tel Aviv, and Tehran seek alternative
coercive means to lever concessions.

1

Improve your organization’s overallcyber hygiene by enabling passwordlesssolutions such as MFA and enforcing its
use for all remote connectivity to mitigate
any potentially compromised credentials.

2

Evaluate the authenticity of all inboundemail traffic to ensure the sender address
is legitimate.

3

Patch early and often.34

4

Review and audit each one of your partner
relationships with service providers tominimize any unnecessary permissions
between your organization and upstream
providers. Microsoft recommends
immediately removing access for any
partner relationships that look unfamiliaror have not yet been audited.35

United States 25%

Noncritical infrastructure 61%

Israel 22%

Iran
United ArabEmirates 15%

United Kingdom 7%

Critical infrastructure 39%

India 5%
Saudi Arabia 4%

Other 22%

Iranian targeting of critical infrastructure occurred most prominently against Israeli, Emirati, and US organizations.

Iranian actors are likely to remain a threat to
US and Israeli transportation and energy
companies in the coming year.

Contributing
Teams

Actionable insights

Continued

In Israel, DEV-0198 targeted Israeli railways,
logistics companies, software providers oflogistics companies, and fuel companies with afocus on gas stations. In early 2022, the groupconducted a disruptive attack on the networkof a major Israeli logistics company, which
forced the company to shut down its computersand some of its operations to contain theattack. In another case, we observed the groupattempt to access the network of a major Israelitransportation provider via stolen or reused
credentials. Meanwhile, another Iranian actor,
DEV-0343—whose targeting of defense, maritime
transportation, and satellite imagery companies
suggests links to the IRGC—compromised
accounts at Israeli transportation and portrelated entities throughout early 2021.

Cyber
Resilience

Iranian groups have expanded ransomware
attacks beyond regional adversaries and aretargeting high profile US and Israeli criticalinfrastructure targets.

Links to further information
Iranian targeting of IT sector on therise | Microsoft Threat Intelligence Center(MSTIC), Microsoft Digital Security Unit
(DSU)
Iran-linked DEV-0343 targeting defense,
GIS, and maritime sectors | Microsoft
Threat Intelligence Center (MSTIC),
Microsoft Digital Security Unit (DSU)

ReportIntroduction

48 Microsoft Digital Defense Report 2022

Lebanon-based group with links
to Iran targeting Israel
Microsoft monitors cyber threat activities
regardless of platform, targeted victim, or
geographical region. We maintain visibility
and active threat hunting worldwide towrite better detections for our customers.
Although threats from Russia, China, Iran, andNorth Korea represent the majority of ourobserved nation state actor activity, we also track
and communicate about threats from NATOmember countries and democratic nations.
Last year, we featured activity by a Turkey-based
actor (SILICON) and a Vietnam-based actor(BISMUTH). This year, we are expanding on
the details of a Lebanon-based group that we
previously disclosed publicly.36
Microsoft uncovered a previously undocumented
Lebanon-based group that we assesswith moderate confidence operated incoordination with actors affiliated with Iran’s
Ministry of Intelligence and Security (MOIS).
Such collaboration or direction from Tehran
would align with revelations since late 2020 that
the Government of Iran is using third parties tocarry out cyber operations, likely to enhance
Iran’s plausible deniability.
In the observed activity, POLONIUM targetedor compromised two dozen Israel-basedorganizations and one IGO with operations
in Lebanon between February and May 2022,
before Microsoft disrupted and publicly revealed

The State ofCybercrime

its activity. Nearly half the Israeli organizations
were part of Israel’s defense industry or had
links to Israeli defense companies, indicating
the group has a similar set of interests as Iranin collecting intelligence on and/or directly
countering Israel.37
POLONIUM’s assessed links to MOIS groups
are based on observed victim overlaps andcommonality of tools and techniques.
•

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Microsoft
successfully
detected anddisabled POLONIUM’s
abuse of OneDrive
as a C2.

Cyber
Resilience

Contributing
Teams

Actionable insights
1

Update antivirus tools40 and ensure cloudprotection41 is turned on to detect therelated indicators.

2

For customers with service provider
relationships, ensure review and auditof all partner relationships to minimize
unnecessary permissions between yourorganization and upstream providers.⁴2
Immediately remove access for any partner
relationships that appear unfamiliar or
have not been audited.

Links to further information•

POLONIUM deployed a series of custom
implants using cloud services for C2 and data
exfiltration—notably OneDrive and DropBox.
POLONIUM often created unique OneDrive
applications for targets, likely to evade detection.
As of June 2022, Microsoft suspended more than
20 POLONIUM-created OneDrive applications,notified affected organizations, and deployeda series of security intelligence updates toquarantine POLONIUM-developed tools.

Exposing POLONIUM activity andinfrastructure targeting Israeliorganizations | Microsoft ThreatIntelligence Center (MSTIC), Microsoft
Digital Security Unit (DSU)
MERCURY leveraging Log4j 2
vulnerabilities in unpatched systems totarget Israeli organizations | Microsoft
Threat Intelligence Center (MSTIC),
Microsoft 365 Defender Research Team,
Microsoft Defender Threat Intelligence49

Microsoft Digital Defense Report 2022

North Korean cybercapabilities employedto achieve regime’s
three main goals
North Korea’s cyber priorities over the past
year reflected the government’s statedglobal priorities. Kim Jong Un emphasized
the three priorities of building defense
capacity, bolstering the country’s struggling
economy, and ensuring domestic stability
in several key addresses.43 The actions taken
by North Korean state actors clearly showthat cyber is being utilized to achieve thesethree goals.

North Koreanstate actors used avariety of tactics toattempt to penetrateaerospace companies
around the globe.

ReportIntroduction

The State ofCybercrime

North Korean state threat groups, primarily
CERIUM and ZINC, used a variety of tactics toattempt to penetrate networks of defense andaerospace companies around the globe. As North
Korea embarked on its most aggressive period of
missile testing ever in the first half of 2022, it usedcyberespionage to help North Korean researchers
gain an edge in developing indigenous defense
systems and countermeasures for the advances
its adversaries made.
We observed COPERNICIUM targeting a varietyof cryptocurrency-related companies around theworld, often with success, to help support North
Korea’s struggling economy. While we cannot
confirm whether the group was able to exfiltratemoney after a compromise, we observed
COPERNICIUM infect dozens of machines bysending malicious documents masquerading as
proposals from other cryptocurrency companies.
Finally, a group Microsoft tracks as DEV-0215
worked to uphold stability and loyalty in North
Korea by targeting news organizations thatreport on North Korean issues. These outlets
have sources both in North Korea and withincommunities of defectors, which Pyongyang
views as an existential threat. In addition, thegroup worked to gain access to networks of
Korean-speaking Christian groups, which tend
to be outspoken against North Korea and work
actively with North Korean defectors.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Targeting of defense and aerospace companies

Targeting cryptocurrency to balance losses

North Korean state actors led by CERIUM and
ZINC put significant effort into developing tactics
aimed at penetrating defense and aerospacecompanies. CERIUM repeatedly probed South
Korean virtual private networks (VPNs) bydownloading clients and looking for weaknesses.
It also downloaded common applications usedby South Korean military and government clients,
likely looking for vulnerabilities. The groupclosely followed current events and wrote newlure documents which used high profile topics
as bait to encourage targets to click on theirmalware executables and links.

Since UN sanctions were levied in 2016, North
Korea’s economy has continued to contract,compounded by natural disasters such as floods44
and drought45 as well as a near-total lockdownof borders to imports since the onset of the
COVID-19 pandemic in early 2020.46 Although
North Korea opened its borders for trade with
China briefly in early 2022, they were soon closed
again.47 In mid-May, North Korea reported its
first domestic case of COVID-19.48 It has sinceapplied a China-style “zero COVID” strategy
of mass lockdowns to combat the virus which
has negatively impacted North Korea’s alreadyfragile economy.

Both ZINC and CERIUM used social media andsocial engineering in campaigns. ZINC wasparticularly adept at creating fake profiles on
LinkedIn and other professional social media
sites, where its operators posed as recruiters
for major defense and aerospace companies.
Using these profiles, they sent links or malicious
file attachments to potential victims using direct
messages on social media or email.
In addition to employees of corporations,
CERIUM also broadly targeted members of theSouth Korean military, showing special interestin both South Korean military academies andmilitary members working in academia.

The North Korean state group COPERNICIUM
tried to offset some of the lost revenue bystealing money—typically in the form ofcryptocurrency—from any company whose
networks it could penetrate. We saw dozens
of machines compromised belonging tocryptocurrency-related companies in the UnitedStates, Canada, Europe, and throughout Asia.
COPERNICIUM even compromised machinesbelonging to cryptocurrency-related companies
within North Korea’s strongest ally, China, bothon the mainland and in Hong Kong. The grouprelied heavily on social media for its earlyreconnaissance and approaches to targets.
Actors would build profiles pretending to be
developers or senior officers in businesses
related to cryptocurrency. They would thenestablish relationships with those in the industry,
sending malicious links or files once they had
built up rapport.

50 Microsoft Digital Defense Report 2022

ReportIntroduction

The State ofCybercrime

North Korean cybercapabilities employedto achieve regime’s
three main goals

also possible the actors behind DEV-0530
were acting independently to earn money forthemselves. If it were North Korean hackers
operating independently, that would explain why
the activity was not widespread compared togovernment-sponsored theft operations against
cryptocurrency companies.

Continued

Targeting North Korean news outlets,
defectors, religious groups, andaid organizations

A group related to PLUTONIUM develops
and deploys ransomware
A group of actors originating from North
Korea that Microsoft tracks as DEV-0530 began
developing and using ransomware in attacks
in June 2021. This group, which called itself
H0lyGh0st, utilized a ransomware payload withthe same name for its campaigns and successfullycompromised small businesses in multiple
countries as early as September 2021.
Microsoft assessed that DEV-0530 had
connections with another North Korean-based
group tracked as PLUTONIUM (also known
as DarkSeoul or Andariel). While the use of
H0lyGh0st ransomware in campaigns is uniqueto DEV-0530, MSTIC observed communications
between the two groups, as well as DEV-0530
using tools created exclusively by PLUTONIUM.
It is not certain that DEV-0530 activity was
government-sponsored. Although ransomware
attacks could have been ordered by thegovernment for the same reason it sponsors
theft from cryptocurrency companies, it is

In the last year, Supreme Leader Kim Jong Un
was publicly more focused on internal security
and loyalty than missiles and nuclear weapons.
Reflecting this preoccupation with domestic
issues, at least two North Korean state groups
focused on aspects the regime would view as
domestic threats.
The first was a group Microsoft tracks as DEV0215, which targets media organizations thatclosely follow North Korean news. One likely
reason for this targeting is these media outlets
obtain their news from North Korean defectors,
Chinese citizens who work closely with North
Korea, and even some North Korean citizens
based inside the country, using a variety ofmethods to communicate with the outside world.
The North Korean government views thesegroups as an existential threat to its survival,
particularly citizens inside North Korea who
would be viewed as traitors and spies. DEV-0215
likely sought to identify these outlets’ sources sothey could neutralize potential information leaks.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

North Korea: Top targeted countries and industry sectors

Nongovernmentalorganizations 25%

United States 38%

Education 23%

Korea 8%

North Korea

Japan 7%

Financial services 11%

United Kingdom 7%
Russia 4%

Government agencies
and Services 9%
Digital print andbroadcast media 8%

Other 36%
Other 24%

North Korea views the United States, South Korea, and Japan as its primary enemies. While Russia is a long-time
ally, North Korean threat actors target Russian think tanks, academics, and diplomatic officials to obtain intelligenceon Russian views of global affairs.

51

ReportIntroduction

Microsoft Digital Defense Report 2022

North Korean cybercapabilities employedto achieve regime’s
three main goals
Continued

Microsoft also saw evidence of DEV0215 targeting Korean-speaking Christiancommunities. Evangelical Christian Koreanchurches tend to be critical of both North Korea
and South Korean governments that favor
engagement with North Korea. These churches
are likely to conduct outreach to defectors, andsome engage in humanitarian work with North
Korea. North Korea views them as a threat
because, while the stream of defectors comingfrom North Korea almost dried up during the
pandemic,49 these Christian groups often playa critical role in helping defectors escape.
DEV-0215 has generated fake documents about
Christian conferences for Korean speakers aslures to target the group and discover who is
helping organize defections.

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Finally, state group OSMIUM showed steadyinterest in international aid organizations
throughout the year, including organizations
that have assisted North Korea in the past.
While North Korea has generally shunned offersof help from outside the country, especially since
the outbreak of COVID-19,50 it is possible that
North Korea is considering taking up offers of
help, but is wary of the security ramifications ofallowing foreign aid workers into the country.
North Korea may be penetrating the networksof aid organizations worldwide to determine
whether to allow such aid into their own country.

Actionable insights
1

North Korean state actors are skilled,
relentless, and creative, but organizations
can defend against them.

2

Most successful attacks can be stopped
with basic cyber hygiene, such as two
factor authentication or not opening
attachments from unknown individuals
in a virtual environment.

Links to further information
North Korean threat actor targets small
and midsize businesses with H0lyGh0st
ransomware | Microsoft Threat Intelligence
Center (MSTIC), Microsoft Digital Security
Unit (DSU)

Among North Korea experts, there haslong been debate over whether the
North Korean government is in earnest
with its public statements or whether it
is posturing for effect. The alignmentof cyberattacks with North Korea’s
announced priorities validates the belief
that North Korea means what it says
when it speaks publicly about its goals.

52

Microsoft Digital Defense Report 2022

Cyber mercenaries
threaten the stabilityof cyberspace
There is a growing industry of privatecompanies that develop and sell tools,
techniques, and services that enable theirclients—often governments—to break into
networks, computers, phones, and internetconnected devices. An asset for nation
state actors, these entities often endanger
dissidents, human rights defenders,journalists, civil society advocates, andother private citizens. We refer to theseas cyber mercenaries or private sector
offensive actors.
A world where private sector companies createand sell cyberweapons is more dangerous
for consumers, businesses of all sizes, andgovernments. These offensive tools can be usedin ways that are inconsistent with the norms
and values of good governance and democracy.
Microsoft believes the protection of human rights
is a fundamental obligation, and one we takeseriously by curtailing “surveillance as a service”
across the globe.

ReportIntroduction

The State ofCybercrime

Microsoft has assessed certain state actors
across democratic and authoritarian regimes
outsource the development or use of“surveillance as a service” technology. This is
how they avoid accountability and oversight,
as well as acquire capabilities that would be
difficult to develop natively.

These cyberweapons provide nation
states with surveillance capabilities
they would not have been able todevelop alone.
The market in which cyber mercenaries operate
is opaque. Nevertheless, we continue to observe
these groups using zero-day exploits andeven zero-click exploits that require no victim
interaction at all, enabling surveillance as a service.
Microsoft recently announced a European private
sector offensive actor we call KNOTWEED, an
Austria-based PSOA called DSIRF. Multiple news
reports have linked the company to thedevelopment and attempted sale of a malware
toolset called Subzero.51 Victims include law firms,
banks, and strategic consultancies in countries
such as Austria, the UK, and Panama.52
Because these offensive surveillance capabilities
are no longer highly classified capabilities createdby defense and intelligence agencies, but rather
commercial products now offered to companies
and individuals, any regulatory regime forcyberweapons needs to move beyond export
control. The impact of these cyberweapons canbe devastating.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

When a cyber mercenary exploits avulnerability in a product or service, they
put the entire computing ecosystem at risk.
When vulnerabilities are identified publicly,companies are in a race against time torelease protections before broad based
attacks ensue (see our earlier discussion ofvulnerability exploits). This is a dangerous
and difficult cycle for both software suppliers(who must expediently develop patches) andconsumers of products (who must implement
the patches immediately).
As a founding member of the Cybersecurity
Tech Accord53—a leading alliance bringing
together more than 150 technology companies—
Microsoft has made a commitment not toengage in offensive operations online. We standby that commitment and by our human rights
responsibilities in this area. We have engaged
in technical disruptions and legal challenges tohighlight the negative impacts caused by theservices provided by cyber mercenaries andwill continue to protect our customers when
we see abuse.

Cyber mercenaries create and provide“surveillance as a service” capabilities
that are technologically sophisticatedand broadly available, including
advanced malware, and a rangeof techniques.

Cyber
Resilience

Contributing
Teams

Actionable insights for governments
1

Implement transparency and oversightrequirements for surveillance as a service,
particularly in procurement, including
the banning of these offensive actors,
as the US has done with the Departmentof Commerce listing of companies on the
Entity List.

2

Establish post-employment restrictions
for former employees in this sector.

3

Aim to implement “know your customer”
obligations and encourage companies touphold their human rights commitments.

Links to further information
Untangling KNOTWEED: European privatesector offensive actor using 0-day exploits| Microsoft Threat Intelligence Center(MSTIC), Microsoft Security Response
Center (MSRC), RiskIQ (Microsoft DefenderThreat Intelligence)Continuing the fight against private sector
cyberweapons | Microsoft On the Issues

53

Microsoft Digital Defense Report 2022

Operationalizing
cybersecurity norms
for peace and security
in cyberspace
We urgently need a consistent, global
framework that prioritizes human rights
and protects people from reckless statebehavior online. Nowhere is this moreclearly demonstrated than in the ongoing
war in Ukraine. In addition to a global
strategic effort, governments can act now
to have an immediate positive impact.
Five years ago, Microsoft called for a “Digital
Geneva Convention” to advance responsibilities
and obligations across sectors to defend peaceand security online. Cyberspace was emerging
as a distinct and volatile domain of conflictand competition between states, with attacks
becoming more common, even in times of peace.
Today, there is still a clear need for such aframework—evidenced by Russian cyberattacks
against Ukraine as part of Russia’s invasion. This war
has created a new front line that is dramaticallydifferent from any we have known before.
Bringing stability to cyberspace will require
strengthening and reimagining global
governance institutions to make them fit-forpurpose. Cyberspace is fundamentally different
from other domains—it is borderless, synthetic,
and maintained largely by private industry.

ReportIntroduction

The State ofCybercrimeThis means asking the technology industry totake greater responsibility for both the securityof products and services and the wider digital
ecosystem. While there has been notable
progress on all fronts, the challenges havegrown dramatically.
We must redouble collective efforts to defend
the security of cyberspace. We cannot take therights and freedoms we have come to expect
online for granted. While we struggle to address
the challenges, malicious actors are planninghow and where to strike next using AI, leveraging
disinformation, and finding ways to undermine
the fledgling metaverse. Human rights defenders,
the technology industry, and rights-respecting
governments must work together towards anaffirmative vision for a safe and secure online
world. The road ahead is long, but there arethings governments can do now to immediately
improve the cybersecurity ecosystem:• Cite norms, laws, and consequences inattributions. One major improvement overthe past five years has been the speed andcoordination of government attributions ofcyberattacks. Beyond simply naming andshaming, these statements need to highlightwhich international laws or norms are violated
and what manner of consequences will be
imposed to help strengthen recognition ofinternational expectations.
• Clarify international law interpretation online.
While governments agree that internationallaw applies online, questions remain about
how it applies in specific instances. This isparticularly pertinent in the aftermath of the
Ukraine invasion. Governments can go a long

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

way toward setting expectations, avoiding
misunderstandings, and building trust by
stating how they understand their obligations
under international law.
• Consult with other stakeholders.
As international forums continue todiscover the best ways to facilitate robust
multistakeholder inclusion, governments can
support informed dialogue by consultingwith multistakeholder communities, inparticular the technology industry, toensure dialog benefits from those withindispensable expertise.
• Form a standing body to support responsible
state behavior in cyberspace. The work ofinternational diplomatic forums to advanceresponsible state behavior online has neverbeen more important. There is a clear needfor a permanent UN mechanism to deal withcyberspace as a domain of conflict.
• Define new norms for evolving threats.
Cyberspace threats are constantly evolving
alongside innovations in technology.
While international norms should betechnology neutral, they will need to be
updated and attenuated based on changes
in the threat landscape and how we use
technology. Even today, we see gaps in theexisting international framework being abused.
States should commit to expressly protect core
processes underpinning the digital ecosystemthat are not currently protected, like the software
update process. Moreover, specific areas
deserve additional protections. For example,
as we have learned amid the pandemic, norms
for protecting healthcare are essential.

Cyber
Resilience

Contributing
Teams

Nation state actors and attacks are
increasing in volume and sophistication,
creating a situation that is untenable.
Immediate action is imperative—there
are things governments can do now toimmediately improve the cybersecurity
ecosystem, including implementing agreed
upon norms and rules for state behavior incyberspace and working with the broader
multistakeholder community to address
emerging gaps.
Multilateral institutions must be
reimagined to address the pressing
challenge of nation state cyberattacks.

