Microsoft
Digital Defense
Report 2022
Executive Summary
Illuminating the threat landscapeand empowering a digital defense.

01

ReportReportIntroduction

Microsoft Digital Defense Report 2022 Executive Summary

Introduction by Tom Burt
Corporate Vice President, Customer Security & Trust“The trillions of signals we analyze
from our worldwide ecosystemof products and services reveal the
ferocity, scope, and scale of digital
threats across the globe ”

A snapshot of our landscape…

Scope and scale ofthreat landscape

Dismantlingcybercrime

Addressing
vulnerabilities

The volume of password
attacks has risen to an
estimated 921 attacks
every second – a 74%
increase in just one year.

To date, Microsoft
removed more than
10,000 domains usedby cybercriminals and
600 used by nation
state actors.

93% of our ransomware
incident response
engagements revealed
insufficient controls
on privilege access andlateral movement.

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

On February 23, 2022, the cybersecurity world
entered a new age, the age of the hybrid war.
On that day, hours before missiles were launched
and tanks rolled across borders, Russian actors
launched a massive destructive cyberattack
against Ukrainian government, technology, andfinancial sector targets. You can read more about
these attacks and the lessons to be learned
from them in the Nation State Threats chapterof this third annual edition of the Microsoft
Digital Defense Report (MDDR). Key among
those lessons is that the cloud provides the best
physical and logical security against cyberattacks
and enables advances in threat intelligence andend point protection that have proven their value
in Ukraine.
While any survey of the year’s developments incybersecurity must begin there, this year’s reportprovides a deep dive into much more. In thereport’s first chapter, we focus on activities ofcybercriminals, followed by nation state threats inchapter two. Both groups have greatly increased
the sophistication of their attacks which has
dramatically increased the impact of their actions.
While Russia drove headlines, Iranian actors
escalated their attacks following a transitionof presidential power, launching destructive
attacks targeting Israel, and ransomware andhack-and-leak operations targeting criticalinfrastructure in the United States. China also
increased its espionage efforts in Southeast
Asia and elsewhere in the global south, seeking
to counter US influence and steal critical dataand information.

Cyber
Resilience

Foreign actors are also using highly effective
techniques to enable propaganda influence
operations in regions around the globe, as
covered in the third chapter. For example,
Russia has worked hard to convince its citizens,and the citizens of many other countries, thatits invasion of Ukraine was justified – while
also sowing propaganda discrediting COVID
vaccines in the West and simultaneously
promoting their effectiveness at home.
In addition, actors are increasingly targeting
Internet of Things (IoT) devices or Operational
Technology (OT) control devices as entry points
to networks and critical infrastructure which
is discussed in chapter four. Finally, in the lastchapter, we provide the insights and lessons
we have learned from over the past year
defending against attacks directed at Microsoft
and our customers as we review the year’s
developments in cyber resilience.
Each chapter provides the key lessons learned
and insights based on Microsoft’s uniquevantage point. The trillions of signals we analyze
from our worldwide ecosystem of products andservices reveal the ferocity, scope, and scaleof digital threats across the globe. Microsoft istaking action to defend our customers andthe digital ecosystem against these threats,and you can read about our technology that
identifies and blocks billions of phishingattempts, identity thefts, and other threats toour customers.

02

Microsoft Digital Defense Report 2022 Executive Summary

ReportIntroduction

The State ofCybercrime

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Introduction by Tom Burt

The state of cybercrime

Nation state threatsContinued

Cybercriminals continue to act as sophisticatedprofit enterprises. Attackers are adapting andfinding new ways to implement their techniques,
increasing the complexity of how and where
they host campaign operation infrastructure.
At the same time, cybercriminals are becoming
more frugal. To lower their overhead and boost
the appearance of legitimacy, attackers arecompromising business networks and devices tohost phishing campaigns, malware, or even use
their computing power to mine cryptocurrency.

