Tag: cybersecurity

As we report more fully below, in the wake of Russian battlefield losses to Ukraine this fall, Moscow has intensified its multi-pronged hybrid technology approach to pressure the sources of Kyiv’s military and political support, domestic and foreign. This approach has included destructive missile and cyber strikes on civilian infrastructure in Ukraine, cyberattacks on Ukrainian and now foreign-based supply chains, and cyber-enabled influence operations[1]—intended to undermine US, EU, and NATO political support for Ukraine, and to shake the confidence and determination of Ukrainian citizens.

In recent months, cyberthreat actors affiliated with Russian military intelligence have launched destructive wiper attacks against energy, water and other critical infrastructure organizations’ networks in Ukraine as missile strikes knocked out power and water supplies to civilians across the country. Russian military operators also expanded destructive cyberactivity outside Ukraine to Poland, a critical logistics hub, in a possible attempt to disrupt the movement of weapons and supplies to the front.

Meanwhile, Russian propaganda seeks to amplify the intensity of popular dissent over energy and inflation across Europe by boosting select narratives online through state-affiliated media outlets and social media accounts to undermine elected officials and democratic institutions. To date, these have had only limited public impact, but they foreshadow what may become broadening tactics during the winter ahead.

We believe these recent trends suggest that the world should be prepared for several lines of potential Russian attack in the digital domain over the course of this winter. First, we can expect a continuation of Russia’s cyber offensive against Ukrainian critical infrastructure. We should also be prepared for the possibility that Russian military intelligence actors’ recent execution of a ransomware-style attack – known as Prestige – in Poland may be a harbinger of Russia further extending cyberattacks beyond the borders of Ukraine. Such cyber operations may target those countries and companies that are providing Ukraine with vital supply chains of aid and weaponry this winter.

Second, we should also be prepared for cyber-enabled influence operations that target Europe to be conducted in parallel with cyberthreat activity. Russia will seek to exploit cracks in popular support for Ukraine to undermine coalitions essential to Ukraine’s resilience, hoping to impair the humanitarian and military aid flowing to the region. The good news is that, when equipped with more information, a media-savvy public can act with awareness and judgment to counter this threat.

Here’s what we are seeing at Microsoft since Ukraine’s counteroffensive has pushed the Russian army into retreat, what we anticipate Russia’s cyber and influence operations might look like headed into the winter months, and how we at Microsoft will help prepare and prevent harm to Microsoft customers and democracies facing these attacks.

Combined missile and cyber strikes focus on destruction of civilian infrastructure

As Russia retreated from formerly occupied territory in Ukraine in late October, the Kremlin unleashed new missile and drone strikes against Ukrainian cities and the energy and transportation infrastructure that supports them. Missile barrages cut power to more than 10 million Ukrainians and left up to 80% of Kyiv’s population without running water.[2] The intent to inflict suffering on Ukraine’s civilians has been clear, and was effectively acknowledged by Russian officials.[3]

Notably, these recent missile strikes have been accompanied by cyberattacks on the same sectors, perpetrated by a threat group – known at Microsoft by the element name IRIDIUM and by others as Sandworm – associated with Russia’s military intelligence service, the GRU. The repeated temporal, sectoral and geographic association of these cyberattacks by Russian military intelligence with corresponding military kinetic attacks indicate a shared set of operational priorities and provides strong circumstantial evidence that the efforts are coordinated, as reflected in the timelines below.

Microsoft’s research of IRIDIUM shows a history of destructive attacks against Ukraine’s critical energy infrastructure that dates back nearly a decade. Following Russia’s annexation of Crimea in 2014, IRIDIUM launched a series of wintertime operations against Ukrainian electricity providers, cutting power to hundreds of thousands of citizens in 2015 and 2016.[4] The group’s pursuit of destruction in Ukraine spread globally in 2017 with the NotPetya attack, which inflicted $10 billion of damage to companies including international firms such as Maersk, Merck and Mondelēz, and underscores the risk of this actor’s operations to the global digital ecosystem.[5]

The wave of Russian destructive cyberattacks that began on February 23, and subsequent destructive attacks against Ukrainian targets in support of the Russian war effort have been the responsibility of IRIDIUM, as we have previously reported.[6] In October, IRIDIUM’s destructive attacks against Ukrainian critical services networks spiked, after two months of little to no wiper activity. As the Ukrainian counteroffensive progressed and winter approached, Microsoft observed that IRIDIUM deployed Caddywiper and FoxBlade wiper malware to destroy data from networks of organizations involved in power generation, water supply and the transportation of people and goods. The predominant focus was on the Kyiv region, as well as the southern and central-eastern regions of the country, where the physical conflict has been the most intense.

Cyber and missile strikes on transportation and logistics companies may interfere with the transportation of weapons and supplies. However, such attacks can also disrupt the passage of humanitarian aid to Ukrainian citizens, compounding the harm from curtailing the supply of electricity.This tactic of targeting civilian infrastructure has been in play since the beginning of the conflict. Of the roughly 50 Ukrainian organizations that Russian military operators have hit with destructive wiper malware since February 2022, 55% were critical infrastructure organizations, including in the energy, transportation, water, law enforcement and emergency services, and health care sectors.In most instances, threat actors have deployed wipers against the business networks of the targeted critical infrastructure organizations. However, operational technology networks are also vulnerable. For example, IRIDIUM attempted to inflict severe damage on energy production in April by targeting the industrial control systems (ICS) of a Ukrainian energy provider.[7] Quick action by CERT-UA and international partners thwarted the attack, but the risk of future ICS attacks that would disrupt or destroy the productive capacity of Ukrainian power or water infrastructure is high.