Links to further information
A moment of reckoning: the need for astrong and global cybersecurity response |Microsoft On the Issues
Cyberattacks targeting health care muststop | Microsoft On the Issues
The next chapter of cyber diplomacy
at the United Nations beckons | Microsoft
On the Issues

54 Microsoft Digital Defense Report 2022

ReportIntroduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Endnotes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

https://www.microsoft.com/en-us/cybersecurity/content-hub/cloud-security
https://blogs.microsoft.com/on-the-issues/2022/04/27/hybrid-war-ukraine-russia-cyberattacks/
Critical infrastructure in this chapter is defined by the Presidential Policy Directive 21 (PPD-21),
Critical Infrastructure Security and Resilience (February 2013).
https://www.microsoft.com/security/blog/2021/11/18/iranian-targeting-of-it-sector-on-the-rise/https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-andinfrastructure-targeting-israeli-organizations/
https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegatedadministrative-privileges-to-facilitate-broader-attacks/
https://www.microsoft.com/en-us/security/business/identity-access/azure-active-directorypasswordless-authentication
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211
https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6114-securityfix-release
https://reliefweb.int/report/ukraine/unicef-ukraine-humanitarian-situation-report-no-13-10-17may-2022
https://news.un.org/en/story/2022/06/1119672
https://zetter.substack.com/p/dozens-of-computers-in-ukraine-wiped?s=r ;https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainianorganizations/
https://www.cnn.com/2022/03/14/economy/china-jan-feb-economy-challenges-ahead-intl-hnk/
index.html
https://www.wsj.com/articles/russias-vladimir-putin-meets-with-chinese-leader-xi-jinping-inbeijing-11643966743
https://www.washingtonpost.com/world/2022/04/01/china-eu-summit/
https://twitter.com/MoNDefense
https://news.usni.org/2022/01/24/2-u-s-aircraft-carriers-now-in-south-china-sea-as-chinese-airforce-flies-39-aircraft-near-taiwan
https://ec.europa.eu/trade/policy/in-focus/eu-china-agreement/; https://www.usnews.com/
news/world/articles/2022-02-28/eu-plans-summit-with-china-on-april-1-to-address-tensions

19 https://www.wsj.com/articles/u-s-on-sidelines-as-china-and-other-asia-pacific-nations-launchtrade-pact-11641038401
20 https://greenfdc.org/chinas-two-sessions-2022-what-it-means-for-economy-climatebiodiversity-green-finance-and-the-belt-and-road-initiative-bri/
21 https://www.cfr.org/global-conflict-tracker/conflict/territorial-disputes-south-china-sea
22 https://www.theguardian.com/world/2022/apr/30/the-china-solomons-security-deal-has-beensigned-time-to-move-on-from-megaphone-diplomacy
23 https://www.fmprc.gov.cn/eng/zxxx_662805/202205/t20220531_10694928.html
24 https://blogs.microsoft.com/on-the-issues/2021/12/06/cyberattacks-nickel-dcu-china/;
https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-governmentorganizations-across-latin-america-and-europe/
25 https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasksfor-defense-evasion/
26 https://attack.mitre.org/techniques/T1053/
27 https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-openpersistent-backdoors-into-servers/
28 https://www.microsoft.com/security/blog/2021/02/11/web-shell-attacks-continue-to-rise/
29 https://www.timesofisrael.com/in-rare-criticism-of-irgc-rouhani-slams-anti-israel-sloganson-test-missiles/; https://www.theguardian.com/world/2017/may/05/iran-president-hassanrouhani-nuclear-agreement-sabotaged; https://d2071andvip0wj.cloudfront.net/184-irans-priorities-in-a-turbulent-middle-east_1.pdf; https://www.aljazeera.com/news/2016/3/9/
iran-launches-ballistic-missiles-during-military-drill; https://www.usatoday.com/story/news/
world/2015/04/25/iran-yemen-weapons/26367493/; https://www.armscontrol.org/blog/
ArmsControlNow/2016-03-14/The-Iranian-Ballistic-Missile-Launches-That-Didnt-Happen;
https://www.reuters.com/world/middle-east/iran-parliament-approves-most-raisi-nomineeshardline-cabinet-2021-08-25/;
30 https://www.reuters.com/world/middle-east/iran-parliament-approves-most-raisi-nomineeshardline-cabinet-2021-08-25/; https://www.france24.com/en/live-news/20210825-iran-sparliament-approves-president-s-cabinet-choices

55

Microsoft Digital Defense Report 2022

ReportIntroduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Endnotes continued
31 https://www.janes.com/defence-news/news-detail/iranian-irgc-consolidates-primacyinintelligence-operations; https://www.proofpoint.com/us/blog/threat-insight/badblood-ta453targets-us-and-israeli-medical-research-personnel-credential; https://miburo.substack.com/p/
iran-disinfo-privatized?s=r.
32 https://www.reuters.com/business/energy/iran-says-israel-us-likely-behind-cyberattack-gasstations-2021-10-30/
33 https://www.tasnimnews.com/en/news/2021/11/05/2602361/us-military-action-off-the-tableiranian-general
34 In particular, patch Exchange servers for ProxyShell vulnerabilities (CVE-2021-26855, CVE-202126857, CVE-2021-26858, and CVE-2021-27065, CVE-2021-34473). Also, be sure to patch Fortinet
FortiOS SSL VPN appliances for vulnerabilities.
35 https://docs.microsoft.com/en-us/microsoft-365/commerce/manage-partners?view=o365worldwide
36 https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-andinfrastructure-targeting-israeli-organizations/
37 https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-andinfrastructure-targeting-israeli-organizations/
38 https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign
39 https://www.microsoft.com/security/blog/2021/11/18/iranian-targeting-of-it-sector-on-the-rise/
40 https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-updatesbaselines-microsoft-defender-antivirus?view=o365-worldwide
41 https://docs.microsoft.com/microsoft-365/security/defender-endpoint/cloud-protectionmicrosoft-defender-antivirus
42 https://docs.microsoft.com/microsoft-365/commerce/manage-partners?view=o365-worldwide
43 https://www.marketwatch.com/story/kim-jong-un-calls-for-improved-living-conditions-in-northkorea-01633920099
https://www.bbc.com/news/world-asia-59845636
https://kcnawatch.org/newstream/1650963237-449932111/respected-comrade-kim-jong-unmakes-speech-at-military-parade-held-in-celebration-of-90th-founding-anniversary-of-kpra/
44 https://www.theguardian.com/world/2021/aug/06/north-korea-homes-wreckeddamaged-andand-bridges-washed-away-in-floods

45 https://www.reuters.com/world/asia-pacific/nkorea-mobilises-office-workers-fight-droughtamid-food-shortages-2022-05-04/
46 https://www.washingtonpost.com/world/asia_pacific/north-korea-kimpandemic/2021/09/08/31adfd74-ff53-11eb-87e0-7e07bd9ce270_story.html
47 https://news.yahoo.com/china-halts-freight-train-traffic-102451425.html
48 https://www.cnn.com/2022/05/11/asia/north-korea-covid-omicron-coronavirus-intl-hnk/index.
html
49 https://www.csis.org/analysis/number-north-korean-defectors-drops-lowest-level-two-decades
50 https://www.aljazeera.com/economy/2022/5/20/north-korea-shuns-outside-help-as-covidcatastrophe-looms
51 Jan-Philipp Hein, In the mystery of creepy spy software, the trail leads via Wirecard to the
Kremlin, FOCUS Online, (2022), https://www.focus.de/politik/vorab-aus-dem-focus-vollekontrolle-ueber-zielcomputer-das-raetsel-um-die-spionage-app-fuehrt-ueber-wirecardzu-putin_id_24442733.html; Sugar Mizzy, We unveil the “Subzero” state trojan from Austria,
Europe-cities (2021), https://europe-cities.com/2021/12/17/we-unveil-the-subzero-state-trojanfrom-austria/; Andre Meister, We unveil the state Trojan “Subzero” from Austria, Netzpolitik.
org (2022), https://netzpolitik.org/2021/dsirf-wir-enthuellen-den-staatstrojaner-subzero-ausoesterreich.
52 As noted in our technical blog, the identification of targets in a country does not necessarilymean that a DSIRF customer resides in the same country, as international targeting is common.
53 Home | Cybersecurity Tech Accord (cybertechaccord.org)

56

Microsoft Digital Defense Report 2022

ReportIntroduction

Devices andInfrastructureWith the acceleration of digital transformation, the securityof digital infrastructure is more important than ever.

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

ContributingTeams

An overview of Devices and Insfrastructure 57
Introduction 

58

Governments acting to improve criticalinfrastructure security and resilience59

IoT and OT exposed: Trends and attacks 62Supply chain and firmware hacking 

65Spotlight on firmware vulnerabilities

66

Reconnaissance-based OT attacks

68

57

ReportIntroduction

Microsoft Digital Defense Report 2022

An overview ofDevices andInfrastructure

The State ofCybercrime

Governments worldwide are moving
to protect critical infrastructure by
improving IoT and OT security.

The pandemic, coupled with
rapid adoption of internetfacing devices of all kinds as
a component of accelerating
digital transformation, hasgreatly increased the attack
surface of the digital world.

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Top IoT malware detectedin the wild (July 2021-June 2022)

Malware as aservice has moved
into large scale
operations against
exposed IoT and OT
in infrastructure andutilities as well as
corporate networks.

Find out more on p63

Cybercriminals and nation-states are quickly
taking advantage. While the security of IT
hardware and software has strengthened inrecent years, the security of Internet of Things(IoT) and Operational Technology (OT) devices
has not kept pace. Threat actors
are exploiting
Countries
Countries
advancingthese devices to establish access on networks
criticalinfrastructure
Find out more on p59advancing cyberand enable lateral movement, to establish a
incident reporting
cybersecurity
foothold in a supply chain, orto disrupt the risktarget organization’s OT operations.
requirements
Globally consistentrequirements
and interoperable
Other

11

Nation State
Threats

103,092

87,479

Attackers
leveraging
10,192are increasingly
3,166
vulnerabilities in IoT device firmware
to infiltrate corporate networks andlaunch devastating attacks.

11,895

Find out more on p65

Mirai

Gafgyt32% of firmware images analyzed
contained at least 10 known critical
Xhide
Tsunamivulnerabilities.
Miner

Attacks against remote management
devices are on the rise, with morethan 100 million attacks observedin May of 2022—a five-fold increasein the past year.

2

security policies are needed to ensure
broad adoption.
1%

Find out more on p62

9Countries
advancing both

Weak passwords

27%

10+ Critical known vulnerabilities

32%

10+ Critical vulnerabilities 6+ years old

4%

10+ Certificates expired 3+ years

13%

Presence of dangerous components

36%

Web

30%

Email

4%
Find out more on p59

Industrial control
systems

1%

Find out more on p66

58 Microsoft Digital Defense Report 2022

Introduction
Accelerating digitaltransformation has increased
the cybersecurity risk to
critical infrastructure andcyber-physical systems.

ReportIntroduction

The State ofCybercrime

The last several years have seen unprecedentedchange in the digital world. Organizations are
evolving to harness advances in computing
capability from both the intelligent cloud andthe intelligent edge. As a result of the pandemic
forcing entities to digitize to survive and therate at which industries worldwide are adoptinginternet-facing devices, the attack surface of thedigital world is increasing exponentially.
This rapid migration has outpaced the security
community’s ability to keep up. Over the past
year, we have observed threats exploiting devices
in every part of the organization, from traditional
IT equipment to operational technology (OT)
controllers or simple Internet of Things (IoT)
sensors. Although security of IT equipment has
strengthened in recent years, IoT and OT device
security has not kept pace. Threat actors are
exploiting these devices to establish access on
networks and enable lateral movement or disrupt
the organization’s OT operations. We have seen
attacks on power grids, ransomware attacks
disrupting OT operations, IoT routers being
leveraged for increased persistency, and attacks
targeting vulnerabilities in firmware.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

While the prevalence of IoT and OT vulnerabilities
is a challenge for all organizations, criticalinfrastructure is at increased risk because threat
actors have learned that disabling critical services
is a powerful lever. The 2021 ransomware attackon the Colonial Pipeline Company demonstrated
how criminals can disrupt a critical service toincrease the likelihood of a ransom payment.
And Russia’s cyberattacks against Ukraine
demonstrate that some nation states view
cyberattacks against critical infrastructure
as acceptable sabotage to achieve its
military objectives.
However, there is hope on the horizon.
Policymakers and network defenders are
acting to improve the cybersecurity of criticalinfrastructure, including the IoT and OT devices
they rely on. Policymakers are accelerating thedevelopment of laws and regulations to build
public trust in the cyber security of criticalinfrastructure and devices.
Microsoft is partnering with governments aroundthe world to seize this opportunity to enhancecybersecurity and we welcome additional
engagement. We are, however, concerned thatinconsistent, bespoke, or complex requirements
could have unintended effects, including
decreasing security in some cases by diverting
scarce security resources toward compliance withmultiple duplicative certifications.

Cyber
Resilience

Contributing
Teams

From a security operation standpoint network
defenders take multiple approaches to improving
their organization’s IoT/OT security posture.
One approach is to implement continuous
monitoring of IoT and OT devices. Another is to“shift-left”—meaning to demand and implement
better cybersecurity practices for the IoT andOT devices themselves. A third approach is toimplement a security monitoring solution whichspans both IT and OT networks. This holistic
approach has the significant added benefit ofcontributing to critical organizational processes,
such as “breaking the silos” between OT and IT,
which in turn enables the organization to reachan enhanced security posture while meetingbusiness objectives.
Michal Braverman-Blumenstyk
Corporate Vice President, Chief Technology
Officer, Cloud and AI Security

59

Microsoft Digital Defense Report 2022

Governments acting
to improve criticalinfrastructure security
and resilience
Governments worldwide are developing
and evolving policies to manage criticalinfrastructure cybersecurity risk. Many arealso enacting policies to improve IoT andOT device security. The growing global
wave of policy initiatives is creating
enormous opportunity to enhancecybersecurity but also poses challenges
to stakeholders across the ecosystem.
Developing a holistic vision for managing criticalinfrastructure cyber risk is critical, but complex,
especially given the degree of interconnection acrosstechnologies and global suppliers, the range oftechnology uses and associated risks, and the needto invest in both short-and long-term strategies.
Effectively scoped policies that drive iterative
learning and improvements, and support global,
cross-sector interoperability, can help manage
complexity and enable a more security-minded
digital transformation. However, a fragmented
approach to legislation could lead to overlappingand inconsistent regulatory requirements. This could
impact resources and ultimately undermine security
objectives. For example, organizations could
divert resources from innovation and security toformalistic compliance exercises.

ReportIntroduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Microsoft seeks to partner with governments
around the world in pursuing effective criticalinfrastructure cybersecurity policies, increasing
understanding of challenges and opportunities,
and supporting efforts to enhance collective
risk posture.
Policy developments in critical infrastructure
cybersecurity risk management
During the last year, multiple jurisdictions
including Australia, Chile, the European Union(EU), Japan, Singapore, the United Kingdom (UK),and the United States, have developed, updated,or implemented cross-sector or sector-specificcybersecurity requirements.1 Many of thesegovernments—and others such as India2 andSwitzerland3—already issued or are developing
cybersecurity incident reporting requirements
for critical infrastructure and essential service
providers.4
Some notable policy developments occurred inAustralia, the EU, Indonesia, and the United States
during the last year. Australia enacted two laws to
help it manage cross-sector critical infrastructure
cybersecurity risks. The laws, among other things,
designate new critical infrastructure sectors,
require the development of risk management
plans, mandate cybersecurity incident reporting,and empower the government to intervene if it
determines a critical infrastructure operator isunwilling or unable to adequately respond to
an incident.

11

Countries advancing
critical infrastructure
cybersecurity risk
requirements

2

The EU worked to update its NIS Directiveof 2016, which provides a framework for EU
member states to regulate technology services
and products deemed critical to their economy
and the functioning of society. The proposed
NIS 2 includes revisions that would create a
new category of critical digital infrastructure,
increase requirements for cyber incident
reporting, and impose additional cybersecurity
risk management requirements, The EU also
developed a proposed update to its Digital
Operational Resilience Act (DORA), creating new
requirements for information communication
technologies used in the financial services sector.

Countries
advancing cyberincident reporting
requirements

9Countries
advancing both

In May, Indonesia issued a presidential
regulation on the protection of vital information
infrastructure (“IIV”), which will take effect in
May 2024 and cover sectors such as energy,transportation, finance, and health, among
others. Indonesia’s objective with the regulation
is to protect the continuity of the implementationof IIV, prevent cyberattacks, and increase
preparedness in handling cyber incidents.
IIV providers will be responsible for conducting
secure and reliable protection, implementing
effective cyber risk management, and reporting
cyber risk results to corresponding government
agencies. The regulation includes a requirement
to report cyber incidents within 24 hours.

ReportIntroduction

60 Microsoft Digital Defense Report 2022

Governments acting
to improve criticalinfrastructure security
and resilience
Continued

The US Congress passed a law that authorized
the Cybersecurity and Infrastructure
Security Agency (CISA) to issue regulations
to require cyber incident reporting fromcritical infrastructure operators, and the US
Transportation Security Administration (TSA)
issued new sector-specific cybersecurity
requirements in the transportation sector.
In 2021, TSA issued two security directives
to hazardous liquid and natural gas pipeline
operators in response to the ransomware
attack on the Colonial Pipeline Company:• The first directive required operators todesignate a cybersecurity coordinator, reportcyber incidents within 12 hours, and conduct
a vulnerability assessment of their systems.
• The second directive, which TSA revised in
2022, required them to implement specificmitigation measures to protect against
ransomware attacks and other known threats
to IT and OT systems, develop and implementa cybersecurity contingency and response
plan within 30 days, and undergo an annual
cybersecurity architecture design review.

The State ofCybercrime

Building on its regulations for pipelines, TSA issued
two additional security directives later in 2021 that
promulgated cybersecurity requirements to freight
rail, passenger railroad carrier, or rail transit systems.
The directives required that covered operators
designate a cybersecurity coordinator, reportcybersecurity incidents within 24 hours, develop
and implement a cybersecurity incident responseplan, and complete a cybersecurity vulnerability
assessment. TSA simultaneously announced it also
updated its aviation security programs to require
airport and airline operators to implement the firsttwo provisions, designating a coordinator andreporting incidents within 24 hours.
Policy developments in IoTand OT device security
Across dozens of countries, governments areactive in developing requirements to advance thecybersecurity of information and communications
technology (ICT) products and services, including
IoT and OT devices. In the context of ICT products
and services, the biggest concerns are software
supply chain security and IoT security.
• The European Commission proposed the
Cyber Resilience Act, which would establish
cybersecurity requirements for standalone
software and connected devices and ancillary
services.5 Relevant practices for software
vendors include leveraging a secure softwaredevelopment lifecycle6 and providing a
Software Bill of Materials.7 New security
requirements would apply to connected
devices and all manufacturers would be tasked
with managing coordinated vulnerability
disclosure8 processes for released products.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Policymakers have also focused their attention
on the continued proliferation of IoT devices
and networked OT devices.
• In the UK, the draft Product Security and
Telecommunications Infrastructure Billwill require manufacturers of consumer
connectable products, such as smart TVs,
to stop using default passwords that are aneasy target for cyber criminals, to establish avulnerability disclosure policy (such as a way toreceive notice of security flaws), and to provide
transparency about the minimum length oftime during which they will provide security
updates.9• In the EU, new security standards or
requirements are being implemented via
multiple legislative instruments, including
a delegated act to the Radio Equipment
Directive that applies to wireless devices
and seeks to improve network resilience,protect consumers’ privacy, and reduce therisk of monetary fraud.10 In addition, useof a cloud certification scheme,11 currently
in development as a result of the 2019 EU
Cybersecurity Act,12 might be required.

Cyber
Resilience

ContributingTeams

The need for consistency
In many cases, the range of activity acrossregions, sectors, technologies, and operationalrisk management areas is being pursued
simultaneously, resulting in potential overlap
or inconsistency in scope, requirements,
and complexity for organizations seeking toleverage guidance or demonstrate compliance.
Without a universally accepted definition of
IoT, scope is especially challenging for IoT andOT device regulations. The examples above
potentially apply to “connected products andancillary services,” “consumer connectableproducts,” and “wireless devices.” At the sametime, many governments aim to implement
more robust assessment regimes to better
understand whether and how organizations
and products meet current, emerging, andevolving requirements. As these trends merge,
complexity will increase. Encouragingly, questions
posed during the EU Cyber Resilience Act
consultation explored how new regulation could
potentially interact with existing cybersecurity
regulation, indicating intent to avoid conflicting
cybersecurity requirements.
Iterative approaches that are risk-based
and outcome- or process-oriented (versus
implementation-specific) could foster enhanced
cybersecurity and continuous improvement.
Likewise, a focus on enabling interoperability
across sectors, regions, and policy areas
could consistently raise cybersecurity acrossinterconnected global supply chains.

61

Microsoft Digital Defense Report 2022

Governments acting
to improve criticalinfrastructure security
and resilience
Continued

There are increasingly complex criticalinfrastructure cybersecurity policies indevelopment across regions, sectors,
and topic areas. This activity brings
great opportunities and significant
challenges. How governments proceed
will be crucial to the future of digitaltransformation and ecosystemwide security.

ReportIntroduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Accelerating ecosystem-wide investments in software
supply chain security and Zero Trust architecture
US Executive Order (EO) 14028 on
improving cybersecurity has been acatalyst to expedite Microsoft’s ongoing
initiatives to invest in our own andecosystem-wide supply chain security
and to enable our customers to meet
Zero Trust objectives.
We have long believed that enhancing thesoftware supply chain requires sharing learnings
and best practices, beginning with our public
release of Microsoft’s Security Development
Lifecycle about 15 years ago.
In addition, we are partnering closely with the
National Cybersecurity Center of Excellence
to demonstrate approaches to Zero Trust
Architecture applied to both on-premises andcloud technology and establishing new productcapabilities, including the ability to enforce
phishing-resistant authentication for hybrid
and multi-cloud environments.

Today, we’re going beyond the EO’s
requirements to demonstrate conformancewith software supply chain security
requirements and provide Software Bill ofMaterials (SBOM) information in two ways:
1. First, we’re sharing an open-source versionof our SBOM generator tool, which we built
to be easily integrated with CI/CD pipelines
supporting builds on Windows, Linux, Mac,
iOS, and Android platforms.13
2. Second, we’re contributing to thedevelopment of industry standards for
Supply Chain Integrity, Transparency,
and Trust (SCITT). This will allow for the
automated exchange of verifiable supply
chain information, including artifacts that
demonstrate conformance with requirements
such as those resulting from the EO’s
software supply chain guidance.

Cyber
Resilience

Contributing
Teams

Actionable insights
1

Multilateral institutions must be
reimagined to address the pressing
challenge of nation state cyberattacks.

2

Develop cybersecurity policies that areconsistent and interoperable acrossregions, sectors, and topic areas.

Links to further information
Continued investments in supply
chain security in support of thecybersecurity Executive Order | Microsoft
Tech Community
US Government sets forth Zero Trustarchitecture strategy and requirements |Microsoft Security BlogCYBER EO | Microsoft Federal
Supply Chain Integrity, Transparency,
and Trust | github.com
Implementing a Zero Trust Architecture |NCCoE (nist.gov)

Contributing
Teams

120
100
80
60
40
20

May 2022

Apr 2022

Mar 2022

Feb 2022

Jan 2022

Dec 2021

Nov 2021

Oct 2021

Sep 2021

Aug 2021

Jul 2021

0

Increasing attacks on remote management ports over time, as seen through the MSTIC sensor network.

Web attacks against IoT and OT
50

Summary of attack types on IoT/OT
Databases 18%

40

Web 30%Industrial
controlsystems 1%

30
20
10

Attack types observed through MSTIC sensor
network. Most prevalent were attacks against remotemanagement devices, attacks via web, and attacks ondata bases (brute forcing or exploits).

Jun 2022

May 2022

Apr 2022

Mar 2022

Feb 2022

Jan 2022

Dec 2021

Nov 2021

Other 1%

Oct 2021

Email 4%
Remotemanagement 46%

Sep 20210

Aug 2021

Malware as a service has moved into large
scale operations against civil infrastructure andutilities (including hospitals, oil and gas, electricalgrids, transportation services, and other criticalinfrastructure) as well as corporate networks.
Significant research efforts are required by threat
actors to uncover and exploit the configuration ofoperating environments and embedded IoT andOT devices.

Cyber
Resilience140

Jul 2021

IoT devices—including everything from printers
to web cameras, climate control devices, andbuilding accesses controls—pose uniquesecurity risks to individuals, organizations, andnetworks. While critical to many organizations’operations, they can quickly become a liability
and security risk. The rapid adoption of IoT
solutions in almost every industry has increased
the number of attack vectors and the exposurerisk of organizations.

Exposed devices can be discovered throughinternet search tools by identifying services
listening on open network ports. These ports
are commonly used for remote management ofdevices. If not secured correctly, an exposed IoT
device can be used as a pivot point into anotherlayer of the enterprise network as unauthorizedusers can remotely access the ports. We haveobserved a variety of threat actors attempting to
exploit vulnerabilities in internet exposed devices
ranging from cameras to routers to thermostats.
However, despite the risk, millions of devices
remain unpatched or exposed.