Nation state actors are launching increasingly
sophisticated cyberattacks designed to evadedetection and further their strategic priorities.
The advent of cyberweapon deployment in
the hybrid war in Ukraine is the dawn of a new
age of conflict. Russia has also supported its
war with information influence operations,using propaganda to impact opinions in Russia,
Ukraine, and globally. Outside Ukraine, nation
state actors have increased activity and havebegun using advancements in automation, cloudinfrastructure, and remote access technologies toattack a wider set of targets. Corporate IT supply
chains that enable access to ultimate targets
were frequently attacked. Cybersecurity hygiene
became even more critical as actors rapidly
exploited unpatched vulnerabilities, usedboth sophisticated and brute force techniques
to steal credentials, and obfuscated theiroperations by using opensource or legitimate
software. In addition, Iran joins Russia in theuse of destructive cyberweapons, including
ransomware, as a staple of their attacks.

We also use legal and technical means toseize and shut down infrastructure used bycybercriminals and nation state actors and notify
customers when they are being threatened
or attacked by a nation state actor. We work
to develop increasingly effective featuresand services that use AI/ML technology toidentify and block cyber threats and security
professionals defend against and identify
cyber-intrusions more rapidly and effectively.
Perhaps most importantly, throughout the MDDR
we offer our best advice on the steps individuals,organizations, and enterprises can take todefend against these increasing digital threats.
Adopting good cyber hygiene practices is thebest defense and can significantly reduce therisk of cyberattacks.

“The advent ofcyberweapon
deployment in
the hybrid war
in Ukraine is thedawn of a new
age of conflict.”

These developments require urgent adoption ofa consistent, global framework that prioritizes
human rights and protects people from recklessstate behavior online. All nations must work
together to implement norms and rules forresponsible state conduct.

Cyber
Resilience

Devices and infrastructure
The pandemic, coupled with rapid adoptionof internet-facing devices of all kinds as acomponent of accelerating digital transformation,
has greatly increased the attack surface of ourdigital world. As a result, cybercriminals andnation states are quickly taking advantage.
While the security of IT hardware and software
has strengthened in recent years, the security of
IoT and OT devices security has not kept pace.
Threat actors are exploiting these devices toestablish access on networks and enable lateral
movement, to establish a foothold in a supply
chain, or to disrupt the target organization’s
OT operations.

03

Microsoft Digital Defense Report 2022 Executive Summary

ReportIntroduction

The State ofCybercrime

Introduction by Tom Burt

Nation State
Threats

Devices andInfrastructure

Cyber
Resilience

Cyber Influence
Operations

Our unique vantage pointContinued

Cyber influence operations
Nation states are increasingly using sophisticatedinfluence operations to distribute propaganda
and impact public opinion both domestically andinternationally. These campaigns erode trust,increase polarization, and threaten democratic
processes. Skilled Advanced Persistent
Manipulator actors are using traditional media
together with internet and social media to vastly
increase the scope, scale, and efficiency of theircampaigns, and the outsized impact they arehaving in the global information ecosystem.
In the past year, we have seen these operations
used as part of Russia’s hybrid war in Ukraine,
but have also seen Russia and other nations,
including China and Iran, increasingly deploy
propaganda operations powered by social media
to extend their global influence on a range
of issues.

37bn

email threats
blocked34.7bnCyber resilience
Security is a key enabler of technological success.
Innovation and enhanced productivity can only
be achieved by introducing security measuresthat make organizations as resilient as possible
against modern attacks. The pandemic has
challenged us at Microsoft to pivot our security
practices and technologies to protect ouremployees wherever they work. This past year,
threat actors continued to take advantage ofvulnerabilities exposed during the pandemic
and the shift to a hybrid work environment.
Since then, our principal challenge has been
managing the prevalence and complexity ofvarious attack methods and increased nation
state activity. In this chapter, we detail thechallenges we have faced, and the defenses
we have mobilized in response with our morethan 15,000 partners.

43tn

identity threats
blockedsignals synthesized daily, using sophisticateddata analytics and AI algorithms to understandand protect against digital threats andcriminal cyberactivity.

8,500+

engineers, researchers, data scientists,
cybersecurity experts, threat hunters,
geopolitical analysts, investigators, andfrontline responders across 77 countries.

2.5bn

endpoint signals
analyzed daily

15,000+partners in our security ecosystem who
increase cyber resilience for our customers.

