43 Trillion Security Data Points Illuminate Our Most Pressing Threats

The “Microsoft Digital Defense Report” is a compilation of insights from 43 trillion daily security signals that provides organizations with a high-level picture of the threat landscape and current state of cybersecurity. This annual report aggregates security data from organizations and consumers across the cloud, endpoints, and the intelligent edge to help better predict what attackers will do next.

Keep reading for a high-level overview of our findings, and click here to access the full report.

The State of Cybercrime

2022 saw a significant increase in indiscriminate phishing and credential theft to gain information for targeted ransomware, data exfiltration and extortion, and business email compromise attacks. Human-operated ransomware was the most prevalent type of ransomware attack observed, with one-third of targets successfully compromised and 5% ransomed. The evolving cybercrime-as-a-service (CaaS) economy is also a concern, as Microsoft blocked 2.75 million site registrations successfully to get ahead of criminal actors that planned to use them to engage in global cybercrime.

During ransomware recovery engagements, 93% of Microsoft investigations revealed insufficient privilege access and lateral movement controls. The most effective defense against ransomware includes multifactor authentication (MFA), frequent security patches, and zero-trust principles across network architecture.

The Nature of Nation-State Threats

Nation-state cyber threat groups have shifted from exploiting the software supply chain to exploiting the IT services supply chain. Oftentimes they target cloud solutions and managed services providers to reach downstream customers in government, policy, and critical infrastructure sectors.

Nation-state actors are also getting savvier, pursuing new and unique tactics to deliver attacks and evade detection in response to strengthened cybersecurity postures. Zero-day vulnerabilities are particularly key for initial exploitation. On average, it takes only 14 days for an exploit to become available in the wild after a vulnerability is publicly disclosed. These zero-day exploits are often discovered by other actors and reused broadly in a short period of time, leaving unpatched systems at risk.

Attacks on Devices and Infrastructure

Did you know that 68% of “Microsoft Digital Defense Report” respondents believe that adopting Internet of Things/operations technology (IoT/OT) is critical to their strategic digital transformation? Yet 60% of those same respondents recognize that IoT/OT security is one of the least secured aspects of their infrastructure. Attacks against remote management devices are on the rise, with more than 100 million attacks observed in May 2022 — a fivefold increase in the past year.

Accelerating digital transformation has increased the cybersecurity risk to critical infrastructure and cyber/physical systems. Likewise, growing IoT solutions have increased the number of attack vectors and the exposure risk of organizations. While policymakers are seeking to build trust in critical infrastructure cybersecurity through increased regulations, the public and private sector must collaborate to find a balance between compliance and truly effective cybersecurity practices.

Tackling Cyber Influence Operations

Democracy needs trustworthy information to flourish, yet we’ve observed a 900% year-over-year increase in the proliferation of deepfakes since 2019. AI-enabled media creation and manipulation make it easier than ever for cybercriminals to create highly realistic synthetic images, videos, audio, and text. This false content can then be optimized and disseminated to target audiences, challenging our collective understanding of the truth.

In response, governments, the private sector, and civil society must work together to increase transparency of these influence campaigns and to expose and disrupt their operations. We recommend implementing strong digital hygiene practices and considering ways to reduce any unintended enabling of cyber influence campaigns by your employees or your business practices. Business should support information literacy campaigns, civic engagement campaigns, and industry-specific counter-influence groups to help defend against propaganda and foreign influence.

The Path to Cyber Resilience

Nation-state actors have escalated their use of offensive cyber operations to destabilize governments and impact global trade operations. As these threats increase and evolve, it’s crucial to build cyber resilience into the fabric of the organization.

Basic security hygiene still protects against 98% of attacks, yet many threat actors succeed simply because these foundational security practices have not been followed. In fact, more than 90% of accounts that were compromised by password-based attacks did not have strong authentication practices in place. Organizations should enable MFA, apply zero-trust principles, implement modern anti-malware software, ensure all systems are kept up to date, and protect data by knowing where important information is located and whether the right systems are implemented.

Download the full “Microsoft Digital Defense Report” to better understand today’s cyber threat landscape. For even more details, check out our recent webinar, “Build Cyber Resilience by Leveraging Microsoft Experts’ Digital Defense Learnings.”

Explore more threat intelligence insights on Microsoft Security Insider.