Cyber Influence
Operations

Attacks against remote management devices

Jun 2021

The increasingly connected digital world
means devices are rapidly coming online,
communicating with larger systems,
collecting data, and creating visibility acrossformerly obscured spaces. This brings
opportunity for organizations and threat
actors alike, with the business of cybercrime
becoming both a multi-billion dollar
industry and risk.

IoT devices pose unique security
risks as entry and pivot points in the
network. Millions of IoT devices areunpatched or exposed.

Devices andInfrastructure

Nation State
Threats

Jun 2021

IoT and OT exposed:
Trends and attacks

The State ofCybercrime

Millions

ReportIntroduction

Microsoft Digital Defense Report 2022

Thousands

62

Web attack volume over time, as seen through the MSTIC sensor network. As the number of devices directly
connected to the web continues to drop, attackers might eventually be less likely to probe for them.

Gafgyt

Tsunami

3,166

Xhide

Many industrial control system protocols
are unmonitored and therefore vulnerable toOT-specific attacks. This can mean increased
risk for critical infrastructure.

11
nc

roo
t
default

default
user

user

in
m
ad
t
lne
te

in
m
ad
t
lne
te

ad
m
in
ad
m
in

vizxv

Miner

10,192Contributing
Teams

11
nc

root

11,895adminin
telecomadm

Mirai

87,479

tsg
oin
gon

ort
supp

103,092

As revenue from attacks against IoT devices
declined in 2022, we observed several threat
actor groups abusing vulnerabilities—such as
Log4j and Spring4Shell—to deliver a malicious
payload to devices such as servers, infecting
them and recruiting them into large botnets
carrying out DDoS attacks. The revamped
utility of malware designed to target vulnerable
IoT devices has serious implications for bothorganizations and nations, as lateral movement
can expose backdoors to additional payloads
and other devices on networks.

ort
supp

Top IoT malware detected in the wild

t
roo
in
m
ad

Top IoT malware detectedin the wild (July 2021-June 2022)

The use of Mirai grew among both 32- and 64-bit
x86 CPU architectures over the past year, and themalware was given new capabilities that wererapidly adopted by nation state and criminalgroups. Nation state attacks now leverage newvariants of existing botnets in distributed denialof service (DDoS) attacks on foreign adversaries.

12
34

3
12
in
m
ad

As cybercrime groups have evolved, so has theirdeployment of malware and choice of targets.
In the past year, we observed attacks against
common IoT protocols—such as Telnet—
drop significantly, in some cases as much as
60 percent. At the same time, botnets wererepurposed by cybercrime groups and nation
state actors. The persistence of malware, such as
Mirai, highlights the modularity of these attacks
and the adaptability of existing threats.

Cyber
Resilience

Relative prevalence of user name and password pairs seenamong IoT/OT devices in 45 days of sensor signals

6
45
123

Revamped malware utility

Cyber Influence
Operationsmadminteleco

Continued

Mirai evolved to infect a wide range of IoT
devices including internet protocol cameras,
security camera digital video recorders, androuters. The attack vector bypassed legacy
security controls and poses a risk for endpoints
within the network by exploiting additional
vulnerabilities and moving laterally. Mirai has
been redesigned multiple times, with variants
adapting to different architectures and exploiting
both known and zero-day vulnerabilities tocompromise new attack vectors.

Devices andInfrastructure

Nation State
Threats

1001chin

IoT and OT exposed:
Trends and attacks

The State ofCybercrime

Zte
521

ReportIntroduction

Microsoft Digital Defense Report 2022

ro
ot

63

Inner circle
usernames
Outer circle
passwords

Using common username and password pairs increases risk of compromise. Based on a sample size of over
39 million IoT and OT devices, those using identical usernames and passwords represented around 20 percent.

ReportIntroduction

64 Microsoft Digital Defense Report 2022

IoT and OT exposed:
Trends and attacks

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Industrial control system protocol prevalence
1. EtherNet/IP

13. IEC-60870

2. MODBUS

14. Honeywell FDA
Diagnostics

Continued

3. BACNet

While weak configurations and default
credentials still pose a risk to networks, Microsoft
observed many web-based exploits utilizing
HTTP. We observed this increase in attacks
on web-based services using legacy botnets.
Meanwhile, there was a decrease in the numberof open telnet ports on the internet, a positive
sign for network security as botnets which posed
historical risk to devices are losing relevance.
Despite this decrease in open telnet ports, we stillobserved persistent botnets in sensor networks.

4. Siemens S7Distribution of IoT malware by
CPU architecture
PowerPC or
Cisco 4500 6%

ARM 26%ARM
AArch64 1%

Intel 80386
15%

MIPS 20%

Motorola
m68k 4%x86-64 19%

3SPARC 3%

Microsoft observed that IoT devices running on ARM
are most targeted by malware, followed by MIPS,
X86-64, and Intel 80386 CPU.

4

5. Profinet
Real-Time

5

1
8

11

12

6
9

2

ARC Cores Tangent-A5 <1%

RenesasSH 6%

Cyber Influence
Operations

7

10

13
16

18

17

19

Industrial control system protocol vulnerabilities
We looked into OT data from our cloudconnected sensors, revealing the most common
industrial control system (ICS) protocols.
These protocols provide insights into the natureof these devices and their attack surface. This isespecially relevant to the security of criticalinfrastructure. Some key learnings are:
1. Most of the protocols represented areproprietary, so standard IT monitoring tools
won’t have adequate security visibility acrossthese devices and protocols. As a result,
networks are left unmonitored and therefore
more vulnerable to OT-specific attacks.

7. Siemens S7 Plus

19. AMS8. CodeSys

20. SRTP

9. Siemens
WinCC Agent

21. TwinCat

20

21

22

23

24

25

11. Honeywell
Control
Data Access

Malware such as Mirai persists by developing
new capabilities and is being adopted bycybercrime groups and nation state actors,
leveraging new variants of existing botnets
in DDoS attacks on foreign adversaries.

17. GSM
18. DNP3

10. EtherNet/IP
O/O

ContributingTeams

16. DeltaV

6. Profinet DCP

15

14

15. Suitelink

Cyber
Resilience

22. Emerson Roc
23. Bently Nevada

Actionable insights
1

Ensure devices are robust by applying
patches, changing default passwords,
and default SSH ports.

2

Reduce the attack surface by eliminating
unnecessary internet connections andopen ports, restricting remote access byblocking ports, denying remote access,and using VPN services.

3

Use an IoT/OT-aware network detection
and response (NDR) solution anda security information and event
management (SIEM)/security orchestration
and response (SOAR) solution to monitor
devices for anomalous or unauthorized
behaviors, such as communication with
unfamiliar hosts.

4

Segment networks to limit an attacker’s
ability to move laterally and compromise
assets after initial intrusion. IoT devices
and OT networks should be isolated from
corporate IT networks through firewalls.

5

Ensure ICS protocols are not exposed
directly to the internet.

24. Mitsubishi
MELSEC
25. TriStation Tricon

12. MMS

2. There is a large variety of vendor-specificprotocols. This means vendor-specific security
solutions won’t be able to adequately cover
the whole network. Microsoft prioritizes
a vendor agnostic approach, to provide
security coverage for the broad variety ofdifferent devices.
3. Organizations should ensure these protocols
are not exposed directly to the internet fromtheir networks. This exposure could pose amajor security risk due to vulnerabilities andthe unsecure nature of these protocols.

65

Microsoft Digital Defense Report 2022

Supply chain andfirmware hacking
Almost every internet-connected device
has firmware, which is software embeddedin the device’s hardware or circuit board.
Over the past few years, we have seen
increased targeting of firmware to launchdevastating attacks. As firmware is likely tocontinue to be a valuable target for threat
actors, organizations must protect against
firmware hacking.

ReportIntroduction

The State ofCybercrime

Firmware is responsible for a device’s primaryfunctions, such as connecting to a networkor storing data. Firmware is found in routers,
cameras, televisions, and other devices used inEnterprises (IoT) along with industrial control
equipment (OT) used in critical infrastructure.
Historically, firmware has been writtenwith unsecured code, creating significant
vulnerabilities which can be exploited to takeover the device or inject malicious code into
the firmware.
This risk is compounded when it comes tothe supply chain. Most devices are built using
software and hardware components fromnumerous manufacturers as well as opensource libraries. In many cases device operators
do not have visibility into the hardware andsoftware bill of materials (H/SBOM) to evaluate
the supply chain risk of devices on their
network. In June 2020, vulnerabilities weredisclosed in a networking stack used by manydifferent manufacturers affecting hundredsof millions of IoT devices in the consumer andindustrial equipment space.14 In some cases,
the network stack was rebranded by othervendors and there was no indication a device
was vulnerable. We see a growing threat ofmalicious actors targeting this software andhardware supply chain of IoT/OT devices tocompromise organizations.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

The firmware updating process varies widely
across devices, and the complexity and logisticalchallenge of performing it impacts the update
frequency. It is not always possible to determine
if a device is running the latest firmware, making
it difficult for security professionals to monitor
and ensure the security posture in their IoT
and OT devices. In addition, some devices havefirmware that is not cryptographically signed,
enabling them to be updated without verificationfrom the user. These weaknesses further open thedevices up to supply chain attacks throughout
the production and distribution chain.
To address these threats, Microsoft invests
significantly in ensuring the security and integrityof the firmware as it moves through various
stages of the supply chain, and in attesting at any
time that it has not been tampered with duringingestion or along the way. This will allow us tovalidate trust between each pipeline segment
and provide a certified and provable end-to-end
chain of custody for every component we ship
to customers. We are working with our partners
to bring this chip-to-cloud security to all deviceson the enterprise and OT network.

Cyber
Resilience

Contributing
Teams“ICT infrastructure suppliers are increasingly
targets as they enable widespread replicationof a single attack. At the same time, global
legislation, regulation, and customer demands
for supply chain security and resiliency are on
the rise, often diverging in their requirements.
The solution is partnership. Together with
suppliers and global governments, Microsoft
is committed to addressing security across our
supply chain ecosystem, exceeding demands
from customers and regulators alike. To dothis, we are driving a comprehensive approachto security and operational resiliency that is
flexibly deployed across the supply chain.
Driving firmware integrity from design
through to device operation is key to ourcollective approach. Ensuring suppliers’ SDL
processes and deploying hardware root oftrust innovation are examples of how we can‘build in’ supply chain integrity.
Our community is leveraging collective
research and development spanning newanti-tampering techniques and cryptographic
mechanisms, combined with ongoing
monitoring and anomaly detection. Together,
we are progressing in minimizing the allureof supply chain as an attack surface.”
Edna Conway,
Vice President, Security & Risk Officer,
Cloud Infrastructure

66 Microsoft Digital Defense Report 2022

Spotlight on firmware
vulnerabilities
Attackers are increasingly leveraging
vulnerabilities in IoT device firmware
to infiltrate corporate networks.
Unlike traditional IT endpoints that
use XDR agents to identify weaknesses,
vulnerability identification within IoT/OT
devices is much more elusive.
A recent survey conducted by Microsoft and
the Ponemon Institute highlights both theopportunity and the security challenge of IoT/OT devices in an enterprise.15 While 68 percent
of respondents believe the adoption of IoT/OT is
critical to their strategic digital transformation,
60 percent recognize that IoT/OT security is
one of the least secured aspects of the IT/
OT infrastructure.
An example of attackers using vulnerabilities
in IoT device firmware to infiltrate a networkis the Trickbot trojan which leveraged default
passwords and vulnerabilities in Mikrotik
routers16 to bypass corporate defense systems.
The fundamental challenge with IoT device
firmware is the lack of visibility into the security
posture and vulnerabilities of devices.

ReportIntroduction

The State ofCybercrime

While there are solutions available to build secure
devices, there are billions of devices alreadyon the market and deployed in enterprises.
These are known as brownfield devices. In 2021,
Microsoft acquired ReFirm Labs to shine a lighton brownfield device security and enable devicebuilders to improve the security of their products.
ReFirm Labs analyzes the binary firmware imageof a device and produces a detailed report on
potential security weaknesses.17 This technology
is being incorporated into a future release of
Microsoft Defender for IoT.
Over the past year, we examined aggregate
results of the unique firmware scanned byour customers. While not every weakness
discovered might be exploitable, they
underscore the fundamental challenge
of device firmware security.
Note the types of weaknesses that exist in IoT/OT
devices would never be acceptable on traditional
Windows or Linux endpoints.
• Weak passwords: Twenty-seven percentof the firmware images scanned contained
accounts with passwords encoded using
weak algorithms (MD5/DES), which areeasily broken by attackers.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Security weaknesses in firmware images analyzed
Weak passwords

27%

10+ Critical known vulnerabilities

32%

10+ Critical vulnerabilities 6+ years old

4%

10+ Certificates expired 3+ years

13%

Presence of dangerous components

36%• Known vulnerabilities: Like other systems,
IoT/OT device firmware extensively leveraged
open-source libraries. However, devices
frequently ship with out-of-date versions ofthese components. In our analysis, 32 percentof the images contained at least 10 known
vulnerabilities (CVEs) rated as critical (9.0 or
higher). Four percent contained at least 10
critical vulnerabilities that were more thansix years old.
• Expired certificates: Certificates are used toauthenticate connections and identities, aswell as protect sensitive data, but 13 percentof the images analyzed contained at least 10
certificates that had expired more than three
years ago.

• Software components: Thirty-six percent of
the images contain software components
Microsoft recommends be excluded in IoT
devices such as packet capture tools (tcpdump,
libpcap), which can be leveraged for network
reconnaissance as part of an attack chain.

67

Microsoft Digital Defense Report 2022

Firmware attacks in the wild
Viasat: Using a firmware vulnerability
to target satellite communication
In February 2022, a satellite network incident
disconnected a strategic communication networkwith impacts felt across Europe. Viasat’s KA-SAT
system received a large amount of traffic that
disconnected many modems and a denial ofservice attack was initiated against the network.
As fixed broadband was disrupted, thousandsof wind turbines became remotely inaccessible
to operators and malicious wiper malware was
deployed to affected modems. The disruption
affected more than 30,000 satellite terminals
used by companies and organizations
for communication.
Cyclops Blink: Using a firmware supply
chain attack to target firewall gateways
For threat actors, the development andexpansion of command and control (C2) andattack infrastructure is a crucial component of
success. As the need for a stable C2 infrastructure
has grown, routers have become a desirable
attack vector due to their infrequent patching
and lack of comprehensive security solutions.

ReportIntroduction

The State ofCybercrime

Microsoft is partnering withgovernment and industry on firmware
analysis technology to bring deeper
visibility into device security andprovide full lifecycle security for
device builders and operators.
Since June 2019, a nation state-affiliatedadvanced persistent threat (APT) group used
the modular malware Cyclops Blink to target
vulnerable WatchGuard firewall devices and
ASUS routers by executing malicious firmware
updates and recruiting them to a large botnet.
The malware successfully infects devices by
exploiting a known vulnerability that allows aprivilege escalation, enabling the threat actors tomanage the device. Once infected, the malware
allows further modules to be installed and evades
firmware updates. Compromised devices havebeen observed connecting to C2 servers hosted
on other WatchGuard devices. Issuing many SSL
certificates for their C2 on various TCP ports,
Cyclops Blink operators gained privileged remote
access to networks by executing malicious
firmware updates and by evading traditional
security methods such as scanning.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

How Microsoft is improving supply
chain security
Microsoft is partnering with government andindustry to address these IoT and OT device
security challenges (see the discussion on page66). Our contribution will include leveraging
firmware analysis technology to provide device
operators with visibility into the security postureof the devices on their network. This will enable
customers to identify and prioritize devices inneed of additional protections, upgrades, or
replacement—and drive demand for devicebuilders to invest in device security. At thesame time, we are supporting builders withcomprehensive solutions to architect secure
devices and adopt secure development lifecycles.
Another key component is providing builders
and operators robust infrastructure to allow
device firmware to be updated as security
issues are discovered and resolved. Microsoft isbringing together firmware analysis and Defenderfor IoT with Device Update for IoT Hub to provide
a solution to address the full lifecycle of IoT andOT device security. These are important steps
in realizing our vision for customers to secure
the infrastructure by adoption of devices that
support a Zero Trust approach to their IoT andOT solutions.18

Attackers are increasingly targetingvulnerabilities in IoT device firmware
to infiltrate corporate networks.

Cyber
Resilience

Contributing
Teams

Actionable insights
1

Gain deeper visibility into IoT/OT
devices on your network and prioritize
them by risk to the enterprise if they
are compromised.

2

Use firmware scanning tools to understandpotential security weaknesses and workwith vendors to identify how to mitigate
the risks for high-risk devices.

3

Positively influence the security of IoT/OT devices by requiring the adoptionof secure development lifecycle bestpractices by your vendors.

Links to further information
Assessment of the Critical Supply Chains
Supporting the US Information andCommunications Technology Industry

68 Microsoft Digital Defense Report 2022

ReportIntroduction

The State ofCybercrime

Reconnaissance-based
OT attacks

The unique configuration of each PLC is
described in the project file, which contains thedefinition of the environment and its assets, theladder logic, and more.

Complex supply chains use specific design
information to plan the actual system.
Of the myriad assets that compose thisdesign information, the most sensitive is the
project file, which defines the environment
and its assets. This file is a crucial strategic
target for threat actors seeking to gain
access and deploy a successful attack
wholly tailored to the environment.

In most environments that show evidence of an
attack, analysis shows the timeline preceding theattack far exceeds the length of the attack itself.
Threat actors often invest months in simulating
the environment and its assets remotely, making
many attempts to construct a model andprepare their targeted attack. As environments
continuously change and integrate new devices,vulnerabilities are created specifically aroundthe data in the project and configuration files.
The theft of a project file can advance an attack
by weeks or months and enable attackers tomodel the target environment rapidly andaccurately, increasing the difficulty in detecting
malicious activity.

Targeting industrial systems to disrupt
operational processes involves two steps.
1. First, the attacker must access the OT network.
This can be done by entering through IoT deviceson the enterprise side of the network (Purdue
Model Level 4) and crossing the IT-OT boundary,traditionally separated by firewalls and networking
equipment, into the operation and control levels.
2. Second, the network devices must be
identified. Industrial systems use standard
devices and components in customized
architectures specifically designed for theirenvironments. One of these standard devices
is the programmable logic controller (PLC).
Every manufacturer develops unique interfaces
and functions for their PLCs, which are a
crucial component of industrial systems, andthese devices are further configured withcustomized schemas specifically designed forthe customer’s environments.

Industroyer and Incontroller
We have observed increased attacks onorganizations, critical infrastructure, andgovernment targets by state sponsored actors
using modular malware and attack frameworks.
New attempts to interfere with critical operations
in Ukraine underscore the growing threat ofreconnaissance-based OT attacks that arehighly tailored to their target environments.
The extended reconnaissance and researchphases carried out by nation state cyber actors
points to a strategy of using cyber warfare tocripple infrastructure remotely to meet specificstrategic or operational goals in blended cyberkinetic operations and political strategy.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

ContributingTeams

We have observeda growing threat ofreconnaissance-based
OT attacks that are highly
tailored to their target
environments.

69

Microsoft Digital Defense Report 2022

Reconnaissance-based
OT attacks
Continued

In early 2022, two adaptable critical OT attacks
were identified. A cyber-physical attack onelectrical substations and protection relays
in Ukraine was carried out with customized
malware, including a variant of Industroyer,
a malware known to have caused power outages
in Ukraine after its deployment in 2016.
Industroyer2 is the first known redeploymentof malicious OT attack malware on a newtarget. It utilized the IEC104 protocol (standard
protocol for power system monitoring andcontrol) plugin developed for Industroyer andtargeted mostly PLC-like remote terminal units
with model number ABB RTU540/560. The writerof this malware used knowledge of the victim’s
environment to issue commands repeatedly
to predetermined outputs, ensuring they
could not be turned on manually. This ensured
longer lasting power outages and a moredamaging impact.

ReportIntroduction

The State ofCybercrime

Incontroller, a modular attack framework
identified during the same period, is a modular
toolkit that significantly reduces the lead timeto penetrate and attack OT devices, bypassing
legacy security solutions. The general-purpose
toolkit has data-collection, reconnaissance, andattack capabilities that are highly customizable
to different environments and can greatly impact
the research phase for an OT attack, reducing
the time necessary to perform reconnaissance,
supporting the simulation of environments
by extracting information about devices andtheir configurations.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

The Incontroller framework supports protocols
for Schneider Electric and Omron PLCs andcollects information, such as firmware version,model type, and connected devices. The toolkit
can issue commands to change configurations
and turn outputs on and off. Once anenvironment is accessed, the framework supports
implanting backdoors in devices for the delivery
of more payloads, issuing vulnerabilities toincrease access points, uploading of ladder logic,
and the ability to initiate DoS attacks. The genericnature of the toolkit enables a threat actor to
attack an environment quickly without needing
to write new attacks for every PLC or location.
This allows the actor to easily interact withdifferent types of machines potentially across
many industries.

Cyber
Resilience

Contributing
Teams

Actionable insights
1

Avoid transferring files which containsystem definitions through unsecurechannels, or to non-essential personnel.

2

When transferring such files is unavoidable,
be sure to monitor activity on the networkand ensure assets are secure.

3

Protect engineering stations by monitoringwith EDR solutions.

4

Proactively conduct incident response
for OT networks.

5

Deploy continuous monitoring,
like Defender for IoT.