July 1, 2021 through June 30, 2022

04 Microsoft Digital Defense Report 2022 Executive Summary

Introduction by Tom Burt
Continued

We believe Microsoft—independently andthrough close partnerships with others inprivate industry, government, and civil society—has a responsibility to protect the digitalsystems that underpin the social fabric of oursociety and promote safe, secure computing
environments for every person, wherever they
are located. This responsibility is the reason we
have published the MDDR each year since 2020.
The report is the culmination of Microsoft’s
vast data and comprehensive research. It shares
our unique insights on how the digital threat
landscape is evolving and the crucial actions thatcan be taken today to improve the security ofthe ecosystem.
We hope to instill a sense of urgency, so readerstake immediate action based on the data andinsights we present both here and in our manycybersecurity publications throughout the year.
As we consider the gravity of the threat to thedigital landscape—and its translation into thephysical world—it is important to remember that
we are all empowered to take action to protect
ourselves, our organizations, and enterprises
against digital threats.
Read the report in full

ReportIntroduction

The State ofCybercrime

Thank you for taking
the time to review
this year’s Microsoft
Digital Defense
Report. We hope
you will find thatit provides valuable
insight andrecommendations
to help us collectively
defend the digital
ecosystem.
Tom Burt
Corporate Vice President,
Customer Security & Trust

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Cyber
Resilience

Our objective with this report is twofold:1

To illuminate the evolving digital threat landscape for our customers,
partners, and stakeholders spanning the broader ecosystem, shining
a light on both new cyberattacks and evolving trends in historicallypersistent threats.

2

To empower our customers and partners to improve theircyber resiliency and respond to these threats.

ReportIntroduction

05 Microsoft Digital Defense Report 2022 Executive Summary

An overview of

The State of Cybercrime
As cyber defenses improveand more organizations aretaking a proactive approachto prevention, attackers are
adapting their techniques.
Cybercriminals continue to act as sophisticatedprofit enterprises. Attackers are adapting andfinding new ways to implement their techniques,
increasing the complexity of how and where
they host campaign operation infrastructure.
At the same time, cybercriminals are becoming
more frugal. To lower their overhead and boost
the appearance of legitimacy, attackers arecompromising business networks and devices tohost phishing campaigns, malware, or even use
their computing power to mine cryptocurrency.
Learn more in the full report
The State of Cybercrime chapter

The State ofCybercrime

Cyber
Resilience

2,500

The RaaS operator develops and maintains the tools topower the ransomware operations, including the builders
that produce the ransomware payloads and payment portals
for communicating with victims.

BlackCat

LockBitBlack
MatterCyber Influence
Operations

Human operated ransomware is
Credential phishing
BEC Themes (January-June 202
Human operated
most prevalent, as one-thirdof ransomwareschemes whichtargeting
and
rate
of
successmodel
indiscriminately target
targets are successfully compromised
Factors
all inboxes areonscamtheby criminals using these
attacks andGift card
Low barrier to entry
rise and business
email
5% of those are ransomed.
1.9%
compromise, including
Business
invoice fraud,poses aAccess brokers sell accessinformation
to compromised networks
potential target
significant cybercrime
to ransomware-as-a-service
4.3%
organizations
affiliates, who run therisk for enterprises.
ransomware attack
Payroll

Understanding
theransomware
ransomware economyThe
threat ofandOperators
extortionis becoming more
audacious with attacks targetinggovernments, businesses, andcritical infrastructure.

HIVE

Devices andInfrastructure

p15

Cybercrime continues to rise as theindustrialization of the cybercrime
economy lowers the skill barrier toentry by providing greater accessto tools and infrastructure.

Conti

Nation State
Threats

REvil

Affiliates

Access brokers

Attackers increasingly threaten todisclose sensitive data to encourage
ransom payments.

A RaaS program (or syndicate) is an arrangement between
an operator and an affiliate. The RaaS operator develops andmaintains the tools to power the ransomware operations,
including the builders that produce the ransomware
payloads and payment portals for communicating withvictims. Many RaaS programs incorporate a suite ofextortion support offerings, including leak site hosting andintegration into ransom notes, as well as decryption
negotiation, payment pressure, and cryptocurrencytransaction services.

60

encounter activity
associated with known
ransomware attackers

20

are successfullycompromised

1

Affiliates are generally small groups of people “affiliated”
with one or more RaaS programs. Their role is to deploy the
RaaS program payloads. Affiliates move laterally in the
network, persist on systems, and exfiltrate data. Each affiliate
has unique characteristics, such as different ways of doing
data exfiltration.

The most effective
defense against
ransomware
includes multifactor
authentication, frequent
security patches, andZero Trust principles
across networkarchitecture.

Access brokers sell network access to other cybercriminals,
or gain access themselves via malware campaigns, brute
force, or vulnerability exploitation. Access broker entities
can range from large to small. Top tier access brokers
specialize in high-value network access, while lower tierbrokers on the dark web might have just 1–2 usable stolen
credentials for sale.

Organizations and individuals with weak cybersecurity
hygiene practices are at greater risk of having their network
Pre-ransomware
credentials stolen.

Ransomware

falls victim
to a successful
ransomware event

redirection

4.6%
Invoice
fraud

9.3%

RaaS affiliates
prioritize targets byintended impact orperceived profit
Attackers take advantage
of any security weakness
they find in the network,
so attacks vary

The ransomware payload
is the culmination of achain of malicious activity

To disrupt the malicious
infrastructures ofcybercriminals andnation state actors,
Microsoft relies oninnovative legal
approaches and our
public and private
partnerships.

2022

06 Microsoft Digital Defense Report 2022 Executive Summary

An overview of

Nation State Threats
Nation state actors arelaunching increasingly
sophisticated cyberattacks
to evade detection and further
their strategic priorities.
The advent of cyberweapon
deployment in the hybrid
war in Ukraine is the dawnof a new age of conflict.
Russia has also supported its war withinformation influence operations, using
propaganda to impact opinions in Russia, in
Ukraine, and globally. This first full-scale hybrid
conflict has taught other important lessons.
First, the security of digital operations and data
can be best protected – both in cyberspace
and in physical space – by moving to the cloud.
Initial Russian attacks targeted on-premises
services with wiper malware, and targeted
physical data centers with one of the firstmissiles launched.

ReportIntroduction

The State ofCybercrime

Ukraine responded by rapidly moving workloads
and data to hyperscale clouds hosted in data
centers outside Ukraine. Second, advances incyber threat intelligence and endpoint protection
powered by the data and advanced AI and ML
services in the cloud have helped Ukraine defend
against Russian cyberattacks.
Elsewhere, nation state actors have increased
activity and are using advancements in
automation, cloud infrastructure, and remote
access technologies to attack a wider setof targets. Corporate IT supply chains thatenable access to ultimate targets were
frequently attacked. Cyber security hygiene
became even more critical as actors rapidly
exploited unpatched vulnerabilities, used bothsophisticated and brute force techniques to steal
credentials, and obfuscated their operations
by using opensource or legitimate software.
And Iran joins Russia in use of destructive
cyberweapons, including ransomware,
as a staple of their attacks.
These developments require urgent adoptionof a consistent, global framework that prioritizes
human rights and protects people from recklessstate behavior online. All nations must work to
implement agreed upon norms and rules forresponsible state conduct.

Nation State
Threats

Devices andInfrastructure

Cyber Influence
Operations

Increased targeting of criticalinfrastructure particularly IT sector,
financial services, transportation systems,
and communications infrastructure.

IT supply chain being
used as a gateway toaccess targets.
NOBELIUM

Cyber
Resilience

Iran grew increasingly aggressive
following power transition, expanded
ransomware attacks beyond regional
adversaries to US and EU victims,
and targeted high profile US criticalinfrastructure.

Identification and rapid exploitation of
unpatched vulnerabilities has become akey tactic. Rapid deployment of security
updates is key to defense.
Vulnerability
publicly
disclosed

China expanding
global targeting
especially smaller
nations inSoutheast
Asia, to gain
intelligenceand competitive
advantage.

Patch
released

14 days

60 days

Exploitationin wild

POC code releasedon GitHub

North Korea targeted defense and aerospacecompanies, cryptocurrency, news outlets,
defectors, and aid organizations, to achieve
regime’s goals: to build defense, bolster the
economy, and ensure domestic stability.