70

Microsoft Digital Defense Report 2022

ReportIntroduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Endnotes
1

2
3
4
5
6
7
8
9
10
11
12
13
14
15

See, e.g., Revised Directive on Security of Network and Information Systems (NIS2) |Shaping Europe’s digital future (europa.eu); https://eur-lex.europa.eu/legal-content/EN/TXT/
PDF/?uri=COM:2020:595:FIN&rid=1; Security Legislation Amendment (Critical Infrastructure
Protection) Act 2022 (homeaffairs.gov.au); Chile: Bill for cybersecurity and critical information
infrastructure introduced in Senate | News post | DataGuidance; Japan passes economic security
bill to guard sensitive technology | The Japan Times; Review of the Cybersecurity Act and Updateto the Cybersecurity Code of Practice for CIIs (csa.gov.sg); Proposal for legislation to improvethe UK’s cyber resilience—GOV.UK (www.gov.uk); Telecommunications (Security) Act 2021
(legislation.gov.uk); Updating the NIST Cybersecurity Framework—Journey To CSF 2.0 | NIST
Cert-In—Home Page
Initiation of consultation on introduction of cyberattack reporting obligation (admin.ch)See, e.g., untitled (house.gov)
Cyber Resilience Act | Shaping Europe’s digital future (europa.eu)
See, e.g., Microsoft Security Development Lifecycle
See, e.g., Generating Software Bills of Materials (SBOMs) with SPDX at Microsoft—Engineering@
Microsoft; see also, e.g., The Minimum Elements For a Software Bill of Materials (SBOM) |National Telecommunications and Information Administration (ntia.gov)
See, e.g., https://www.microsoft.com/en-us/msrc/cvd
The Product Security and Telecommunications Infrastructure (PSTI) Bill—product security
factsheet—GOV.UK (www.gov.uk)
Commission strengthens cybersecurity of wireless devices and products (europa.eu)
Cloud Certification Scheme: Building Trusted Cloud Services Across Europe — ENISA (europa.eu)
Certification — ENISA (europa.eu)
https://github.com/microsoft/sbom-tool” GitHub - microsoft/sbom-tool: The SBOM tool is ahighly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any varietyof artifacts.
https://www.zdnet.com/article/ripple20-vulnerabilities-will-haunt-the-iot-landscape-for-yearsto-comeIoT/OT Innovation Critical but Comes with Significant Risks (Dec 2021):
https://www.microsoft.com/security/blog/2021/12/08/new-research-shows-iot-and-otinnovation-is-critical-to-business-but-comes-with-significant-risks/

16 Uncovering Trickbot’s use of IoT devices in C2 Infrastructure (Mar 2022):
https://www.microsoft.com/security/blog/2022/03/16/uncovering-trickbots-use-of-iot-devicesin-command-and-control-infrastructure/
17 IoT Show on Channel 9 Episode on IoT Firmware Scanning (May 2022): https://docs.microsoft.
com/en-us/shows/internet-of-things-show/iot-device-firmware-security-scanning-with-azuredefender-for-iot
18 How to apply a Zero Trust approach to your IoT solutions (May 2021):
https://www.microsoft.com/security/blog/2021/05/05/how-to-apply-a-zero-trust-approach-toyour-iot-solutions/

71

Microsoft Digital Defense Report 2022

Cyber Influence
Operations
Today’s foreign influence operations utilize new
methods and technologies, making their campaigns
designed to erode trust more efficient and effective.

ReportIntroduction
Introudction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

ContributingTeams

An overview of Cyber Influence Operations 72
Introduction

73

Trends in cyber influence operations

74

Spotlight on influence operations
during the COVID-19 pandemic andRussia’s invasion of Ukraine76

Tracking the Russian Propaganda Index

78

Synthetic media80

A holistic approach to protect against
cyber influence operations

83

Contributing
Teams

Russia, Iran, and China
employed propaganda
and influence campaigns
throughout the COVID-19
pandemic often as a strategic
device to achieve broader
political objectives.
Find out more on p76

LaunchFind out more on p74

Russia’s invasion of Ukraine demonstrates
cyber influence operations integrated withmore traditional cyberattacks and kinetic
military operations to maximize impact.

Amplification

Synthetic media is becoming moreprevalent due to the proliferation oftools which easily create and disseminate
highly realistic artificial images,
videos, and audio. Digital provenancetechnology that certifies media asset
origin holds promise to combat misuse.

Russia invaded Ukraine

Producers
Good and harmful u

Find out more on p80

A holistic approach to protect
against cyber influence operations
Microsoft is building on its already mature cyber threat
intelligence infrastructure to combat cyber influence
operations. Our strategy is to detect, disrupt, defend,
and deter propaganda campaigns by foreign aggressors.
Find out more on p76

Find out more on p83

Apr 2022

Pre-position

FactorsLowbarrier to entry
On February 24, 2022,

Feb 2022

Nation states are increasingly using sophisticatedinfluence operations to distribute propaganda
and impact public opinion both domestically andinternationally. These campaigns erode trust,increase polarization, and threaten democratic
processes. Skilled Advanced Persistent
Manipulator actors are using traditional media
together with internet and social media to vastly
increase the scope, scale, and efficiency of theircampaigns, and the outsized impact they arehaving in the global information ecosystem.
In the past year, we have seen these operations
used as part of Russia’s hybrid war in Ukraine,
but have also seen Russia and other nations,
including China and Iran, increasingly turning
to social-media powered propaganda operations
to extend their global influence.

Progressionof foreign
cyber influence
operations

Cyber
Resilience

Cyber Influence
Operations

Jan 2022

Today’s foreign influence
operations utilize new methods
and technologies, making
their campaigns designed
to erode trust more efficientand effective.

Cyber influence operations are becoming increasingly
sophisticated as more governments and nation states
are using these operations to shape opinion, discredit
adversaries, and promote discord.

Devices andInfrastructure

Dec 2021

Cyber Influence
Operations

Nation State
Threats

Nov 2201

An overview of

The State ofCybercrime

Mar 2022

ReportIntroduction

Microsoft Digital Defense Report 2022

Oct 2021

72

Distribution
Unprecedented spee
Effects
Erosion of trust
Mitigation
Promising solutions

73

Microsoft Digital Defense Report 2022

Introduction

ReportIntroduction

The State ofCybercrime

Democracy needs
trustworthy information
to flourish. A key area of
focus for Microsoft are theinfluence operations being
developed and perpetuated bynation states. These campaigns
erode trust, increase
polarization, and threaten
democratic processes.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Foreign influence operations have always beena threat to the information ecosystem. However,what differs in the age of the internet andsocial media is the vastly increased scope, scale,and efficiency of campaigns, and the outsized
impact they can have on the health of the global
information ecosystem.
The age-old adage that “a lie gets halfway
around the world before the truth has a chance
to put its shoes on,” is now being borne out withdata. A Massachusetts Institute of Technology(MIT) study1 found that falsehoods are 70 percent
more likely to be retweeted than the truth
and they reach the first 1,500 people six times
faster. The information ecosystem has become
increasingly murky as propaganda campaigns
flourish on the internet and social media andundermine trust in traditional news. In a 2021
study,2 only seven percent of US adults said they
have “a great deal” of trust and confidence innewspapers, television, and radio news reporting,while 34 percent reported “none at all.”
Microsoft has been working to identify the main
actors, threats, and tactics in the foreign cyber
influence space and to share lessons learned.
In June this year, we published a comprehensive
report on the lessons learned from Ukraine,
which contained a detailed look at Russia’s
cyber influence operations.3

Cyber
Resilience

ContributingTeams

We are also studying how advanced technologies
such as deep fakes can be weaponized andundermine the credibility of journalists.
And we are working with industry, government,
and academia to develop better ways to detect
synthetic media and restore trust—such as
artificial intelligence (AI) systems that canspot fakes.
The rapidly changing nature of the information
ecosystem and nation state online propaganda,
including the melding of traditional cyberattacks
with influence operations and the interference indemocratic elections, requires a whole-of-society
approach to mitigate against both online andoffline threats to democracy.
Microsoft is dedicated to supporting a healthy
information ecosystem in which trusted news
and information thrive. We are developing tools
and threat detection capabilities to combat
the evolving and expanding risk of nation statedriven influence operations. To enable this work,
we recently acquired Miburo Solutions, wepartner with third-party validators such as the
Global Disinformation Index and NewsGuard, andwe participate and at times lead multistakeholder
partnerships, including the Coalition for Content
Provenance and Authenticity (C2PA). Only byworking together can we succeed in taking
on those who seek to undermine democratic
processes and institutions.
Teresa Hutson
Vice President, Technology andCorporate Responsibility

74

ReportIntroduction

Microsoft Digital Defense Report 2022

Trends in cyber
influence operations
Cyber influence operations are becoming
increasingly sophisticated as technology
evolves at pace. We are seeing an overlap
and expansion of the tools used in
traditional cyberattacks being applied
to cyber influence operations. Additionally,
we are seeing an increased coordination
and amplification among nation states.
Microsoft invested in combating foreign influence
operations this year by the acquisition of Miburo
Solutions, a company specializing in analysis of foreign
influence operations. Combining these analysts
with Microsoft’s threat context analysts, Microsoft
formed the Digital Threat Analysis Center (DTAC).
DTAC analyzes and reports on nation state threats,
including both cyberattacks and influence operations,combining information and threat intelligencewith geopolitical analysis to provide insights andinform effective response and protections.
More than three-quarters of people across theworld said they worry about the weaponization of
information,4 and our data support these concerns.
Microsoft and its partners have been tracking how
nation state actors are using influence operations
to achieve their strategic objectives and politicalgoals. In addition to destructive cyberattacks andcyber espionage efforts, authoritarian regimes
are increasingly using cyber influence operations
to shape opinion, discredit adversaries, incite fear,
promote discord, and distort reality.

The State ofCybercrime

These foreign cyber influence operations
typically have three stages:
Pre-position
Like the pre-positioning of malware within
an organization’s computer network, foreign
cyber influence operations pre-position false
narratives in the public domain on the internet.
The pre-positioning tactic has long helped
more traditional cyber activities, especially
if IT administrators scan their most recent
network activity. Malware that lays dormant foran extended time on a network can make its
subsequent use more effective. False narratives
that lay unnoticed on the internet can makesubsequent references seem more credible.
LaunchOften at the time most beneficial to achieve
the goals of the actor, a coordinated campaign
is launched to propagate narratives throughgovernment-backed and influenced media
outlets and social media channels.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

This three-step approach was applied in late
2021 to support the Russian false narrativearound purported bioweapons and biolabs in
Ukraine. This narrative was first uploaded toYouTube on November 29, 2021 as part of aregular English-language show by a Moscowbased American expatriate who claimed that
US-funded biolabs in Ukraine were connected tobioweapons. The story went largely unnoticed
for months. On February 24, 2022, just as Russian
tanks crossed the border, the narrative was sent
into battle. A data analytics team at Microsoft
identified 10 Russian-controlled or influenced
news sites that simultaneously publishedreports on February 24 pointing back to “lastyear’s report” and seeking to give it credence.
In addition, Russian Ministry of Foreign Affairs
officials held press conferences that further
seeded false claims about US biolabs in theinformation environment. Russian-sponsoredteams then worked to amplify the narrative onsocial media and internet sites more broadly.

Cyber
Resilience

ContributingTeams

We are seeing authoritarian regimes aroundthe world working together to pollute theinformation ecosystem to their mutual advantage.
For instance, throughout the COVID-19 pandemic
Russia, Iran, and China employed propaganda andinfluence operations using a blend of overt, semicovert, and covert methods of dissemination
to target democracies and further geopoliticalgoals (discussed further on page 76). The three
regimes played on one another’s messaging andinformation ecosystems to promote preferrednarratives. Much of this coverage consisted ofcriticisms or conspiracy theories about the UnitedStates and its allies peddled by government figures
in official statements while promoting their own
vaccines and responses to COVID-19 as superior
to the United States and other democracies.
By amplifying one another, state operated media
outlets created an ecosystem in which negative
coverage of democracies—or positive coverageof Russia, Iran, and China—produced by one
state media outlet was reinforced by others.

Progression of foreign cyber influence operations5Pre-position

LaunchAmplification

Press conference

Russian media
ecosystem coverage

Foreign media
amplifies

Amplification
Finally, nation state-controlled media and proxies
amplify narratives inside targeted audiences.
Often, unwitting tech enablers extend thenarratives’ reach. For example, online advertising
can help finance activities and coordinatedcontent delivery systems
can flood search engines.

Illustration of how narratives about US biolabs and biological weapons spread via the three broad phases of many
foreign influence operations—pre-position, launch, and amplification.

75

Microsoft Digital Defense Report 2022

Trends in cyber
influence operations
Continued

To add to the challenge, private sector
technology entities might unwittingly
enable these campaigns. Enablers can include
companies that register internet domains,
host websites, promote material on social
media and search sites, channel traffic, andhelp pay for these exercises through digitaladvertising. Organizations must be aware of thetools and methods employed by authoritarianregimes for cyber influence operations so they
can detect and then prevent the spread of
campaigns. There is also a growing need to help
consumers develop a more sophisticated ability
to identify foreign influence operations and limit
engagement with their narratives or content.

Cyber influence operations, including
authoritarian propaganda, are a threat
to democracies worldwide as theyerode trust, increase polarization,and threaten democratic processes.

ReportIntroduction

Increased coordinationand information sharing
across government, theprivate sector, and civilsociety is needed toincrease transparency
and to expose
and disrupt these
influence campaigns.

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Globally, more than three-quartersof people worry about how
information is being weaponized.

Contributing
Teams

76

ReportIntroduction

Microsoft Digital Defense Report 2022

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Spotlight on influence
operations during COVID-19
and Russia’s invasion of Ukraine

Topics covered by top 10 most-viewed coronavirus stories on RT.com(October 2021–April 2022)

Nation states seeking to control theinformation environment throughout the
pandemic and during the Russian invasionof Ukraine provide stark examples of how
authoritarian regimes blend cyber andinformation operations.

RussianEnglish“Lockdowns and boosters
prevent transmission”“Vaccinations fail to curb transmission and are
ineffective against new strains”“Russian public figures are testing positive”“Pfizer vaccine has dangerous side effects”

COVID-19 propaganda“Cases and deaths are increasing in Russia”“Mass vaccination is politically motivated”

Russia, Iran, and China employed propaganda
and influence campaigns throughout the
COVID-19 pandemic. COVID-19 featured
prominently in these campaigns in two
central ways:“The Sputnik V vaccine is highly effective”“Pfizer and Moderna conduct
unregulated trials”

1. Representations of the pandemic itself.
2. Campaigns that used COVID-19 as a strategic
device to achieve broader political objectives.
The broad objective of these types of campaigns
is two-fold: first, to undermine democracies,
democratic institutions, and the image of theUnited States and its allies on the global stage;
and second, to bolster their own standing
domestically and internationally.
An example of this can be seen in themessaging by known Russian accounts andmedia organizations targeting English language
readers versus how the Russian government
communicated with its own people regarding
the vaccine and severity of COVID-19.

Anti-vaccine propaganda targets non-Russian readers(Translated below to English)“Vaccine proof needed on public transport”

Contributing
Teams

the United States was behind the COVID-19
outbreak, writing, “in all US wars, radiological,
chemical, biological and other banned weapons
are used, inflicting a devastating toll on people
in targeted areas.”8 Russian state media outlets
and Chinese government accounts echoed thesentiment. Russia Today (RT)—a state-owned
outlet known for its role in disseminating Kremlin
propaganda9 —published at least one story
that promoted statements from Iranian officials
claiming COVID-19 might be a “product of US‘biological attack’ aimed at Iran & China”10 andpushed out social media posts suggesting as
much. For example, an RT tweet from February
27, 2020, read: “Show of hands, who isn’t going
to be surprised if it ever gets revealed that#coronavirus is a bioweapon?”11
The war in Ukraine—propaganda as a weaponof warRussian COVID-19 messaging differs by language.

Campaigns that sought to obscure the originof the COVID-19 virus offer another example.
Since the start of the pandemic, Russian, Iranian,and Chinese COVID-19 propaganda boosted
coverage from the others to amplify thesecentral themes. Much of this coverage consistedof promoting criticisms or conspiracy theories
about the United States. Regularly amplifying
one another, state media outlets developed
an ecosystem in which negative coverage of
democracies or positive coverage of Russia,
Iran, and China by one state media outlet was
reinforced by the others time and again.

Cyber
Resilience

One such example is the early suggestion
by Russian and Iranian state media that
COVID-19 might be a bioweapon created by
the United States. This claim circulated on fringe
conspiracy websites early in the pandemic after
an interview with a law professor who claimed
he believed COVID-19 was created as a weapon.6
After the interview was published on a few
websites with limited reach, the story was picked
up by state-owned media outlets. PressTV,
an Iranian English and French language outlet
sponsored by the Iranian government,7 published
an English-language story in February 2020
titled “Is coronavirus a US biowarfare weapon
as Francis Boyle believes?” The article suggested

Russia’s invasion of Ukraine provides a distinct
example of how cyber influence operations canbe melded with more traditional cyberattacks
and on the ground military operations tomaximize their impact.
In the lead up to the invasion of Ukraine,
Microsoft threat intelligence analysts saw atleast six separate Russia-aligned actors launchmore than 237 cyberattacks against Ukraine.
These campaigns sought to degrade services
and institutions, disrupt Ukrainians’ access toreliable information, and sow doubts about
the country’s leadership.

Featuring purportedly hacked, leaked, orotherwise sensitive material is a common tactic
used by Russian actors in influence operations.
Throughout the war in Ukraine, pro-Russia social
media channels have promoted what they claim
are leaked or otherwise sensitive materials from
Ukrainian sources. Leaked or sensitive material
is used by pro-Russia social media channels andoutlets as part of a broader influence strategy

400
300
200

Apr 260

Apr 18100

Apr 10In another example of how cyberattacks andinfluence operations converge, a Russian threat
actor sent Ukrainian citizens emails purporting
to be from residents of Mariupol, blaming the
Ukrainian government for the war’s escalationand calling on their countrymen to push backagainst the government. These emails were
specifically addressed (by name) to thosereceiving the email, indicating they might
have had their information stolen in an earlier
espionage related cyberattack. No malicious links
were included, which suggests intent was pureinfluence operations.

Russia used other information attacks to shapepublic opinion after events on the ground to
obscure or undermine facts. For example, on
March 7, Russia pre-positioned a narrative
through a filing with the United Nations (UN)that a maternity hospital in Mariupol, Ukraine,
had been emptied and was being used as amilitary site. On March 9, Russia bombed thehospital. After the news of the bombing broke,
Russia’s UN representative Dmitry Polyanskiy
tweeted that coverage of the bombing was “fakenews” and cited Russia’s earlier claims about its
alleged use as a military site. Russia then pushed
this narrative broadly across Russian controlledwebsites for two weeks following the attack on
the hospital.

Cyber Influence
Operations

500

Apr 02

In a Microsoft report released in April 2022,
we showcased how in an apparent attempt tocontrol the information environment in Kyiv,
Russia launched a missile strike against a TV
tower in Kyiv on the same day it launched adestructive malware against a major Ukrainian
media company.12

Devices andInfrastructure

Domains with traffic(March 9, 2022–April 30, 2022)

Mar 25

Continued

to degrade trust in institutions and cast doubt
on mainstream narratives. This information canbe manipulated to create propaganda targeting
Ukraine and the West, diminish trust in digital
security, and erode support for Western aid
to Ukraine.

Nation State
Threats

Mar 17

Spotlight on influence
operations during COVID-19
and Russia’s invasion of Ukraine

The State ofCybercrime

Mar 09

ReportIntroduction

77 Microsoft Digital Defense Report 2022

Propaganda websites published stories about thematernity hospital for about two weeks with a brief
revival beginning on April 1, 2022. Source: Microsoft
AI for Good Lab.

Satellite images of a perinatal hospitalin Mariupol in February and March 2022

Dmitry Polyanskiy@Dpol_un4

Contributing
Teams

Russia’s whitewashing of atrocities has continued
as the war has progressed. For instance, in lateJune of 2022, Russian media outlets and influencers
portrayed the bombing of a shopping mall as
justified and necessary, falsely claiming it was not
in use as a mall, but rather in use as an armory
for Ukrainian territorial defense forces.13 Several
pro-Kremlin bloggers on Telegram posted andamplified content reinforcing the “false flag”
narrative, with bloggers pointing to alleged
indicators of fabrication including the presenceof people in military uniform in footage fromthe scene14 and the absence of women in thefootage.15 Russia launched campaigns by relying
on a built-out system of propaganda messengers
and mediums. The amplification of these stories
online provides Russia the ability to deflect blameon the international stage and avoid accountability.
Nation states like Russia understand the valueof using information derived from closed
sources to influence public perceptions, using“hack and leak” campaigns to spread counter
narratives and sow distrust.
Links to further information

That’s how #fakenews is born. We
warned in our statement back on
7 March (russia.ru/en/news/070322n)that this hospital has been turned
into a military object by radicals.
very disturbing that UN spreads
this information without verification#Mariupol #Mariupolhospital
1

Cyber
Resilience

8

Defending Ukraine: Early Lessons fromthe Cyber War | Microsoft On the Issues

Microsoft’s own satellite image analysis showed
the perinatal hospital was bombed. The first photo isfrom February 24, 2022 and the second is from March24, 2022. Photo source: Planet Labs.

An overview of Russia’s cyberattack
activity in Ukraine | Microsoft
Special Report
Disrupting cyberattacks targeting Ukraine |Microsoft On the Issues

78

ReportIntroduction

Microsoft Digital Defense Report 2022

Tracking the Russian
Propaganda Index

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Russian Propaganda Index in the United States(October 2021–April 2022)

In January 2022, nearly one thousand US
websites were referring traffic to Russian
propaganda websites. The most common
topics for Russian propaganda websites
targeting a US audience were the war in
Ukraine, US domestic politics (either proTrump or pro-Biden) and COVID-19 andvaccine-related narratives.
The Russian Propaganda Index (RPI) monitors
the flow of news from Russian state-controlled
and sponsored news outlets and amplifiers as aproportion of overall news traffic on the internet.
The RPI can be used to chart the consumptionof Russian propaganda across the internet andin different geographies on a precise timeline.
Microsoft notes, however, that we can only
observe the Russian propaganda posted topreviously identified websites. We do not haveinsight into propaganda on other types of
websites, including authoritative news websites,
unidentified websites, and social network groups.

Apr 2022

Mar 2022

Feb 2022

Jan 2022

Dec 2021

Nov 2201

Oct 2021

On February 24, 2022,
Russia invaded Ukraine

79

ReportIntroduction

Microsoft Digital Defense Report 2022

Tracking the Russian
Propaganda Index
Continued

Russian Propaganda Index: Ukraine
When the Ukraine war began, we saw a 216
percent increase in Russian propaganda, peaking
on March 2. The chart below shows how thissudden increase coincided with the invasion.
The two graphs show how Russian propaganda
surged soon after the invasion began.

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Russian Propaganda Index: New Zealandversus Australia and the United States

Russian Propaganda Index in the
United States: English and Spanish

An assessment of the RPI in New Zealand showeda spike in late 2021 that was related to COVID-19
propaganda. This spike in Russian propaganda
consumption in New Zealand preceded anincrease in public protests in early 2022 in
Wellington. A second spike was clearly related to
the Russian invasion of Ukraine and exceeded the
RPIs of Australia and the United States.

The RPI also tracks propaganda across languages.
Multiple outlets, including RT and Sputnik News,
are available in over 20 languages. These include
English, Spanish, German, French, Greek, Italian,
Czech, Polish, Serbian, Latvian, Lithuanian,
Moldavian, Belarusian, Armenian, Ossetian,Georgian, Azerbaijani, Arabic, Turkish, Persian,and Dari.

RPI, New Zealand versus Australia
and the United States

The following graph shows that the RPI for
Spanish language news in the United States ismuch higher than for English language news.

RPI, Ukraine(October 7, 2021–April 30, 2022)

Cyber
Resilience

Contributing
Teams

Russian propaganda
is high in Latin America

Russian propaganda consumption is 2X
higher among Spanish speakers

5 Feb 2022

EnglishApr 2022

Mar 2022

Feb 2022

Jan 2022

Russian propaganda consumption in New Zealand issimilar to Australia until the first week of December
2021. After December, Russian propaganda
consumption in New Zealand increased by over
30 percent relative to consumption in Australia andthe United States.