Defending Ukraine: Early Lessons fromthe Cyber War — Microsoft On the Issues
Learn more in the full report
Nation State Threats chapter

Cyber mercenaries threaten the stability of cyberspace as this growing industry ofprivate companies is developing and selling advanced tools, techniques, and services
to enable their clients (often governments) to break into networks and devices.

07

ReportIntroduction

Microsoft Digital Defense Report 2022 Executive Summary

An overview ofDevices andInfrastructure

The State ofCybercrime

Governments worldwide are moving
to protect critical infrastructure by
improving IoT and OT security.

The pandemic, coupled with
rapid adoption of internetfacing devices of all kinds as
a component of accelerating
digital transformation, hasgreatly increased the attack
surface of the digital world.

Devices andInfrastructure

Cyber Influence
Operations

Malware as aservice has moved
into large scale
operations against
exposed IoT and OT
in infrastructure andutilities as well as
corporate networks.

103,092

87,479GafgytAttackers
leveraging
10,192are increasingly
3,166
vulnerabilities in IoT device firmware
to infiltrate corporate networks andlaunch devastating attacks.

11,89532% of firmware images analyzed
contained at least 10 known critical
Xhide
Tsunamivulnerabilities.
Miner

Attacks against remote management
devices are on the rise, with morethan 100 million attacks observedin May of 2022—a five-fold increasein the past year.

2

1%

Email

4%
Industrial control
systems

1%

Cyber
Resilience

Top IoT malware detectedin the wild (July 2021-June 2022)

Mirai

Cybercriminals and nation-states are quickly
taking advantage. While the security of IT
hardware and software has strengthened inrecent years, the security of Internet of Things(IoT) and Operational Technology (OT) devices
has not kept pace. Threat actors
are exploiting
Countries
Countries
advancingthese devices to establish access on networks
advancing cyber
criticalinfrastructureand enable lateral movement, to establish a
incident reporting
cybersecurity
foothold in a supply chain, orto disrupt the risktarget organization’s OT operations.
requirements
Globally consistentrequirements
and interoperable
security policies are needed toOther
ensureLearn more in the full reportbroad adoption.
Devices and Infrastructure chapter

11

Nation State
Threats

9

Countries
advancing both

Weak passwords

27%

10+ Critical known vulnerabilities

32%

10+ Critical vulnerabilities 6+ years old

4%

10+ Certificates expired 3+ years

13%

Presence of dangerous components

36%

Web

30%

Learn more in the full report
Cyber Influence Operations chapter

LaunchAmplification

Russia, Iran, and China
employed propaganda
and influence campaigns
throughout the COVID-19
pandemic often as a strategic
device to achieve broader
political objectives.
FactorsLowbarrier to entry
On February 24, 2022,

Synthetic media is becoming moreprevalent due to the proliferation oftools which easily create and disseminate
highly realistic artificial images,
videos, and audio. Digital provenancetechnology that certifies media asset
origin holds promise to combat misuse.

Russia’s invasion of Ukraine demonstrates
cyber influence operations integrated withmore traditional cyberattacks and kinetic
military operations to maximize impact.

Russia invaded Ukraine

Producers
Good and harmful u
Apr 2022

Pre-position

Cyber
Resilience

Mar 2022

Progressionof foreign
cyber influence
operations

Cyber Influence
Operations

Feb 2022

Nation states are increasingly using sophisticatedinfluence operations to distribute propaganda
and impact public opinion both domestically andinternationally. These campaigns erode trust,increase polarization, and threaten democratic
processes. Skilled Advanced Persistent
Manipulator actors are using traditional media
together with internet and social media to vastly
increase the scope, scale, and efficiency of theircampaigns, and the outsized impact they arehaving in the global information ecosystem.
In the past year, we have seen these operations
used as part of Russia’s hybrid war in Ukraine,
but have also seen Russia and other nations,
including China and Iran, increasingly turning
to social-media powered propaganda operations
to extend their global influence.

Cyber influence operations are becoming increasingly
sophisticated as more governments and nation states
are using these operations to shape opinion, discredit
adversaries, and promote discord.