Dec 2021

United States

On February 24, 2022,
Russia invaded Ukraine

Nov 2021

26 Jan 2022

16 Jan 2022

6 Jan 2022

27 Dec 2021

17 Dec 2021

7 Dec 2021

17 Nov 2021

27 Nov 2021

New ZealandEnglishspeakers

Oct 2021

Australia

7 Nov 2021

28 Oct 2021

18 Oct 2021

Apr 2202

Mar 2022

Feb 2022

Jan 2022

Dec 2021

Nov 2021

Oct 2021

On February 24, 2022,
Russia invaded Ukraine

8 Oct 2021

Spanish speakers
propaganda
consumption

SpanishRussian propaganda consumption in the United Statesis two times higher among Spanish speakers.

RT in Spanish is the international
news outlet with the highest
number of page views andFacebook followers.
Source: Microsoft AI for Good Research Lab

ReportIntroduction

80 Microsoft Digital Defense Report 2022

Synthetic media
We are entering a golden era for AIenabled media creation and manipulation.
Microsoft analysts note this is driven by two
key trends: the proliferation of easy-to-use
tools and services for artificially creating
highly realistic synthetic images, videos,
audio, and text, and the ability to quickly
disseminate content optimized
for specific audiences.
Neither of these developments is inherently
problematic on its own. AI-based technology
can be used to create fun and exciting digitalcontent, whether creating purely synthetic or
enhancing existing material. These tools arebeing widely used by enterprises for advertisingand communications and by individuals to create
engaging content for their followers. However,synthetic media, when created and distributedwith the intent to harm, has the potential to
do serious damage to individuals, companies,
institutions, and society. Microsoft has been adriving force in developing technologies andpractices, both internally and across the wider
media ecosystem, to limit this harm.
This section explores insights from Microsoft
analysis on the current state of the art technology
for creating damaging synthetic content, theharms that can arise if this content is widely
disseminated, and technical mitigations thatcan defend against synthetic media based
cyber threats.

The State ofCybercrime

Creating synthetic media
The field of synthetic text and media is advancing
incredibly fast as techniques that were once
only possible with the vast computing resourcesof large movie studios are now integrated
into phone apps. At the same time, tools are
becoming easier to use and can generate content
with a level of realism that can fool even forensic
media specialists. We are very close to reaching
the point at which anyone can create a synthetic
video of anyone saying or doing anything. It’s
not unreasonable to believe we are entering an
era where a significant quantity of the content
we see online is fully or partially synthetic using
AI techniques.

With the availability of moresophisticated, easy-to-use, and widely
available tools, synthetic content
creation is on the rise and will soon
be indistinguishable from reality.
There are many high-quality free and commercial
image, video, and audio editing tools. These tools
can be used to make simple but potentiallydamaging changes to digital content like adding
misleading text, face-swapping, and removing oraltering context. Such “cheap fakes” are widelyused to spread nefarious content, promote
political ideologies, and damage reputations.
A well-known example is the 201916 video of US
Speaker of the House, Nancy Pelosi, slurring her
speech and appearing inebriated. Although it wasquickly determined that the video was slowed

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

to create the effect, the “cheap fake” spread
far and wide before the original video andcontext surfaced.
More sophisticated approaches to altering media
content includes the application of advanced
AI techniques to (a) create purely synthetic
media, and (b) make more sophisticated edits
of existing media. The term deepfake is often
used for synthetic media that has been createdusing cutting-edge AI techniques (the namecomes from the deep neural networks thatare sometimes used). These technologies arebeing developed as standalone apps, tools,
and services and integrated into establishedcommercial and open-source editing tools.
Such technologies are weaponized by bad actors
hoping to damage individuals and institutions.
Examples of deepfake techniques include:• Face swap (video, images)—replacing a facein a video with another. This technique can beused to attempt blackmail of an individual,
company, or institution, or to place individuals
in embarrassing locations or situations.
• Puppeteering (video, images)—using avideo to animate a still image or second video.
This can make it appear an individual said
something embarrassing or misleading.
• Generative adversarial networks(video, images)—a family of techniques
for generating photorealistic imagery.
• Transformer models (video, images, text)—
creating rich imagery from text descriptions.

Cyber
Resilience

Contributing
Teams

Such advanced AI-based techniques are not yet
widely used in cyber influence campaigns today,
but we expect the problem to grow as the tools
become easier to use and more widely available.
The impact of synthetic media manipulation
The use of information operations to cause harmor expand influence is not new. However, thespeed with which information can spread, andour inability to quickly sort fact from fiction,mean the impact and harm caused by fakes andother synthetically generated malicious media
can be much greater, as demonstrated with thePelosi example.
There are several categories of harm which
we consider: market manipulation, payment
fraud, vishing, impersonations, brand damage,
reputational damage, and botnets. Many ofthese categories have widely reported real-world
examples, which could undermine our ability toseparate fact from fiction.
A longer-term and more insidious threat is to ourunderstanding of what is true if we can no longer
trust what we see and hear. Because of this, any
compromising image, audio, or video of a public
or private figure can be dismissed as fake—an
outcome known as The Liar’s Dividend.17 Recent
research18 shows this abuse of technology
is already being used to attack financial
systems, although many other abuse scenarios
are plausible.

81

ReportReportIntroduction
Introduction

Microsoft Digital Defense Report 2022

Synthetic media
Continued

Detecting synthetic media
Efforts are underway across industry,
government, and academia to develop betterways to detect and mitigate synthetic media
and restore trust. There are several promising
paths forward, as well as barriers thatwarrant consideration.

The State ofCybercrime

One approach is to build AI-based systems
that can spot fakes—essentially “defensive”
AI systems to counter the offensive AI systems.
This is an area of active research where
current systems for creating synthetic audio
and video leave telltale artifacts that can be
spotted by trained media forensic analysts andautomated tools.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

open competition to build deepfake image
detectors.19 It is tempting to increase investment
in developing more advanced detectors, but
Microsoft is highly skeptical this will result inmeaningful improvements for two reasons:

Unfortunately, while current fakes have revealing
flaws, the precise artifacts tend to be specific toa particular tool or algorithm. This means training
on known fakes does not usually generalize toother algorithms as demonstrated in a 2020

First, we have excellent physical models thatreflect the real world. Current fake creators cut
corners, resulting in detectable artifacts, but
newer models will become ever more realistic.
There is nothing inherently special about areal-world scene captured by a camera that
can’t be modeled by a computer.

Cyber
Resilience

Contributing
Teams

Second, advanced fake-creation algorithms use atechnique called Generative Adversarial Networks(GANs) as part of the creation process. A GAN
plays two AI systems against each other using agenerator to create the fake and a discriminator
to detect fake images and train the generator.
Any investment in developing a better detector
will only enable the generator to improve thequality of the fakes.

Synthetic media landscape
Factors
Low barrier to entry

Easy-to-use tools

More sophisticated tools

Easy to distribute

Producers
Good and harmful uses

Organizations
and institutions

Individuals
and consumers

Malicious actors
to cause harm

Distribution
Unprecedented speed

Social media
amplification

Targeted emails
and ads

Audio files
via voice mail

Direct fromthe source

Effects
Erosion of trust

Damage to individual
reputation

Fraud and otherfinancial damage

Damage to organizationor brandMarketmanipulation

Mitigation
Promising solutions

Advanced AI
systems for detection

Digitalprovenance

Cross-industry
efforts

82 Microsoft Digital Defense Report 2022

Synthetic media
Continued

Provenance for digital assets
If detecting fakes is unreliable, what can be done
to protect against the harmful uses of synthetic
media? One important emerging technology isdigital provenance—a mechanism that enables
digital media creators with the ability to certify
an asset and helps consumers identify whether
or not the digital asset has been tampered with.
Digital provenance is particularly important in
the context of today’s social media networks
given the speed with which content can travel
the internet and the opportunity for bad actors
to easily manipulate content.

ReportIntroduction

Digital Provenance Technology is a modern
version of cryptographic document signing,
designed to capture the source, edit history, andmetadata of objects as they flow through today’s
web. The vision and technical methods forenabling this type of end-to-end tamper-proof
certification of media was developed by a crossteam of researchers and scientists at Microsoft.
We co-lead a cross-industry partnership aimed
at bringing media provenance technology to lifein Project Origin (founded by Microsoft, BBC,
CBC/Radio-Canada, and the New York Times)
and engage in the Content Authenticity Initiative(founded by Adobe). Microsoft also worked withpartners in technology and media services toestablish the Coalition for Content Provenanceand Authenticity (C2PA). C2PA is a standards
organization that recently published the mostadvanced digital provenance specification toutilize with media assets including images,
videos, audio, and text.
A C2PA-enabled object carries a manifest
that protects the object and metadata fromtampering, and the accompanying certificate
identifies the publisher.

900%

year over year increasein proliferation of
deepfakes since 2019.20

The State ofCybercrime

Synthetic media was not originallydesigned to cause harm, but it isbeing weaponized by bad actors
to undermine trust in individuals
and institutions.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Digital provenance is a promising
emerging technology that has thepotential to help restore people’s trust
in online media content by certifying
the origin of a media asset.
Publicly available solutions based on the C2PA
specification are surfacing either as a new featurein existing products or new standalone apps
and services. We expect most of the commonlyused capture, editing, and authoring tools to be
C2PA enabled in a few years. This presents anopportunity for enterprises to determine theirneeds and uses for digital provenance today, andto require this additional layer of protection in
the tools they use in existing workflows.

Cyber
Resilience

Contributing
Teams

Actionable insights
1

Take proactive steps to protect yourorganization against misinformation
threats through proactive consideration ofyour PR and communication responses.

2

Use provenance technology to protect
official communications.

Links to further information
A promising step forward on
disinformation | Microsoft On the Issues
A Milestone Reached, January 31, 2022
Project Origin | Microsoft ALT Innovation
Coalition for Content Provenance andAuthenticity (C2PA)
Explore technical details about thesystem Project Origin uses for media
authentication | Microsoft ALT Innovation

83

ReportIntroduction

Microsoft Digital Defense Report 2022

A holistic approachto protect against cyber
influence operations
Microsoft is building on its already maturecyber threat intelligence infrastructure
to develop a broader, more inclusive viewof cyber influence operations.
We use a framework for suggested response andmitigation strategies to combat the threat posedby operations, which can be divided into four
key pillars: detect, disrupt, defend, and deter.
In addition, Microsoft has adopted four principles
to anchor our work in this space. First is acommitment to respect freedom of expression
and uphold our customers’ ability to create,publish, and search for information via ourplatforms, products, and services. Second, we
proactively work to prevent our platforms andproducts from being used to amplify foreign
cyber influence sites and content. Third, we will
not willfully profit from foreign cyber influence
content or actors. Finally, we prioritize surfacing
content to counter foreign cyber influence
operations by utilizing internal and trusted
third-party data on our products.

The State ofCybercrime

DetectAs with cyber defense, the first step in countering
foreign cyber influence operations is developing
the capacity to detect them. No single company
or organization can hope to individually makethe progress that is needed. New, broader
collaboration across the tech sector will be
crucial, with progress in analyzing and reporting
cyber influence operations relying heavily on
the role of civil society, including in academic
institutions and nonprofit organizations.
Recognizing this role, researchers Jake Shapiro
and Alicia Wanless at Princeton University andthe Carnegie Endowment for International
Peace respectively have mapped out plans tolaunch the new “Institute for Research on the
Information Environment” (IRIE). With support
from Microsoft, the Knight Foundation, and Craig
Newmark Philanthropies, the IRIE will create an
inclusive multistakeholder research institution
modeled after the European Organization
for Nuclear Research (CERN). It will combine
expertise in data processing and analysis to
speed up and scale new discoveries in this space.
Findings will be shared to inform policymakers,
technology companies, and consumers
more broadly.
DefendThe second strategic pillar is to shore up
democratic defenses, a longstanding priority inneed of investment and innovation. It should takeaccount of the challenges technology has created
to democracy, and the opportunities technology
has created to defend democratic societies
more effectively.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Microsoft’s strategy framework is
aimed at helping cross-sectoral
stakeholders detect, disrupt, defend,
and deter against propaganda—
particularly campaigns byforeign aggressors.
It is appropriate to start with one of the great
technological challenges of our age—theimpact of the internet and digital advertisingon traditional journalism. Since the 1700s, a free
and independent press has played a special rolein supporting every democracy on the planet—
uncovering corruption, documenting wars, andilluminating the largest societal challenges ofthis and every other time. However, the internet
has gutted local news by devouring advertising
revenue and luring away paid subscribers.
Many local newspapers have collapsed. One of
the many insights from our recent work is towns
that lack a newspaper are unknowingly andinevitably exposed to a greater than averagevolume of foreign propaganda. For thesereasons, one of democracy’s critical defensive
prongs must strengthen traditional journalism
and a free press, especially at the local
level. This requires ongoing investment
and innovation that must reflect the
local needs of different countries andcontinents. These issues are not easy,
and they require multistakeholder
approaches, which Microsoft
and other tech companies
are increasingly supporting.

Cyber
Resilience

ContributingTeams

We also need new innovations in public policy,
which needs to be a public priority. This can
include laws that enable publishers to negotiate
advertising revenue collectively with technology
companies, and legislation that provides tax
credits to relieve local newsrooms of a portionof their payroll taxes for journalists they employ.
Journalists need many other tools for their craft,including the ability to separate content fromlegitimate and fraudulent sources.
There is also a rapidly evolving need to help
consumers develop a more sophisticated ability
to identify nation state-driven information
operations. While this might seem daunting,it resembles the work the tech sector has
long pursued to combat other cyber threats.
Consider the education of consumers to look
more carefully at an email address to help spot
spam or other fraudulent communications.
Initiatives in the United States—such as the News
Literacy Project and the Trusted Journalism.

A longer-term andmore insidious threat is to
our understanding of what istrue if we can no longer trust
what we see and hear.

84 Microsoft Digital Defense Report 2022

A holistic approachto protect against cyber
influence operations
Continued

Program—are helping to develop better
informed consumers of news and information.
Globally, new technology like the browser plugin
from NewsGuard can help move this effort
forward much faster.
This also should remind us that part of thefoundation for democracy is an education in
civics. As always, this effort needs to start inschools. But we live in a world that requires we
receive ongoing civics education throughout
our lifetime. The new Civics at Work pledge, led
by the Center for Strategic and International
Studies, and of which Microsoft was an inauguralsignatory and partner, seeks to reinvigorate civics
literacy within corporate communities. It is agood example of the breadth of opportunity
to strengthen our democratic defenses.
Disrupt
In recent years, Microsoft’s Digital Crimes Unit
(DCU) has refined tactics and developed tools to
disrupt cyber threats ranging from ransomware
to botnets and nation state attacks. We havelearned many critical lessons, starting with therole of active disruption in countering a broad
range of cyberattacks.

ReportIntroduction

The State ofCybercrime

As we think about countering cyber influence
operations, disruption might play an evenmore important role and the best approach todisruption is becoming clearer. The most effective
antidote to broad deception is transparency.
That is why Microsoft increased its capacity
to detect and disrupt nation state influence
operations by acquiring Miburo Solutions,a leading cyber threat analysis and researchcompany specializing in the detection of andresponse to foreign cyber influence operations.
Our experience has shown that governments,
technology companies, and NGOs should
attribute cyberattacks carefully and with ample
evidence. Understanding the impact of suchdisruption is vital and can be even more helpful
in disrupting cyber influence. Witness the
US government’s information-sharing in thelead-up to Russia’s invasion of Ukraine that
put transparency into effective action—suchas exposing Russian plans including specificcampaigns like a plot to use a fake graphic video.
As shown in last summer’s publication fromthe CyberPeace Institute in Geneva on ongoingcyberattacks inside and outside Ukraine, there
is an opportunity for a broad range of civilsociety and private-sector organizations toadvance transparency relating to cyber influence
operations. Reliable reports about newly
discovered and well-documented operations
can help the public better evaluate what it
reads, sees, and hears, especially on the internet.
To this end, Microsoft will build on and extend
its existing cyber reports and will release newreports, data, and updates related to what we
discover about cyber influence operations,

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

including attribution statements whenappropriate. We will publish an annual report thatuses a data-driven approach to look across thecompany at the prevalence of foreign information
operations and next steps to ensure incremental
improvement. We will also consider additional
steps that build on this type of transparency.
The role of digital advertising is especially
important, for instance, since advertising can help
fund foreign operations while simultaneously
creating an appearance of legitimacy for foreignsponsored propaganda sites. New efforts will beneeded to disrupt these financial flows.

Cyber
Resilience

Contributing
Teams

Through rapid radical transparency, democratic
governments and societies can effectively blunt
influence campaigns by attributing the sourceof nation state attacks, informing the public,
and building trust in institutions.

We have increased technical capacity
to detect and disrupt foreign influence
operations and are committed totransparently reporting on these
operations like our reportingon cyberattacks.

Deter
Finally, we cannot expect nations to change
behavior if there is no accountability for violatinginternational rules. Enforcing such accountability
is uniquely a governmental responsibility.
Yet increasingly, multistakeholder action isplaying an important role in strengthening andextending international norms. More than 30
online platforms, advertisers, and publishers—
including Microsoft—signed on to the recently
updated European Commission’s Code of Practiceon Disinformation, agreeing to strengthenedcommitments to tackle this growing challenge.
Like the recent Paris Call, Christchurch Call,and Declaration on the Future of the Internet,
multilateral and multistakeholder action canbring together the governments and publicamong democratic nations. Governments canthen build on these norms and laws to advancethe accountability the world’s democracies needand deserve.

Actionable insights
1

Implement strong digital hygiene
practices across your organization.

2

Consider ways to reduce any unintended
enabling of cyber influence campaigns by
your employees or your business practices.
This includes reducing supply to known
foreign propaganda sites.

3

Support information literacy and civic
engagement campaigns as a key
component to help societies defend
against propaganda and foreign influence.

4

Engage directly with groups relevant
to your industry working to address
influence operations.

85

Microsoft Digital Defense Report 2022

ReportIntroduction

The State ofCybercrimeEndnotes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

https://mitsloan.mit.edu/ideas-made-to-matter/mit-sloan-research-about-social-mediamisinformation-and-elections?msclkid=8dc75d6abcfe11ecad9946a058d581c9
https://news.gallup.com/poll/355526/americans-trust-media-dips-second-lowest-record.aspx
Defending Ukraine: Early Lessons from the Cyber War (microsoft.com)
https://www.edelman.com/sites/g/files/aatuss191/files/2022-01/2022 Edelman Trust Barometer_
FullReport.pdf
Russian Foreign Ministry Spokeswoman Maria Zakharova: https://tass.com/politics/1401777;
Lavrov: https://www.cnn.com/2022/05/05/opinions/sergey-lavrov-hitler-comments-ukrainekauders/index.html,Kirill Kudryavtsev/Pool/AFP/Getty Images
https://apnews.com/article/conspiracy-theories-iran-only-on-ap-media-misinformationbfca6d5b236a29d61c4dd38702495ffe
https://www.justice.gov/opa/pr/united-states-seizes-websites-used-iranian-islamic-radio-andtelevision-union-and-kata-ib
https://www.presstv.ir/Detail/2020/02/04/617877/Is-the-coronavirus-a-US-bioweapon
https://www.state.gov/wp-content/uploads/2022/01/Kremlin-Funded-Media_January_update-19.pdf
https://www.rt.com/news/482405-iran-coronavirus-us-biological-weapon/
https://web.archive.org/web/20220319124125/https://twitter.com/RT_com/
status/1233187558793924608?s=20
https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4Vwwd
Russia’s Kremenchuk Claims Versus the Evidence—bellingcat
https://t.me/oddr_info/39658
https://t.me/voenacher/23339
Fact check: “Drunk” Nancy Pelosi video is manipulated | Reuters
https://lawcat.berkeley.edu/record/1136469
https://carnegieendowment.org/2020/07/08/deepfakes-and-synthetic-media-in-financialsystem-assessing-threat-scenarios-pub-82237
Deepfake Detection Challenge Results: An open initiative to advance AI (facebook.com)
Deepfakes 2020: The Tipping Point, Johannes Tammekänd, John Thomas, and Kristjan Peterson,
October 2020

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

ContributingTeams

86 Microsoft Digital Defense Report 2022

Cyber
Resilience
Understanding the risks and rewardsof modernization becomes crucial toa holistic approach to resilience.

ReportIntroduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

ContributingTeams

An overview of Cyber Reslience87

Introduction

88

Cyber resiliency: A crucial foundationof a connected society

89

The importance of modernizing
systems and architecture

90

Basic security posture is a determining
factor in advanced solution effectiveness92

Maintaining identity health is fundamental
to organizational well-being
93
Operating system default security settings 96
Software supply chain centrality

97

Building resilience to emerging DDoS,
web application, and network attacks

98

Developing a balanced approach to data
security and cyber resiliency
101
Resilience to cyber influence operations:
The human dimension

102

Fortifying the human factor with skilling

103

Insights from our ransomware
elimination program104

Act now on quantum security implications 105
Integrating business, security,and IT for greater resilience106

The cyber resilience bell curve

108

87

ReportIntroduction

Microsoft Digital Defense Report 2022

An overview ofCyber Resilience
Cyber security is a key enablerof technological success.
Innovation and enhanced
productivity can only beachieved by introducing
security measures thatmake organizations as
resilient as possible against
modern attacks.
The pandemic has challenged us to pivot our
security practices and technologies to protect
Microsoft’s employees wherever they work.
This past year, threat actors continued to takeadvantage of vulnerabilities exposed during
the pandemic and the shift to a hybrid work
environment. Since then, our principal challenge
has been managing the prevalence andcomplexity of various attack methods
and increased nation state activity.

The State ofCybercrime

Effective cyber resiliency requiresa holistic, adaptive approach towithstand evolving threats tocore services and infrastructure.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

While password-based attacks
remain the main source of identity
compromise, other types of attacks
are emerging.

Cyber
Resilience

ContributingTeams

The vast majority of successful
cyberattacks could be prevented
by using basic security hygiene.
Find out more on p108

Find out more on p89

Modernized systems and architecture
are important for managing threatsin a hyperconnected world.

Find out more on p93
Find out more on p90

Basic security posture is adetermining factor in advanced
solution effectiveness.
Find out more on p92

The human dimension of resilienceto cyber influence operations is ourability to collaborate and cooperate.
Find out more on p102

Over the past year,
the world experienced
DDoS activity thatwas unprecedented involume, complexity,
and frequency.

Find out more on p98

88 Microsoft Digital Defense Report 2022

Introduction

ReportIntroduction

The State ofCybercrime

The pandemic challenged us
to pivot our security practices
and technologies to protect
Microsoft’s employees
wherever they work. This
past year, threat actors
continued to take advantage
of vulnerabilities exposed
during the pandemic andthe shift to a hybrid work
environment. Since then, ourprincipal challenge has been
managing the prevalence andcomplexity of various attack
methods and increased nation
state activity.
Digital threat activity and the level of cyberattack
sophistication increases every day. Many of
today’s complex attacks focus on compromisingidentity architectures, supply chains, and third
parties with varying degrees of security controls.
In particular, we have observed identity phishingattacks are a clear and present threat. However,these types of attacks are generally unsuccessful
with good identity management, phishing
control, and endpoint management practices.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

As a result, we must remember the basics: ninetyeight percent of attacks can be stopped withbasic hygiene measures in place. At Microsoft,
we manage identities and devices as part ofour Zero Trust approach, which includes leastprivileged access and phish resistant credentials
to effectively stop threat actors and keep ourdata protected.
Today, even threat actors who lack sophisticatedtechnical skills can launch incredibly destructive
attacks, as access to advanced tactics,
techniques, and procedures become broadly
available in the cybercrime economy. The war
in Ukraine demonstrated how nation state
actors have escalated their offensive cyber
operations through the increased use ofransomware. Ransomware is now a sophisticatedindustry with threat actors using double or
triple extortion tactics to extract a pay out anddevelopers offering ransomware as a service(RaaS). With RaaS, threat actors utilize an affiliate
network to carry out attacks, lowering the barrier
to entry for less skilled cybercriminals and,ultimately, expanding the attacker pool.
As a result, Microsoft designed a ransomware
elimination program. The goal of the programis to remediate gaps in controls and coverage,
contribute to feature enhancements for services,and develop recovery playbooks for our security
operations center and engineering teams in theevent of a ransomware attack.

Cyber
Resilience

Contributing
Teams

Recent supply chain and third-party supplierattacks indicate a major inflection point in theindustry. The disruption these attacks cause
for our customers, partners, governments, andMicrosoft continues to increase, illustrating
the importance of focused attention on cyber
resiliency and collaboration across security
stakeholders. Adversaries are also targetingon-premises systems, reinforcing the need fororganizations to manage vulnerabilities posedwith legacy systems by modernizing and moving
infrastructure to the cloud where security ismore robust.
We live in an era where security is a key enablerof technological success. Innovation andenhanced productivity can only be achievedby introducing security measures that makeorganizations as resilient as possible against
modern attacks. As digital threats increase andevolve, it’s crucial to build cyber resilience into
the fabric of every organization.
Bret Arsenault
Chief Information Security Officer

89 Microsoft Digital Defense Report 2022

Cyber resiliency:
A crucial foundationof a connected society

ReportIntroduction

The State ofCybercrime

Developing a holistic approachto cyber resiliency
Cyber resiliency requires a holistic, adaptive, andglobal approach that can withstand evolving threats
to core services and infrastructure, including:

Digital transformation has forever altered theway organizations interact with customers,
partners, employees, and other stakeholders.
New technologies provide huge opportunities
to engage with people, transform products, andoptimize operations. The pandemic accelerated
the digital transformation by driving innovativetechnologies which allow people to collaborate
in new ways and from any location.

• Basic cyber hygiene as described in our
cyber resilience bell curve.
• Understanding and managing the risk/reward
trade-off of digital transformation.
• Real-time response capabilities that enableproactive detection of threats and vulnerabilities.
• Protection against known attacks andpreventive activity against new andanticipated attack vectors, including
ability to automatically remediate.
• Reduced impact of attacks and disasters
through fault isolation and segmentation.
• Automated recovery and redundancy in theevent of disruption.
• Prioritizing operational testing to find gaps
and understanding shared responsibilities anddependencies on external resources such as
cloud-based security solutions.

As cyber threats become endemic, preventing
them from compromising an organization
becomes more difficult in our “always connected”
world. Cyber resiliency represents an organization’s
ability to continue operations and sustain growth
acceleration despite the barrage of attacks.
Prevention must be balanced with survival andrecovery capabilities and governments and enterprises
are developing comprehensive models that extend
beyond security and privacy to protect assets, data,and other resources as part of cyber resiliency.

An effective cyber resiliency program begins withresource fundamentals such as understanding
services available and having a reliable catalog
of resources that can be called upon in the eventof a disruption. Building on that foundation,
the program must be able to assess its own
effectiveness, measure the performance of criticalservices and their dependencies, test and validate
capabilities across on-premises and cloudservices, and feed continuous improvement
across the organization’s digital lifecycle.

The revolution in digital technology has
seen organizations transform to become
ever more connected in both the way
they operate and the services they offer.
As threats in the cyber landscape increase,building cyber resilience into the fabric of
the organization is as crucial as financial
and operational resilience.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

To deliver a holistic approach, we are partneringwith organizations to identify their most criticalon-premises and online services, businessprocesses, dependencies, personnel, vendors
and suppliers. We also look to identify assets
and resources associated with customer andmarket expectations, regulatory and contractual
obligations, and internal operations. As these
critical resources are identified, parallel efforts
should detect and monitor threats, disruptions,potential attack vectors, and system andprocess vulnerabilities. The ability to do thisunder the current skills shortage requires rigor
in prioritization based on overall risk posed tothe organization.
This type of holistic approach needs to beadaptive against a backdrop of a continually
evolving threat landscape, with a goal of driving
measurable performance enhancement, reduced
time to detect, respond and recover, and reduced
radius of impact in the event of disruption.
The approach must also recognize the increasing
connectedness of threats. For example, a security
incident might result in a data breach withprivacy implications, requiring many internaland external teams to work together to respondquickly and minimize impact.

Cyber resiliency is the ability of anenterprise to continue operations andsustain growth acceleration despite
disruptions, including cyberattacks.

Cyber
Resilience

Contributing
Teams

Actionable insights
1

Build and manage technology systems
that limit the impact of a breach andenable them to continue to operate
securely and effectively, even if a breachis successful. Focus on common criticalassets, support for agility, and architect
for adaptability (for example, hybrid andmulti--cloud, multi--platform), reduce attack
surfaces (for example, remove unused
applications and over-provisioned
accessrights), assume compromised resources,and expect adversaries to evolve.

2

When planning digital projects, consider
potential threats alongside opportunities,
and shared responsibilities for resilience
across the digital technology supply chain,including cloud--based security solutions.

3

Build systems to embed security by design
and take steps to anticipate, detect,withstand, adapt, and respond to future
evolving threats.

4

Ensure business leaders consult
with security teams as necessary tounderstand the risks associated with newdevelopments. Likewise, security teams
should consider business aims and advise
leaders on how to pursue them securely.

5

Ensure clear operational practices andprocedures for organizational resilience
are in place for cyber incidents.

ReportIntroduction

90 Microsoft Digital Defense Report 2022

The importance ofmodernizing systems
and architecture
As we develop new capabilities for a
hyperconnected world, we must manage
the threats posed by legacy systems
and software.
Legacy systems—those developed before
modern connectivity tools such as smartphones,
tablets, and cloud services became the normrepresent a risk to an organization still using
them. This risk exposure is reinforced by thefindings of the Microsoft Security Services for
Incident Response team, a group of security
professionals that helps customers respondto and recover from attacks.
Over the past year, issues found amongcustomers recovering from attacks were related
to six categories as shown in the chart on thispage. The following page outlines actionable
steps to take for improved resilience.

Over 80 percent of security incidents
can be traced to a few missing
elements that could be addressed
through modern security approaches.

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Key issues impacting cyber resiliency
Insecure Active Directory configuration90%

Insecure Azure Active Directory configuration

72%

Legacy authentication protocols

98%

Legacy hashing algorithms

84%

No privilege isolation in Active Directory via tier model98%

No use of Privilege Access Workstations

100%

Lack of local admin password management controls

82%

Lack of Privilege Access Management controls

84%

Excessive admin credentials found98%

No MFA or MFA not mandatory for privileged accounts

70%

No MFA or MFA not mandatory for user accounts

90%

No MFA for VPN access62%

No or very limited use of endpoint detection and response

52%

Skill gaps across security operations

70%

Gaps in security monitoring coverage and integration

60%

No SIEM/SOAR solution

56%

Ineffective SOC processes and operating model54%

No immutable or usable backups

44%

Ineffective data loss prevention controls

88%

Lack of patch and vulnerability management

76%

Unmanaged OT and legacy systems

50%

No Zero Trust of security framework adoption

88%

Insecure design and configuration across cloud platforms

86%

Lack of SDL practices in DevOps

82%

0

10

20

30

40

50

60

70

80

90

100

Insecure configuration of identity provider

Low maturity security operations

Insufficient privilege access and lateral movement controls

Lack of information protection control

No multifactor authentication

Limited adoption of modern security frameworks

This chart shows the percentage of impacted customers missing basic security controls which are critical toincreasing organizational cyber resilience. Findings are based on Microsoft engagements over the past year.

Cyber
Resilience

Contributing
Teams“Leaders should think about cyber
resilience as a critical facet of businessresilience. They should plan for cyberdisruptions in the same way they do natural
disasters or other unforeseen events andbring together internal stakeholders like
operations, communications, legal, and more,
to craft strategies. Doing so will help ensureorganizations bring their critical businesssystems back online as quickly as possible
to resume normal business operations.
But it doesn’t stop there. As many
suppliers
organizations rely on third-party
and service providers, leaders should extend- cyber resilience planning to their end-to
end value chain to further ensure business
continuity and resilience.”
Ann Johnson,
Corporate Vice President of Security,
Compliance, Identity, and Management
Business Development

91

ReportIntroduction

Microsoft Digital Defense Report 2022

The importance ofmodernizing systems
and architectureContinued

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

There are clear areas which organizations can address to modernize their approach and protect from threats:
Problem

Actionable steps

Insecure configuration of identity provider
Misconfiguration and exposure of identity platforms and its components
are a common vector for gaining unauthorized high privilege access.

Follow security configuration baselines and best practices when deploying
and maintaining identity systems such as AD and Azure AD infrastructure.

Insufficient privilege access and lateral movement controls
Administrators have excessive permissions across the digital environmentand often expose administrative credentials on workstations subject tointernet and productivity risks.

Secure and limit administrative access to make the environment
more resilient and limit the scope of an attack. Employ Privilege
Access Management controls such as just in time access and justenough administration.

No multifactor authentication (MFA)
Today’s attackers do not break in, they log on.

MFA is a critical and fundamental user access control that all organizations
should enable. Coupled with conditional access, MFA can be invaluable infighting cyber threats.

Low maturity security operations
Most impacted organizations used traditional threat detection tools anddid not have relevant insights for timely response and remediation.

A comprehensive threat detection strategy requires investments inextended detection and response (XDR) and modern cloud native
tools employing machine learning to separate noise from signals.
Modernize security operations tools by incorporating XDR that can
provide deep security insights across the digital landscape.

Lack of information protection control
Organizations continue to struggle to put together holistic information
protection controls that have full coverage across data locations andremain effective throughout the information lifecycle and are alignedwith business criticality of data.

Identify your critical business data and where it is located.
Review information lifecycle processes and enforce data protection
while ensuring business continuity.

Limited adoption of modern security frameworks
Identity is the new security perimeter, enabling access to disparate digital
services and computing environments. Integrating Zero trust principles,
application security and other modern cyber frameworks enables
organizations to proactively manage risks which otherwise organizations
might struggle to envision.

Zero Trust frameworks enforce concepts of least privilege,
explicit verification of all access, and always assume compromise.
Organizations should also implement security controls and practices
in DevOps and application lifecycle processes for higher assurance levelsin their business systems.

Implement access restrictions by enforcing segregation of privileges,
least privilege access and utilizing privileged access workstations (PAW)for managing identity systems.

92

Microsoft Digital Defense Report 2022

Basic security postureis a determining factor
in advanced solution
effectivenessThrough our analysis, we discovered aprevalence of common blind spots inorganizational defenses which enableattackers to gain initial access, establish
a toehold, and implement an attack,even in the presence of advanced
security solutions.
In many cases, the outcome of a cyberattackis determined long before the attack begins.
Attackers leverage vulnerable environments
to gain initial access, conduct surveillance, andwreak havoc via lateral movement and encryption
or exfiltration. Stopping an attacker at an earlystage greatly increases the opportunity to reduce
the overall impact.
Microsoft studied specific configurations insecurity postures to identify the most common
shortcomings in actual practice in theseenvironments. This enabled us to see the mostcommon vulnerabilities exploited during humanoperated ransomware attacks that allowed thethreat actors to gain access and travel througha network undetected.

ReportIntroduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Basic security configurations must be turned on

Risk posed by unknown devices

An organization’s devices which are notonboarded or are outdated (both in relation
to vulnerabilities and security agent status)
serve as potential entry points and accessestablishment routes for attackers. We foundthat while ensuring organizational devices areonboarded with an updated endpoint detection
and response1 (EDR) and endpoint protection
platform2 (EPP) solution is an important step,
it is not guaranteed to stop ransomware.

In contrast to cloud networks, where customers
know which assets are running on which
operating systems, on-premises networks cancontain a wide variety of devices such as IoT,
desktops, servers, and network devices that are
not monitored or managed by the organization.

Advanced solutions such as EDR and EPP
are critical in detecting an attacker earlyin the attack flow and enabling automatic
remediation and protection. However,since these advanced solutions rely on afundamental ability to detect an attack, theyrequire basic security configurations to beturned on. In fact, we observed a prevalenceof scenarios with advanced solutions in placethat were undermined by the absence of basic
security configurations.
Best practices in security configurations is agreater indicator of resilience than security
operations center (SOC) analyst response time
We observed a 70 percent reduction in thetime it takes a SOC analyst to view and act
on a relevant alert over a six-month period
across our customer and partner population.
This increased awareness is a good sign.
However, while security configuration visibility
improved SOC analyst performance, enablingproduct visibility by onboarding and updating
the organization’s devices was a greater predictorof successful prevention.

The average enterprise network has over 3,500
connected devices that are not protectedby an EDR agent and might have access toenterprise resources or even to high value assets.
Microsoft Defender for Endpoint (MDE) uses
network inspection to discover devices andprovide information about device classifications
for those connected to the network such asdevice name, operating system distribution,and device type.

3,500

average number ofconnected devices inan enterprise that are
not protected by an
endpoint detection
and response agent.

For devices not supported by an EDR agent,at least be aware of their existence and act
to protect them by assessing vulnerabilities,
as well as restricting network access.

Cyber
Resilience

Contributing
Teams

Actionable insights
1

Even advanced solutions can beundermined by the absence of basic
security configurations.

2

Invest in best practices in security posture
configurations to protect against futureattacks. These basic settings produce a
massive return on investment in termsof an organization’s ability to defend
against attacks.

3

Onboard all applicable devices to an
EDR solution.

4

Be sure to update security agents andensure protection from tampering
to enable greater visibility and fuller
protection benefits of products.

ReportIntroduction

Microsoft Digital Defense Report 2022

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

4,500

1.4

In the time it takes
to read this statement,
we’ve defended against
4,500 password attacks.

1.2

1.0

0.8

0.6

0.4

Breach replay

Password sprayJun 2022

May 2022

Apr 2022

Mar 2022

Feb 2022

Jan 2022

Dec 2021

Nov 2021

Oct 2021

Sep 2021

Aug 2021

Jul 2021

Jun 2021

May 2021

Apr 2021

Mar 2021

Feb 2021

Jan 2021

Dec 2020

Nov 2020

0

Oct 2020

0.2

Sep 2020

We have seen a rise in targeted password
spray attacks, with very large spikes in volume
of attacker traffic spread across thousands of
IP addresses.

Devices andInfrastructure

1.6

Aug 2020

Password-based attacks are still common, andover 90 percent of accounts compromised via
these methods are not protected with strong
authentication. Strong authentication uses morethan one factor of authentication, for example
password + SMS and FIDO2 security keys.

Nation State
Threats

1.8

Jul 2020

Safeguarding identity is more important
than ever. While password-based attacks
remain the main source of identity
compromise, other types of attacks are
emerging. The volume of sophisticatedattacks continues to increase relative
to the previous norm of password sprayand breach replay.

The State ofCybercrime

Users compromised by attack category

Jun 2020

Maintaining identity
health is fundamental toorganizational well-being

Millions

93

Other*

Users compromised per month by attack category. Password spray attack volumes were highly volatile, as seen in the
spikes in November 2021 and March 2022. These spikes represent thousands of users and thousands of IP addresses
touched. *“Other” indicates attacks different from password spray and breach replay, including phishing, malware,
man-in-the-middle, on-premises token issuer compromise, and others. Source: Azure AD Identity Protection.

This trend is positive, but significant growth isstill needed to reach majority coverage of strong
authentication; customers not already using
strong authentication in their environments
should start the planning and deploymentof strong authentication to protect theirusers.3 While designing strong authentication
deployment, passwordless authentication
should be considered as it offers the mostsecure usable experience, eliminating the riskof password attacks.

While strong authentication usage has doubled
since 2019, just 26 percent of users and 33 percent ofadministrators are using strong authentication. Source:
Azure Active Directory.

Volume of detected token replay attacks
70,00060,00050,00040,00030,00020,000Jun 2022

May 2022

Apr 2022

Mar 2022

Jan 2022

Feb 20220

Dec 2021

10,000

Oct 2021

The share of other forms of attack increased
in 2022. We saw a rise in targeted attacks thatspecifically avoid password-based authentication
to reduce the chance of detection. These attacks
leverage browser single sign-on (SSO) cookies orrefresh tokens obtained via malware, phishing,and other methods. In some cases, attackers
choose infrastructure in locations near thegeographic location of the targeted user tofurther reduce the chances of detection. We haveseen a steady rise in token replay attacks,
reaching over 40,000 detections per month inAzure AD Identity Protection. Token replay is theuse of tokens that were issued to a legitimate
user by an attacker that has possession of said
tokens. Tokens are commonly obtained via
malware, for example by exfiltrating the cookies
from the user’s browser or through advanced
phishing methods.

Contributing
Teams

Nov 2021

Steady rise in token replay attacks

Cyber
Resilience

Sept 2021

Cyber Influence
Operations

Jul 2021

On a positive note, we are seeing steady
growth in adoption of strong authentication
amongst the Azure Active Directory (AzureAD) enterprise customer base. For Azure AD,
strong authentication monthly active users(MAU) grew from 19 percent to 26 percent in
the last year, while strong authentication MAU
for administrative accounts grew from 30 toapproximately 33 percent.

Devices andInfrastructure

Aug 2021

Strong authentication adoption

100
90
80
70
60
% 50
40
30
20
10
0

Nation State
Threats

Jun 2021

Continued

Use of strong authentication(September 2019–May 2022)

Sep 2019
Nov 2019
Jan 2020
Mar 2020
May 2020
Jul 2020
Sep 2020
Nov 2020
Jan 2021
Mar 2021
May 2021
Jul 2021
Sep 2021
Nov 2021
Jan 2022
Mar 2022
May 2022

Maintaining identity
health is fundamental toorganizational well-being

The State ofCybercrime

May 2021

ReportIntroduction

94 Microsoft Digital Defense Report 2022

Detected token replay attacks per month. Source: Azure
AD Identity Protection, unique sessions flagged by theanomalous token detection.

ReportIntroduction

Microsoft Digital Defense Report 2022

Cyber
Resilience

Actionable insights
Ensure all the accounts across yourorganization are protected by strong
authentication measures.

2

Passwordless authentication offers themost secure and user-friendly
experience,eliminating the risk of password attacks.

10,0003

Disable legacy authentication acrossyour entire organization.

0

4

Protect high value and administrative
accounts with phish-resistantforms ofstrong authentication.

5

Modernize from an on-premises
identity
provider to a cloud identity provider andconnect all your apps to the cloud-based
identity provider for consistent user
experience and security.

30,000Jun 2022

Apr 2022

Source: Azure AD Identity Protection.

Detected instances of phishing followed by
man-in-the-middle attacks

Links to further information

1,200This World Password Day consider ditching
passwords altogether | Microsoft Security

1,000
800
600
400

May 20220

Apr 2022200
Mar 2022

The share of sophisticated attacks
continues to rise, underscoring theneed for phish-resistant factors ofmultifactor authentication.

May 2022

Mar 2022

Jan 2022

Feb 2022

Dec 2021

Using the concept of “MFA fatigue,” attackers
generate multiple requests for MFA to thevictim’s device, hoping that the victim will accept
the request either inadvertently or as a result of
fatigue. This attack can be prevented by using
modern authenticator apps such as Microsoft
Authenticator combined with features suchas number matching4 and enabling additional
context.5 Azure AD Identity Protection estimatedthere are 30,000 MFA fatigue attacks per month.

Nov 2021

MFA fatigue

Oct 2021

20,000

Password-based attacks are theprimary method by which accounts
are compromised.

Contributing
Teams

1

Jan 2022

Attackers can also extract tokens from victims’
devices through man-in-the-middle attacks,
in which the victim clicks a malicious link in aphishing email or instant message and is directed
to a website that looks like the legitimate sign-in
page of the identity provider. In reality, it is a web
service spun up by the attacker that relays andintercepts all traffic between the user and theidentity provider. The attacker is able to intercept
the username and password and also to relay
MFA challenges; resulting tokens issued by theidentity provider and intercepted by the attacker
might contain MFA claims that can be used by
the attacker to satisfy MFA requirements.

40,000Feb 2022

More than malware, attackers need credentials
to achieve their goals. In fact, 100 percent of all
human operated ransomware attacks include
stolen credentials. Many sophisticated intrusions
include credentials purchased from the dark web,
initially stolen from unsophisticated and broadly
distributed credential theft malware. This class of
malware has evolved to steal tokens, including
session information and MFA claims. This meansthat infections on home systems, where users
log in to corporate assets, can lead to serious
incidents on corporate networks.

Cyber Influence
Operations

Estimated instances of MFA fatigue attacks

Aug 2021

Extracting tokens

Devices andInfrastructure

Sept 2021

Continued

Microsoft Defender for Cloud Apps has detected
an average of 895 such attacks per month since
the beginning of 2022. This form of attack canbe prevented by using phish-resistant factors of
MFA, such as Certificate Based Authentication,
Windows Hello for Business, or FIDO2
security keys.

Nation State
Threats

Jul 2021

Maintaining identity
health is fundamental toorganizational well-being

The State ofCybercrime

Jun 2021

95

Source: Microsoft Defender for Cloud Apps.

96 Microsoft Digital Defense Report 2022

Operating systemdefault security settings
With the continuously evolving security
threat landscape, we see an increasing needfor computer security configured by default
to improve cyber resiliency. While operating
system security is more urgent, complex,
and business critical than ever before, it canbe challenging to get right and manage.
In the past, computer and device security
included built-in security features that thecustomer or IT professional was expected
to configure to their own desired level.
This approach is no longer adequate, asattackers are using more advanced tools in
automation, cloud infrastructure, and remote
access technologies to achieve their aims. It has
become critical that all layers of security, fromthe chip to the cloud, are configured by default.
Microsoft has evolved to configure Windows
operating system security by default.6

ReportIntroduction

The State ofCybercrime

Customers who embrace defense—in depth
including a layered security posture, newsecurity features, regular and consistent patching
and updates, as well as security training andawareness to report phishing and other scams– can expect less malware.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

For devices where security is
not enabled by default, Microsoft
recommends manually configuring
them in settings where possible.