Devices andInfrastructure

Jan 2022

Today’s foreign influence
operations utilize new methods
and technologies, making
their campaigns designed
to erode trust more efficientand effective.

Nation State
Threats

Dec 2021

Cyber Influence
Operations

The State ofCybercrime

Oct 2021

An overview ofReportIntroduction

Nov 2201

08 Microsoft Digital Defense Report 2022 Executive Summary

Distribution
Unprecedented spee
Effects
Erosion of trust

A holistic approach to protect
against cyber influence operations
Microsoft is building on its already mature cyber threat
intelligence infrastructure to combat cyber influence
operations. Our strategy is to detect, disrupt, defend,
and deter propaganda campaigns by foreign aggressors.

Mitigation
Promising solutions

Milli09 Microsoft Digital Defense Report 2022 Executive Summary

Cyber Influence
Operations

While password-based attacks
remain the main source of identity
compromise, other types of attacks
are emerging.

0.6

Cyber
Resilience

The vast majority of successful
cyberattacks could be prevented
by using basic security hygiene.

Modernized systems and architecture
are important for managing threatsin a hyperconnected world.

0.4

90%

Insecure Azure Active Directory configuration

72%

Legacy authentication protocols

98%

Legacy hashing algorithms

84%

No privilege isolation in Active Directory via tier model98%

No use of Privilege Access Workstations

100%

Lack of local admin password management controls

82%

0.2

52%

No Multi-Factor Authentication

88%
76%
50%
88%

1500
The human dimension of resilienceto cyber influence operations is ourability to collaborate and cooperate.

86%
82%

90

100

2000

1000

Aug 2021

44%

Over the past year,
the world experienced
DDoS activity thatwas unprecedented involume, complexity,
and frequency.

Jun 2021

54%

May 2021

2500

56%

Apr 2021

60%

Jul 2021

70%

Basic security
postureis a0
10 20 30 40 50 60 70 80
determining factor in advanced
Insecure configuration of identity provider
Low maturity security operations
solution effectiveness.
Insufficient privilege access and lateral movement controls
Lack of information protection control

Lack of SDL practices in DevOps

3000

62%

Mar 2021

Insecure design and configuration across cloud platforms

90%

Feb 2021

No Zero Trust of security framework adoption70%

Sep 2020

098%

Aug 2020

MFA or MFA
The pandemic has challenged us toNopivot
ournot mandatory for privileged accounts
No
MFA
or
MFA
not mandatory for user accounts
security practices and technologies to protect
No MFA for VPN access
Microsoft’s employees wherever theywork.
No or very limited use of endpoint detection and response
This past year, threat actors continued
toacrosstake
Skill gaps
security operations
advantage of vulnerabilities exposed
Gapsduring
in security monitoring coverage and integration
No SIEM/SOAR
the pandemic and the shift to a hybrid
worksolution
Ineffective SOC processes and operating model
environment. Since then, our principal challenge
No immutable or usable backups
has been managing the prevalenceIneffective
and data loss prevention controls
complexity of various attack methods
Lack of patch and vulnerability management
and increased nation state activity. Unmanaged OT and legacy systems

84%

Jul 2020

Excessive admin credentials foundJun 2020

Lack of Privilege Access Management controls

Jan 2021

Insecure Active Directory configuration

Learn more in the full report
Cyber Resilience chapter

Devices andInfrastructure

Dec 2020

Cyber security is a key enablerof technological success.
Innovation and enhanced
productivity can only beachieved by introducing
security measures thatmake organizations as
resilient as possible against
modern attacks.

Effective cyber resiliency requiresa holistic, adaptive approach towithstand evolving threats tocore services and infrastructure.

Nation State
Threats

Nov 2020

Cyber Resilience

0.8

The State ofCybercrime

Oct 2020

An overview ofReportIntroduction

Limited adoption of modern security frameworks

500

Breach replay

Password sprayIlluminating the threat landscapeand empowering a digital defense.

Learn more: https://microsoft.com/mddr
Dive deeper: https://blogs.microsoft.com/on-the-issues/
Stay connected: @msftissues and @msftsecurity© 2022 Microsoft. All rights reserved.