To simplify defense in depth, Windows 11
has tightly integrated hardware and software
protections turned on by default, including
memory integrity, Secure Boot, and a Trusted
Platform Module 2.0. Windows 10 users on
capable hardware can also turn these features
on in the Windows Settings app or in the
BIOS menu.
Older devices in general often do not haveas strong an alignment between hardware
security and software security techniques.
For devices where security is not enabled bydefault, manually configure them in settings
where possible.7

Be proactive about applying
continuous operating system
updates and security patches that
help provide protection throughout
the hardware and software lifecycle.

Cyber
Resilience

Contributing
Teams

Actionable insights
1

Use a passwordless solution whichbinds sign--on credentials in the Trusted
Platform Module, specifically look fora passwordless solution that meets theFaster Identity Online (FIDO) Alliance8
industry standard.

2

Perform timely clean up of all unused andstale executables sitting on organizations’devices.

3

Protect advanced firmware attacks byenabling memory integrity, Secure Boot,and Trusted Platform Module 2.0, if notenabled by default, which hardens bootusing capabilities built into modern CPUs.

4

Turn on data encryption andcredential protection.

5

Enable application and browser
controls for enhanced protection from
untrusted applications and other built-in
exploit protections.

6

Enable memory access protection to help
protect against casual physical attacks
such as someone plugging a malicious
device into externally accessible ports.

Links to further information
Windows Security Book | Commercial
New security features for Windows 11
will help protect hybrid work | Microsoft
Security Blog

ReportReportIntroduction
Introduction

Microsoft Digital Defense Report 2022

Software supply
chain centrality
Attacks on third-party apps, plugins,and extensions can erode customer trustin suppliers that play a central role in the
supply ecosystem. Using network theory
to look at software centrality helps
illuminate the criticality of patching,especially for central apps.
The Windows App Network of 18 million
application executables is installed and used
across five million organizations, providing a
top-level view of our software ecosystem. Of
the 100,000 most used applications, 97 percent
are produced by third-party organizations whose
updates and security patches are maintained bythem. This illustrates two important traits of ourcommercial application ecosystem.
First, there is centrality in the Windows commercial
application ecosystem. Only the top 100,000 (of the
18 million) applications are used on 1,000 or more
devices. In other words, just over one half of 1
percent of these applications have this kind of broadreaching effect among the device ecosystem.
Second, there is diversity in the manageabilityof those applications, where the top 10,000
application suppliers manage the updates
and security patches of these most usedcommercial applications. This demonstrates
the interdependence a company has on adiverse set of software suppliers’ security,
compliance, and management controls.

The State ofCybercrime

3.5M
3.0M
2.5M
2.0M
1.0M
0.5M

Publisher

Devices andInfrastructure

Cyber Influence
Operations

35M
70M
105M
Estimated Active Device Count
Microsoft Corporation
Third Party

140M

The top applications are used by millions of organizations
and tens of millions of devices. Because they are nearubiquitous, adversaries are on constant lookout toexploit vulnerabilities in these top applications, which
can impact millions of devices in the user base.

We observe millions of commercial devices stillusing vulnerable application versions many
months after patch release or even years beyond
the end of product support. For example, there
are more than one million active Windows
commercial devices running version of a PDF
reader that has not been supported since 2017.

Old versions of applications which
are unsupported remain in active
use on millions of commercial devices.
As a result, organizations are at riskof carrying vulnerabilities that will
not be patched.

100
90
80
70
60
% 50
40
30
20
10
0
0 Day

Cyber
Resilience

Contributing
Teams

Software resiliency maintenanceshould include regular disabling or
uninstalling of unused applications.
The security and compliance of anorganization depends on its own
efforts and on the efforts of its
software suppliers.

Rate of critical patch deployment

1.5M

0.0M
0M

Nation State
Threats

For in-support application versions, we see aplateauing of the speed of critical patch adoption,
which is the opposite of the trend that will drive
resiliency. Instead, the curve should show an
exponential upwards adoption of patches monthover month, to achieve the resiliency needed.

Commercial penetrationof most-used applications
Estimated Count of Organizations

97

78% of devices stillat risk after 9 months

Unpatched

Actionable insights

3 mo

6 mo

1

Perform timely updates to all applications
and endpoints through your organization.

2

Perform timely cleanup of all unused
and stale executables sitting onorganizations’ devices.

9 moPatchedAfter examining a critical vulnerability that affected 134
versions of a set of browsers, we found that 78 percent,or millions of devices, still used one of the affectedversions nine months after the patch was released.

We used the InterpretML9 toolkit to identify
characteristics correlated with organizations thatare more likely to have devices with older app
versions. The most important of these predictors
included: low hours of engagement on devices;
geographic areas such as Asia Pacific and Latin
America; and industries such as automotive,
chemicals, telecommunications, transportand logistics, health payors (claim handlers),
and insurance.

Links to further information
Microsoft Intune documentation |Microsoft Docs
Manage apps | Microsoft Docs
Microsoft Defender for Endpoint |Microsoft Security
OSS Secure Supply Chain Framework |Microsoft Security Engineering
Microsoft Open Source Software Secure
Supply Chain Framework | GitHub2,000

1,500

1,000

1–2 min

3–5 min

6–10 min

11–20 min21–30 mins

31–40 min

51–60 min

1–2 hours

2–3 hours

3–4 hours

4–10 hours>10 hours

May 2022

Apr 2022

Mar 2022

Feb 2022

Jan 2022

Dec 2021

Nov 20210

Oct 2021

500

Sep 2021

Most attacks observed over this past year wereshort-lived. Approximately 28 percent of theattacks lasted less than 10 minutes, 26 percent
lasted 10–30 minutes and 14 percent lasted
31–60 minutes. Thirty-two percent of the attacks
were more than an hour in duration.

2,500

Aug 2021

Attack duration

Contributing
Teams

Cyber
Resilience

3,000

Jul 2021

In November 2021, Microsoft thwarted a
volumetric DDoS attack with a throughput of 3.4
terabits per second (Tbps) from approximately
10,000 sources spanning multiple countries.
Similar high volumetric attacks above 2+Tbps
were mitigated in 2022 highlighting that it’s notjust the complexity, frequency of attacks that’s
increasing, but also the volume (bandwidth)of attack.

Cyber Influence
Operations

Number of DDoS attacks and duration distribution(March 2021–May 2022)

Jun 2021

Attack complexity, frequency, andvolume continue to grow and are
no longer limited to holiday seasons,indicating a shift toward year-roundattacks. This highlights the importanceof ongoing protection beyond
traditional peak traffic seasons.

Over the past year, the world experienced DDoS
activity that was unprecedented in volume,
complexity, and frequency. This DDoS explosion
was driven by a substantial increase in nation
state attacks and continued proliferation of lowcost DDoS-for-hire services. Microsoft mitigatedan average of 1,955 attacks per day, a 40 percent
increase from the prior year. Previously, the peak
number of attacks normally occurred during theend-of-year holiday season. This year, however,
the most recorded in a day was on August 10,
2021. This might indicate a shift toward yearround attacks and highlights the importanceof ongoing protection beyond traditional peaktraffic seasons.

Devices andInfrastructure

May 2021

Accelerated digital transformation has
brought an end to the traditional networkand security perimeter model. Moving to
the cloud means enterprises must adopt
cloud-native network security to protect
digital assets.

Distributed denial ofservice (DDoS) attacks

Nation State
Threats

Apr 2021

Building resilience
to emerging DDoS,
web application, andnetwork attacks

The State ofCybercrime

Mar 2021

ReportIntroduction

98 Microsoft Digital Defense Report 2022

41–50 min

Most attacks in the last year were short-lived. Approximately 28 percent of the attacks lasted less than 10 minutes.

ReportIntroduction

99 Microsoft Digital Defense Report 2022

Building resilience
to emerging DDoS,
web application, andnetwork attacks

The State ofCybercrime

DDoS attack vectors
UDP Spoof flood attacks 55%

Other 20%

Continued

DDoS attack vectors
In the past year, the attack vectors commonly
employed were User Datagram Protocol (UDP)
reflection on port 80 using simple service
discovery protocol (SSDP), connectionlesslightweight directory access protocol (CLDAP),
domain name system (DNS), and network time
protocol (NTP) comprising one single peak.
We also saw an increase in application layer
DDoS attacks targeting websites, with
16.3 million peak RPS (requests per second)and 9.89 Tbps peak traffic.

TCP Ack flood attacks 19%

DNS amplification attack 6%

UDP Spoof flood attack rose to the top vector in
the first half of 2022, from 16 percent to 55 percent.
TCP Ack flood attack decreased from 54 percent to19 percent.

NationNation State
State
Threats
Threats

Devices andInfrastructure

Cyber Influence
Operations

Geographic target regions
Of the DDoS attacks detected over the past year,
54 percent were conducted against targets in
the United States, a trend that might partiallybe explained by the fact that most Azure andMicrosoft customers are in the United States.
We also saw a sharp uptick in attacks against
India, from just 2 percent of all attacks in thesecond half of 2021 to 23 percent in first half of2022. East Asia, Hong Kong in particular, remains
a popular target at 8 percent. For Europe, we saw
concentrations of attacks against Amsterdam,
Vienna, Paris, and Frankfurt regions.
DDoS attack destination
United States 54%
United Arab Emirates 1%

Cyber
Resilience

ContributingTeams

Web application exploits
Web application firewall (WAF), in combination
with DDoS protection, forms an integral part ofdefense-in-depth strategy for protecting web
and application programming interface (API)assets. Microsoft observed upwards of 300 billion
WAF rules triggered per month via Azure WAFs.
Distribution most prevalent attack types
Header injection attacks 1%

Remote code execution(RCE) attacks 1%
Cross site scripting(XSS) attacks 5%
RFI injection attacks 5%

Australia 1%

Japan 1%

South Korea 1%
United Kingdom 1%

In 2022, Microsoft mitigated nearly
2,000 DDoS attacks daily and thwarted
the largest ever DDoS attack reported
in history.

Brazil 1%

South East Asia 3%

Europe 6%

The gaming industry continues to be the top
target of DDoS attacks, mostly from mutations of
the Mirai botnet and low-volume UDP protocol
attacks. Since UDP is commonly used in gaming
and streaming applications, an overwhelming
majority of the attack vectors were UDP spoof
floods, while a small portion were UDP reflection
and amplification attacks.

East Asia 8%
India 23%

We attribute the high volume of attacks in Asia to theregion’s huge gaming footprint, especially in China,
Japan, South Korea, and India. This footprint will continue
to expand as increasing smartphone penetration drives
the popularity of mobile gaming, suggesting thisgeographic target will only continue to grow.

LFI injection attacks 21%
SQL injection attacks 67%

Azure WAF detects billions of Open Web Application
Security Project (OWASP) Top 1010 attacks daily.
According to our signals, attackers most attempted
SQL injection attacks followed by local file injection
and remote file injection attacks. This is in line with
the OWASP Top Ten list showing injection attacks
as the third most common type of web attacks.

There has also been an increase in bot attacks
against Azure web applications, with an averageof 1.7 billion bot requests per month and 4.6
percent of that traffic consisting of bad bots.

ReportIntroduction

100 Microsoft Digital Defense Report 2022

Building resilience
to emerging DDoS,
web application, andnetwork attacks
Continued

Due to an increasing number of bots
performing credential stuffing attacks,
credit card fraud, cyber influence
campaigns, and supply chain attacks,
we expect to see a steady increase in
bot attacks against web applications.

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Network intrusions: detection and prevention

Actionable insights

We observed a significant increase in network layer exploits, particularly
malware, in 2022. Azure Firewall intrusion detection and prevention system(IDPS) blocked more than 150 million connections in the month of June alone.

1

Inspect all traffic between systems withina data center or cloud service, and traffic
seeking to access them.

2

Develop a robust all-year-round network
security response strategy.

3

Use cloud native security services toimplement a robust zero trust network
security posture.

IDPS Deny traffic reason
Lateral attacks remotemanagement 2%

JA3—malicious
encrypted traffic HTTPS 38%

Malicious DNS
traffic DNS 5%

User agent HTTP 26%

Links to further information
Improve your security defenses forransomware attacks with Azure Firewall |Azure Blog and Updates | Microsoft Azure
Attempted user
privilege gain RPC 29%

IDPS traffic alert reasons
Malicious DNS
traffic—Non-DNS traffic
on DNS port DNS 4%

Remote execution over
SMB SMB/SMB2 76%

JA3—malicious encrypted
traffic HTTPS 20%

Analysis of IDPS alert and deny traffic shows the following approaches used byattackers. In the Deny traffic, we are seeing attackers using SSL to hide their activities
and remote execution attacks are becoming more common. In the Alert traffic,
we are seeing SMB/SMB2 protocols used to perform remote execution attacks.

Anatomy of a DDoS amplification attack |Microsoft Security BlogIntelligent application protection fromedge to cloud with Azure Web Application
Firewall | Azure Blog and Updates |Microsoft Azure101 Microsoft Digital Defense Report 2022

Developing a balanced
approach to data security
and cyber resiliency
The digital transformation has fueled avast expansion of data assets and a risein security, compliance, and privacy risks.
Cyber resilient organizations must balance
investments in data protection, compliance,and recovery capabilities and integratethese with specialized regulatory response
processes to address distinct typesof breaches.
Data breaches are not a matter of if, but when.
The IBM and Ponemon Institute’s “Cost of a Data
Breach, 2021” study reports a global average data
breach cost of $4.24 million USD (up 10 percent
from the previous year) and $9.05 million USD in
the United States. Compliance failures were foundto be the top cost-amplifying factor. Conversely,
breach cost reductions were associated with bestpractices such as incident response (IR) planning,Zero Trust deployment maturity, security AI and
automation, and use of encryption.

Data breaches are inevitable.
Organizations that take a balanced
resilience approach will reduce
the frequency, impact, and costof breaches.

ReportIntroduction

The State ofCybercrime

Data governance, security, compliance,and privacy are interdependent
We have seen data gain prominence in recent
years as a crucial value creation engine fororganizations. At the same time, the riseof privacy regulations requiring both data
governance and security have blurred the lines
between risk roles. While newer C-level roles
such as the Chief Data Officer (CDO) or the Chief
Privacy Officers (CPO) have a vested interest in
security and compliance, the implementationand operationalization of data protection often
relies on teams led by the Chief Information
Officers (CIO) and/or Chief Information Security
Officer (CISO). It is not a one-way street, asdata governance initiatives led by CDOs also
have security benefits. As a result of thisinterconnectedness, IT, data governance, security,
compliance, and privacy teams need to work
ever more closely to achieve efficiency andmanage risk.
Unified data risk management platforms
for the entire organization’s data estateis the future
Aligning IT, data governance, security,
compliance, and privacy management process
is difficult in an environment of bespoke
applications for each discipline and inconsistent
coverage across the typical organization hybrid,
multi-cloud data sprawl. We believe thatorganizations need a single pane of glass tolocate and know their data, protect their data,
govern the access, usage, and lifecycle of data,and prevent data loss across the data estate.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Working from the same data inventory andactivity information facilitates cross-teamprocesses, yields a more comprehensive risk
picture, and allows organizations to better
prepare and streamline their response toa breach.
Data inventory
and activity

CIO
CRO
CCO
CISO
CDO
CPO
DPO

The “single pane of glass” should act as a prism.
Teams that have a stake in data security, compliance,and privacy need different yet consistent views of
the same data inventory and activity to come intoalignment and collaborate. Data activity includes data
access, modification, and movement events, which area valuable part of the data security equation.

Effective data governance,
security, compliance, and privacy
are interdependent and requirecross-team collaboration.

Cyber
Resilience

Contributing
Teams

Actionable insights
1

Balance defense with recovery andminimize data breach impact by investingin compliance, data protection, andresponse capabilities.

2

Develop and adopt processes and toolsthat cut across data risk silos and cover
the full data estate.

Links to further information

Microsoft Purview—Data
Protection—
Solutions | Microsoft Security
The future of compliance and data
governance is here: Introducing Microsoft
Purview | Microsoft Security Blog

102 Microsoft Digital Defense Report 2022

Resilience to cyber
influence operations:
The human dimension
Over the last five years, advances ingraphics and machine learning haveintroduced easy-to-use tools capableof quickly generating high-quality,
realistic content that can spreadwidely across the internet in seconds.
When it comes to events reported via text, audio,
and visual content, we have reached a point
where neither humans nor algorithms can reliably
distinguish fact from fiction. The proliferationof these tools and their outputs are casting
doubt on the trustworthiness of all digital media,
disrupting our understandings of local andworld events. New forms of influence operations
enabled by advances in technology have grave
implications for democratic processes.11

ReportIntroduction

The State ofCybercrime

Questions arise about what we can do to prepare
for a more resilient future against these cyber
influence operations. Technology is only one
part of the puzzle. It’s going to take multiple
efforts, including education aimed at media
literacy, awareness, and vigilance, investments inquality journalism—with trusted reporters on thescene, locally, nationally, and internationally—
networks of sharing and alerting about influence
operations, and new kinds of regulations thatpenalize malevolent actors who generate ormanipulate digital media with an aim to deceive.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

We also recognize that restoring trust indigital content is an ambitious goal that will
require diverse perspectives and participation.
There is not one company, or institution, or
government that can solve these threats on
its own. Our superpower as humans is ourability to collaborate and cooperate. This isespecially important now because it will require
everyone—global governments, industries,
academia, and especially news, social, andmedia organizations—working together forthe betterment and health of our society.

Cyber
Resilience

Contributing
Teams

Links to further information
Applications for artificial intelligence in
Department of Defense cyber missions |Microsoft On the Issues
Artificial Intelligence and Cybersecurity:
Rising Challenges and Promising
Directions. Hearing on Artificial
Intelligence Applications to Operations
in Cyberspace before the Subcommittee
on Cybersecurity, of the Senate Armed
Services Committee, 117th Congress(May 3, 2022; Testimony of Eric Horvitz)

103 Microsoft Digital Defense Report 2022

Fortifying the humanfactor with skilling
Addressing the human factor is a key
component of any cybersecurity skilling
strategy. According to a Kaspersky Human
Factor in IT Security study,12 46 percent
of cybersecurity incidents involve carelessor uniformed staff who inadvertently
facilitate the attack.
Microsoft’s Education and Awareness team in
the Digital Security and Resilience organizationis responsible for fortifying the human factorof cybersecurity by empowering employees tosecure our own and our customers’ systems
and data. Our goals are to:• Reduce risk to Microsoft and our customers
by building a centralized enterprisewide core security skill set across theemployee population.
• Fortify employee security knowledge
through a multi-phased training
reinforcement approach to support desired
behavior outcomes.
• Foster culture change by making a security
mindset an intrinsic part of Microsoft’s culture
through annually required security training
and events.
• Promote a one-stop centralized web resourcefor best practices, company policy information,and incident reporting for all things
cybersecurity related.

ReportIntroduction

The State ofCybercrime

A targeted, centralized cybersecurity skilling
program reaches every Microsoft employee
at least once each year. Training offerings are
optimized to support current cybersecurity
initiatives and deliver measurable behavior
outcomes. Microsoft’s Information Risk
Management Council (IRMC) plays a key rolein identifying important cybersecurity behavior
change outcomes to be addressed by training.
With all of our cybersecurity skilling programs,
we measure the solution’s efficiency,
effectiveness, and outcomes where possible.
For example, our insider threat skilling offeringhas 95 percent training compliance, exceptional
learner satisfaction, and has resulted in asignificant increase in managers reporting
possible insider threat cases via the company’s
Report It Now tool. The program includes:
Security Foundations: Centralized, enterprisewide cybersecurity awareness and compliancetraining which addresses core security andprivacy practices. This highly anticipated training
series employs an edutainment model tomake learning about cybersecurity engaging
and interesting.
STRIKE: Microsoft’s required technical training
for engineers who build and maintain lineof-business solutions. This by-invitation-onlytraining addresses timely and critical areas ofcybersecurity hygiene best practice and uses alive hybrid delivery model tailoredto audience needs.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Program specific: Targeted training programs
support specific cybersecurity initiatives including
Shadow IT, Insider Threat, and Microsoft Federal.
These offerings are tightly integrated into theoverall engagement strategy for their respective
cybersecurity initiatives through executive
sponsorship and scorecard reporting to preventa “check the box” training approach.
MSProtect: Microsoft’s centralized web resource
provides best practices, company policy
information, and incident reporting for all things
cybersecurity related. This on-demand resourceis the go-to for employees outside of formal
training offerings.

Security skilling must not be seen as
a compliance, check-the-box activity.
Instead, focus on behavior change
to allow outcomes to be monitored
across identified target behaviors,and establish listening systems todetermine the impact of offerings.

Cyber
Resilience

Contributing
Teams

Actionable insights
1

Provide security training and resources to
employees when and where they need it.

2

Develop a centralized skilling strategy
informed by stakeholders from acrossthe enterprise.

3

Ensure the impact of training is tracked
and analyzed for efficiency (quantity),effectiveness (quality), and outcomes(business impact).

Links to further information
Microsoft launches next stage of skills
initiative after helping 30 million people

104 Microsoft Digital Defense Report 2022

Insights fromour ransomware
elimination program
Microsoft has been on its own Zero Trustjourney13 in the past five years to ensure
identities and devices are robustly managed
and healthy. As the risk of ransomware
grows, we have developed a deep view
to support our approach to protecting
ourselves and our customers.
Following an in-depth internal evaluation,
we built a ransomware elimination program
to remediate gaps in controls and coverage,
contribute to feature enhancements for services
like Defender for Endpoint, Azure, and M365,
and to develop playbooks for our SOC andengineering teams on how to recover in theevent of a ransomware attack.

ReportIntroduction

The State ofCybercrime

The first step was understanding the extent ofour protection against a ransomware attack
directed at Microsoft. Efforts were already wellunderway to deploy Defender for Endpoint
and to ensure all devices are managed andcompliant with our Zero Trust policies, but weneeded to find a way to understand all facetsof the bigger question as to whether we could
effectively recover from an attack. To gain insight,
we evaluated the NIST 8374: Ransomware Risk
Management: A Cybersecurity Framework (CSF)
Profile,14 which aligns with our overall enterprise
policy against our known list of controls.
This analysis quickly identified gaps in coverage.
Next, we prioritized gaps across the Identify,
Detect, Protect, Respond, and Recover functionsof the CSF. We found strategic alignment
to Zero Trust and other programs and also
discovered gaps that had no existing workstream.
Having assessed the amount of work and effort
needed to remediate these gaps, we separated
them into two pillars:• Protect the enterprise (PtE): Define work
items that we need to do as an enterprise toprotect ourselves and be able to recover froman attack, should one be successful.
• Protect the customer (PtC): Build capabilities
into our offerings to protect our customers aswell as our business.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Embedding findings into our own enterprise
To remediate the top risks and protect ourcritical services against a ransomware attack,we plan to focus investments over the next 6 to
12 months on achieving the five scenarios below
as part of a dedicated ransomware program.
Once we succeed in each of the scenarios, we will
gradually expand the scope of the program toreach all parts of the enterprise.

Cyber
Resilience

Contributing
Teams

Actionable insights
1

Document and validate end-to-end
recovery and remediation activities
related to ransomware attacks against
critical services.

2

Involve stakeholders in updating yourEnterprise Crisis Management playbooks
to include ransomware specific activities
and a decision process and guidance todetermine if/when to pay for ransomware.

3

Scenario 2: Security team members have accessto playbooks designed to help them and otherteams within Microsoft respond to and recovercritical services from a ransomware attack.

Improve detection and protection
coverage by enabling capabilities available
in your deployed security products (e.g.
Defender for Endpoint Attack Surface
Reduction rules).

4

Scenario 3: Enterprise Resilience team members
have a standard to follow for the backup ofcritical systems. Playbooks exist and regularexercises of backup and recovery are done toensure data can be recovered in the event of aransomware attack.

Work with the security standards team todefine a baseline for protection against aransomware attack, and provide training
and documentation to engineering
teams on how to protect against aransomware attack.

5

Scenario 4: Service owners understand andimplement the required security and operational
controls and policies to protect their service,customer data, endpoints and network assets
against ransomware attacks with special focus onservices prioritized as Microsoft critical services.

Put automation in place to make thedeployment of security and operations
policies easier on the DevOps teams
and ensure that if a system drifts
from compliance it is quickly flagged
and remediated.

Links to further information

Scenario 1: Security team members understandthe overall risk associated with a ransomware
attack and have a process established to provide
awareness to the executives on control gaps andrisk status.

Scenario 5: All employees can access educational
and training resources which describe how torecognize a ransomware attack and how to notify
the security team and initiate the response.

Sharing how Microsoft protects against
ransomware | Microsoft Inside Track

105 Microsoft Digital Defense Report 2022

Act now on quantum
security implications

ReportIntroduction

The State ofCybercrime

Quantum computing is a threat to today’s
cryptography and everything it protects.

The pressure is on to manage the threat
quantum computing poses to today’s
cryptography and everything it protects.
The recently issued Memorandum on
Improving the Cybersecurity of National
Security Department of Defense andIntelligence Community Systems15
builds on US Executive Order 1042816
for Improving the Nation’s Cybersecurity
highlights software supply chain security
as critical to addressing future nationstate attacks.

The threat to today’s cryptography

What are quantum computers?

This means the pressure is on to manage thethreat to today’s cryptography and everything
it protects. Adversaries can record encrypted
data now and exploit it later once a quantum
computer is available. Waiting for quantum
computing to arrive before addressing its
cryptographic implications will be too late.

Quantum computers are machines using theproperties of quantum physics to store data andperform computations. This can be extremely
advantageous for certain tasks where they could
vastly outperform even our best supercomputers.
Quantum computing is already opening new
horizons for data encryption and processing.
Studies predict quantum computing will becomea multi-billion dollar (USD) quantum industry as
early as 2030.17 In fact, quantum computing andquantum communication are poised to havea transformative effect across a multitude ofindustries, ranging from healthcare and energy
to finance and security.

With Shor’s 1994 algorithm and an industrialscale quantum computer of more than a few
million physical qubits, all our current, widely
deployed public-key cryptographic algorithms
could be efficiently broken. It is critical toconsider, evaluate, and standardize “quantumsafe” cryptosystems that are efficient, agile,and safe against an adversarial quantum-based
attack. Software migration to “post-quantum
cryptography,” namely existing classicalalgorithms and protocols robust to quantumattack, will take years—if not a decade or more—to achieve.18

As cryptography is used throughout the cyber
ecosystem, this means our cryptographybased security services could be compromised.
For example, this includes services forcommunications (TLS, IPSec), messaging(email, web conferencing), identity and accessmanagement, web browsing, code signing,
payment transaction and other services that are
dependent upon cryptography for protection.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

As quantum computers become a reality,
third-party software components containing
implementations of cryptographic algorithms
and capabilities will require additional scrutiny
as well. This requires all organizations along thevalue chain to do their part to ensure the chain
stays secure. Industry bodies and governments
are increasing efforts to define software supply
chain security requirements and, in some cases,
introducing new mandates for securing thechain. National Security Memorandum NSM-819
establishes requirements and timelines for
implementing post-quantum cryptography
in National Security Systems (NSS). It calls
out timing expectations within 180 days for“modernization planning, use of unsupported
encryption, approved mission unique protocols,quantum resistant protocols, and planningfor use of quantum resistant cryptography
where necessary.”
Standardization is a long lead-time activity inthe transition to quantum-safe cryptography.
Standards bodies that work on standards using
public key cryptography must begin to experimentwith and adapt to post-quantum algorithms now.
New post-quantum cryptography (PQC)
algorithms—classical algorithms thought to berobust to quantum attack—are now under review
through NIST’s Post-Quantum Standardization
Project.20 This work will influence global efforts
within standards bodies. Although there will besome overlap with US government algorithm
selections, differing national body/regulatory
choices for compliant algorithms could presentinternational challenges. This fragmentation will inturn complicate product and service engineering.

Cyber
Resilience

ContributingTeams

New post-quantum cryptographyalgorithms are under review through NIST’s
Post-Quantum Cryptography Standardization
program. This work will influence global
efforts within standards bodies.
Actionable insights
Alongside SAFECode and partnering members,
immediate shorter-term activities should betaken by industry to prepare for the PQCtransition.21 These include:
1

Take an inventory of your products/codesthat use cryptography.

2

Implement a crypto agility strategy
across your organization that includes
minimizing the code churn required when
cryptography changes.

3

Pilot the use of candidate quantum-safe
algorithms in your products or services
that use cryptography.

4

Be prepared to use different public key
algorithms for encryption, key exchange,and signatures.

5

Test your applications for the impact of verylarge key sizes, ciphers, and signatures.

Links to further information
Microsoft has demonstrated the underlying
physics required to create a new kind of
qubit | Microsoft ResearchReportIntroduction

106 Microsoft Digital Defense Report 2022

Integrating business,security, and IT for
greater resilience
Robust cyber resiliency depends on
business leaders working with security
teams to implement security. In Microsoft’s
experience, security leadership is achallenging discipline that requires support
from organizational leaders to mosteffectively protect the organization.
Security leaders navigate a spectrum of dynamic
challenges spanning topics related to risk,
technology, economics, organizational process,business models, culture transformation,
geopolitical interests, espionage, andinternational sanctions compliance. Each ofthese carries nuances to be understood andclosely managed.
Security leaders are also tasked with thwarting
both intelligent, well-funded, and highly
motivated human attackers, and low-skilled,
yet effective, cybercriminals. Their teams must
defend complex technical estates often built
up incrementally over 30 or more years whensecurity was a low or nonexistent priority.
Decisions made years ago can pose risks today
until we pay off the technical debt and address
the gaps in security.

The State ofCybercrime

Organizational leaders and policymakers canhave a significant positive impact on security byactively supporting security leaders and helping
to build a bridge between integrated security
and the rest of the organization. When Microsoft
works with customers that have this alignment,
we see them building a more resilientorganization and also improving their agility
to adapt and innovate.
Organizational leadership can support security
leaders by focusing on three key areas:
1. Build security by design
Security is sometimes viewed as an obstacle oran afterthought in business processes, often
being considered in decisions only when it is toolate to avoid a risk or fix cheaply and easily.
Organizational leaders and policymakers should
ensure that they:
Include security early on new initiatives.
New digital initiatives and cloud adoption should
prioritize security to ensure organizational risk
does not increase with each new application
or digital capability. Once security is reliably
included, you can use those processes tomodernize legacy systems to get both security
and productivity benefits at the same time.
Normalize preventive maintenance forsecurity. Ensure basic security maintenance—
like applying security updates and patches andsecure configurations—has full organizational
support allocated (including budgets, scheduled
downtime, acquisition requirements for vendor
product support).

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Unfortunately, many organizations delay,defer, or apply these common practices only
partially. This provides extensive opportunities
for attackers to exploit. The need for security
normalization is captured in US NIST 800-40.22
2. Engage with security
Organizational leaders should actively participate
in and sponsor key security processes to ensure
prioritization of resources and preparedness forsecurity disasters. This includes engaging in:
Identify critical business assets.
Security leaders and teams need to know
which assets are business-critical to focus
security resources on what matters most. This isoften a new exercise that includes asking andanswering new questions that have not beenpreviously addressed.
Cybersecurity business continuity and disasterrecovery exercises. Cyberattacks can become
major events that disrupt or halt most or all
business operations. Ensuring teams throughout
the organization are prepared to handle thesesituations will reduce the time to restore business
operations, limit damage to the organization,and help sustain the trust and confidence ofcustomers, citizens, and constituents. This should
be integrated within an existing business
continuity and disaster recovery process.

Cyber
Resilience

Contributing
Teams

Security risk decisions are
best made by business or
mission owners who havefull visibility across all risks
and opportunities.

ReportIntroduction

107 Microsoft Digital Defense Report 2022

Integrating business,security, and IT for
greater resilience
Continued

3. Position security correctly
The way organizations structure security risk
accountability often sets them up for poor
security risk decision making. Risk decisions
are best made by business or mission owners
who have full visibility across all risks andopportunities, but organizations often (implicitly
or explicitly) assign security risk accountability
to subject matter experts in the security teaminstead. This places an unhealthy burden on
security teams while depriving business ownersof visibility and control over a key risk to theirbusiness. Organizations can correct this by:
Preparing business owners: Educate businessowners about security risk overall and how
these threats can and will affect their business.
Engaging security teams directly in this effort
also increases the collaborative relationship withsecurity and overall business agility.
Assigning security risk to business owners:
As business owners become informed enoughto understand and accept security risk, theorganization should explicitly shift accountability
for security risk to them while still holding
security teams responsible for managing that risk
and providing informed expertise and guidance
to the owner.

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Reduce risk by removing silos

Siloed approach
Uncertainty
Trust gap
Blame
Increasedvulnerability

Business
SecurityHigh
threat risk

IT

Organizational digital transformation
Integrated approach
Informed decision
makingLess complexity
Lowered cost
Enhanced security
and productivity

Business

Cyber
Resilience

Contributing
Teams“Cyber resilience is on a sliding scale fromclassic business continuity and disaster recovery
starting with good data backup; progressing torecovery capabilities for processes, technology,
and their dependencies (including people andthird parties); and moving to always on, self
healing services, resilience for critical roles, andfailovers for critical third parties. The most resilientorganizations promote integration between IT,
business managers, and security professionals.
Great resilience includes designing for resiliencefrom the start, having safe change management,
and granular fault isolation. Cyber resilience isjust one scenario in a good all-hazards planning
program. As cyber risks increase and theintersection between cybersecurity and resilience
becomes more important, the connection of the
Chief Information Security Officer (CISO) to theenterprise resilience program grows stronger.
Every year, more CISOs are taking ownershipfor company -wide resilience.”
Lisa Reshaur
General Manager, Risk Management, Microsoft

Security

Links to further information

IT

Lower
threat risk

From resilience to digital perseverance:
How organizations are using digitaltechnology to turn the corner in
unprecedented times | Official Microsoft Blog
How IT and security teams can work
together to improve endpoint security |Microsoft Security

108 Microsoft Digital Defense Report 2022

The cyber resilience
bell curve
Resilience success factors every organization
should adopt
As we have seen, many cyberattacks are
successful simply because basic security hygiene
has not been followed. The minimum standards
every organization should adopt are:• Enable multifactor authentication (MFA):
To protect against compromised user
passwords and helps to provide extra
resilience for identities.
• Apply Zero Trust principles: The cornerstoneof any resilience plan limiting the impact on anorganization. These principles are:
– Explicitly verify—ensure users and devices
are in a good state before allowing accessto resources.
– Use least privilege access—only allow theprivilege that is needed for access to a
resource and no more.
– Assume breach—assume system defenses
have been breached and systems might
be compromised. This means constantly
monitoring the environment forpossible attack.

ReportIntroduction

The State ofCybercrime• Use extended detection and response
anti-malware:
Implement software todetect and automatically block attacks andprovide insights to the security operations.
Monitoring insights from threat detection
systems is essential to being able to respondto threats in a timely fashion.
• Keep up to date: Unpatched and out of date
systems are a key reason many organizations
fall victim to an attack. Ensure all systems
are kept up to date including firmware, theoperating system and applications.
• Protect data: Knowing your importantdata, where it is located and whether theright systems are implemented is crucial to
implementing the appropriate protection.

98%

Basic security hygiene
still protects against
98% of attacks

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Key

Enable multifactor
authentication

Apply Zero Trustprinciples

Use modern
anti-malware-

Keep upto dateProtectdata109 Microsoft Digital Defense Report 2022

ReportIntroduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Contributing
Teams

Endnotes
1

2

3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

Endpoint Detection and Response (EDR) is an enterprise endpoint security platform designed
to help enterprise networks prevent, detect, investigate, and respond to advanced threats.
Endpoint detection and response capabilities provide advanced attack detections that are nearreal-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into thefull scope of a breach and take response actions to remediate threats.
An Endpoint Protection Platform (EPP) is a solution deployed on endpoint devices to prevent filebased malware, to detect and block malicious activity from trusted and untrusted applications,and to provide the investigation and remediation capabilities needed to dynamically respond tosecurity incidents and alerts.
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted
https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-numbermatch
https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-additionalcontext
Windows Security book: Commercial
New security features for Windows 11 will help protect hybrid work | Microsoft Security BlogFIDO Alliance: Open Authentication Standards More Secure than Passwords
https://interpret.ml/
OWASP Top Ten | OWASP Foundation
https://blogs.microsoft.com/on-the-issues/2022/05/03/artificial-intelligence-department-ofdefense-cyber-missions/
https://www.kaspersky.com/blog/the-human-factor-in-it-security/
https://aka.ms/ZTatMSFT
https://csrc.nist.gov/publications/detail/nistir/8374/final
https://www.whitehouse.gov/briefing-room/presidential-actions/2022/01/19/memorandumon-improving-the-cybersecurity-of-national-security-department-of-defense-and-intelligencecommunity-systems/
Executive Order 14028 Improving the Nation’s Cybersecurity
https://thequantumdaily.com/2020/02/18/the-quantum-computing-market-sizesuperpositioned-for-growth

18 “The Long Road Ahead to Transition to Post-Quantum Cryptography,” https://cacm.acm.org/
magazines/2022/1/257440-the-long-road-ahead-to-transition-to-post-quantum-cryptography/
fulltext
19 https://www.whitehouse.gov/briefing-room/presidential-actions/2022/01/19/memorandumon-improving-the-cybersecurity-of-national-security-department-of-defense-and-intelligencecommunity-systems/
20 https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptographystandardization
21 https://safecode.org/blog/preparing-for-post-quantum-cryptography-roadmap-initial-guidance/
22 https://csrc.nist.gov/publications/detail/sp/800-40/rev-4/final

110 Microsoft Digital Defense Report 2022

Contributing
Teams

ReportIntroduction
introduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

ContributingTeams

111 Microsoft Digital Defense Report 2022

Contributing Teams
The data and insights in this report were
provided by a diverse group of securityfocused professionals, working across manydifferent Microsoft teams. Collectively, theirgoal is to protect Microsoft, its customers,
and the world at large from the threat ofcyberattacks. We are proud to share these
insights in the spirit of transparency with acommon goal of making the world a safer
place for everyone.

ReportIntroduction

The State ofCybercrime

Azure Networking, Core: A cloud networking
team focused on the Microsoft WAN, data
center networks, and the software defined
networking infrastructure of Azure including
the DDoS platform, the network edge platform,
and network security products such as
Azure WAF, Azure Firewall, and Azure DDoS
Protection Standard.
Cloud Security Research team: By securing
the Microsoft cloud, building innovative
security features and products, and conducting
research, this team protects and empowers
Microsoft customers to securely transformtheir organizations.

AI for Good Research Lab: Harnessing thepower of data and AI to address many of theworld’s challenges. The lab collaborates withorganizations outside Microsoft, applying AI to
improve livelihoods and environments. Areas offocus include online safety (disinformation,
cybersecurity, child safety), disaster response,sustainability, and AI for Health.

Customer Security and Trust (CST): A teamdriving continuous improvement of customer
security in Microsoft products and online
services. Working with engineering and security
teams across the company, CST ensurescompliance, enhances security, and provides
more transparency to protect customers andpromote global trust in Microsoft.

Azure Edge & Platform, Enterprise & OS
Security: Responsible for the core OS andplatform security across Windows, Azure, andother Microsoft products. The team builds
industry-leading security and hardware solutions
into Microsoft platforms to drive down exploit,
identity, and malware compromise from chipto cloud. Creators of Microsoft’s Securedcore platform across PC, Edge and Server, theMicrosoft Pluton Security Processor, and more.

Customer Success: Security teams in Customer
Success work directly with customers to share
best practices, lessons learned, and guidance
to accelerate security transformation andmodernization. This team assembles andorganizes best practices and lessons learned
from Microsoft’s journey—as well as ourcustomers’—into reference strategies, referencearchitectures, reference plans, and more.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber Defense Operations Center (CDOC):
Microsoft’s cybersecurity and defense facility
is a fusion center that brings together security
professionals from across the company to protect
our corporate infrastructure and the cloudinfrastructure to which customers have access.
Incident responders sit alongside data scientists
and security engineers from across Microsoft’s
services, products, and devices groups to help
protect, detect, and respond to threats 24x7.
Democracy Forward Initiative: A Microsoft
team working to preserve, protect, and advancethe fundamentals of democracy by promoting
a healthy information ecosystem, safeguarding
open and secure democratic processes, andadvocating for corporate civic responsibility.
Digital Crimes Unit (DCU): A team of attorneys,investigators, data scientists, engineers, analysts,
and business professionals dedicated to fighting
cybercrime at a global scale using technology,
forensics, civil actions, criminal referrals, andboth public and private partnerships.
Digital Diplomacy: An international teamof former diplomats, policymakers, and legal
experts working to advance a peaceful, stable,
and secure cyberspace in the face of risingnation state conflict.

Cyber
Resilience

Contributing
Teams

Digital Security & Resilience (DSR): An
organization dedicated to enabling Microsoft
to build the most trusted devices and services,while keeping our company safe, and both ourcompany and customer data protected.
Digital Security Unit (DSU): A team ofcybersecurity attorneys and analysts who provide
legal, geopolitical, and technical expertise toprotect Microsoft and its customers. DSU builds
trust in Microsoft’s enterprise security defenses
against advanced cyber adversaries worldwide.
Digital Threat Analysis Center (DTAC): A
team of experts who analyze and report onnation state threats, including cyberattacks
and influence operations. The team combines
information and cyber threat intelligence withgeopolitical analysis to provide insights to ourcustomers and to Microsoft to inform effective
response and protections.
Enterprise and Security: A team focused onproviding a modern, secure, and manageable
platform for the intelligent cloud andintelligent edge.
Enterprise Mobility: A team that helps deliver
the modern workplace and modern management
to keep data secure, in the cloud and onpremises. Endpoint Manager includes theservices and tools Microsoft and customers use
to manage and monitor mobile devices, desktop
computers, virtual machines, embedded devices,and servers.

112 Microsoft Digital Defense Report 2022

Contributing Teams
Continued

Enterprise Risk Management: A teamworking across business units to prioritize risk
discussions with Microsoft’s senior leadership.
ERM connects multiple operational risk
teams, manages Microsoft’s enterprise risk
framework, and facilitates the company’s
internal security assessment using the NIST
Cybersecurity Framework.
Global Cybersecurity Policy: A team working
with governments, NGOs, and industry
partners to promote cybersecurity public
policy that empowers customers to strengthen
their security and resiliency as they adopt
Microsoft technology.
Identity and Network Access (IDNA) Security:
A team working to protect all Microsoft
customers from unauthorized access and fraud.
IDNA Security is a cross-discipline team ofengineers, product managers, data scientists,and security investigators.
M365 Security: Organization that develops
security solutions including Microsoft Defenderfor Endpoint (MDE), Microsoft Defenderfor Identity (MDI), and others, to secure
enterprise customers.

ReportIntroduction

The State ofCybercrime

Microsoft AI, Ethics and Effects in Engineeringand Research (AETHER): An advisory board
at Microsoft with the mission of ensuring newtechnologies are developed and fielded in a
responsible manner.
Microsoft Bing Search and Distribution:
A team dedicated to providing a world-classinternet search engine, enabling users aroundthe world to find trusted search results andinformation quickly, including tracking topics
and trending stories that matter to them, while
giving users control of their privacy.
Microsoft Customer and Partner Solutions:
Microsoft’s unified commercial go-to-market
organization responsible for field roles suchas security and technical sales specialists
and advisors.
Microsoft Defender Experts: Microsoft’s
largest global organization of product-focusedsecurity researchers, applied scientists, and threat
intelligence analysts. Defender Experts delivers
innovative detection and response capabilities in
Microsoft 365 security products and Microsoft
Defender Experts managed services.
Microsoft Defender for IoT: A team composedof domain-expert researchers specializing inreverse-engineering of IoT/OT malware, protocols
and firmware. The team hunts for IoT/OT threats
to uncover malicious trends and campaigns.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Microsoft Defender Threat Intelligence(RiskIQ): A team that produces tacticalintelligence through analysis of Microsoft’s
extensive external telemetry collection, charting
the threat landscape as it evolves to discoverpreviously unknown threat infrastructure, andadding context to threat actors and campaigns.
The team regularly publishes timely anddistinctive research to deliver crucial tacticalintelligence to defenders.
Microsoft Security Business Development
Team: A team that leads Microsoft’s
cybersecurity growth strategy, partnerships,
and strategic investments.
Microsoft Security Response Center (MSRC): A
team engaged with security researchers working
to protect Microsoft’s customers and partner
ecosystem. An integral part of Microsoft’s Cyber
Defense Operations Center (CDOC), MSRC brings
together security response experts to detect andrespond to threats in real time.
Microsoft Security Services for Incident
Response: A team of cybersecurity experts
helping customers through the entire cyberattackfrom investigation to successful containment andrecovery related activities. Services are offered
via two highly integrated teams, the Detection
and Response Team (DART) with a focus on theinvestigation and groundwork for recovery, andthe Compromise Recovery Security Practice(CRSP), which focuses on the containment andrecovery aspects.

Cyber
Resilience

Contributing
Teams

Microsoft Threat Intelligence Center (MSTIC):
A team focused on identifying, tracking, andcollecting intelligence related to the mostsophisticated adversaries impacting Microsoft
customers, including nation state threats,
malware, and phishing.
One Engineering System (1ES): A team witha mission of delivering world class tools to help
Microsoft developers be as productive andsecure as possible. The team leads the central
strategy for securing Microsoft’s end-to-end
software supply chain.
Operational Threat Intelligence Center(OpTIC): The team responsible for managing
and disseminating cyber threat intelligence that
supports the Microsoft Cyber Defense Operation
Center’s (CDOC) mission to protect Microsoft
and our customers.

Illuminating the threat landscapeand empowering a digital defense.

Learn more: https://microsoft.com/mddr
Dive deeper: https://blogs.microsoft.com/on-the-issues/
Stay connected: @msftissues and @msftsecurity© 2022 Microsoft. All rights reserved.