Russian cyberattacks extend outside Ukraine

Russian cyber strikes extended outside Ukraine in October, when IRIDIUM deployed its novel Prestige ransomware against several logistics and transportation sector networks in Poland and Ukraine.[8] This was the first war-related cyberattack against entities outside of Ukraine since the Viasat KA-SAT attack at the start of the invasion.[9]

The Prestige event in October may represent a measured shift in Russia’s cyberattack strategy, reflecting a willingness by Moscow to use its cyberweapons against organizations outside Ukraine in support of its ongoing war. Since Spring 2022, Microsoft has observed that IRIDIUM and suspected Russian state operators have targeted transportation and logistics organizations across Ukraine in probable attempts to collect intelligence on or disrupt the flow of military and humanitarian aid through the country. But these recent attacks in Poland suggest that Russian state-sponsored cyberattacks may increasingly be used outside Ukraine in an effort to undermine foreign-based supply chains.

IRIDIUM’s success in the Prestige destructive attack was limited. Early customer notifications and rapid response, including from Microsoft’s Detection and Response Team (DART) and the Microsoft Threat Intelligence Center (MSTIC), along with local incident responders in Poland, reportedly helped contain the attack’s impact to less than 20% of one targeted organization’s network. However, while the destructive impact was limited, IRIDIUM almost certainly collected intelligence on supply routes and logistics operations that could facilitate future attacks.

Perhaps in part because the impact was successfully limited by the defenders and responders in this instance, international outcry against this new extension of the hybrid war beyond the borders of Ukraine has been muted. Nevertheless, this attack highlights the continued risk of Russian destructive cyberattacks to European organizations that directly supply or transport humanitarian and military assistance to Ukraine.

Cyber-enabled influence operations seek to fuel real-world discord across Europe

This winter, European populations seeking to keep warm amid energy shortages and heightened inflation will likely be targeted by Russian attempts to stir up and potentially mobilize grievances through cyber-enabled influence operations.

Such operations offer the Kremlin a more deniable but nonetheless effective method of shaping discourse around conflict and major geopolitical events. Russia’s “active measures” approach involves infiltrating the constituencies of Kremlin adversaries while elevating candidates and officials who share Russia’s preferred foreign policy positions. Since 2014, Russia has sought to achieve its objectives “through the force of politics, rather than the politics of force,”[10] across democratic contests including the 2016 Brexit referendum and elections in the US, France and Germany, among others. Russia has also exploited political, economic and social divisions to mobilize citizens and even incite violence inside democracies. It is likely that these tools will be deployed in Europe and globally to reduce support for Ukraine’s defense.

Russia has a well-established ability to sway public opinion both in the U.S. and Europe through cyber-enabled influence operations. In 2016, the Internet Research Agency in St. Petersburg, known better as the Russian “troll farm,” famously orchestrated protests in Texas[11] and Florida.[12] Earlier that same year, Russian state media ran a story about an alleged assault of a young girl by migrants in Germany – accusations later disproved – and promoted the narrative that the German government had deliberately concealed the truth. The subsequent media flurry sparked a series of protests within Germany’s sizeable Russian diaspora, who were outraged by what they were being told was failure on the part of the German justice system.[13]

In 2018, the same Kremlin trolls involved in the 2016 US presidential election amplified the “yellow vest” protests in France. Russia did not organize these protests, but its online campaigns elevated calls to protest President Emmanuel Macron’s government by using a blend of overt, state-sponsored media to promote the cause while boosting the movement’s hashtag #giletsjaunes via covert accounts online.[14]

Our Digital Threat Analysis Center (DTAC) team closely tracks cyber-enabled influence operations. Protests in Europe this fall related to energy, inflation, and the war in Ukraine broadly – and their steady promotion by Russian propaganda outlets – foreshadow additional operations we may encounter this winter in support of Russian objectives by seeking to increase European dissatisfaction with energy supply, energy pricing and inflation.[15] If energy and electricity disruptions in Ukraine lead to more refugees throughout Europe, Russian cyber-enabled influence operations may seek to increase frictions over migration to create intra- and inter-country conflicts – a theme visible in the Kremlin’s campaigns over the last decade as refugees fled to Eastern and Central Europe during the Syrian Civil War.[16]

In the coming months, European nations will likely be subjected to a range of influence techniques tailored to their populations’ concerns about energy prices and inflation more broadly. Russia has and will likely continue to focus these campaigns on Germany, a country critical for maintaining Europe’s unity and home to a large Russian diaspora, seeking to nudge popular and elite consensus toward a path favorable to the Kremlin.[17] Strong connections between Kremlin-affiliated ideologues and Germany’s far right will likely be leveraged both online and offline in campaigns targeting German audiences with hardline narratives on the war in Ukraine as well as criticism of the government’s handling of the energy crisis.[18]

Recent quantitative analyses support these assessments. Microsoft’s AI for Good Lab has created a Russian Propaganda Index (RPI) to monitor the consumption of news from Russian state-controlled and state-sponsored news outlets and amplifiers. This index measures the proportion of this propaganda flow to overall news traffic on the internet. The RPI in Germany currently is the highest in Western Europe, over three times the regional average.

Higher Russian propaganda consumption in Germany may be in part due to decades of Russian investment in soft power and public diplomacy targeting the country, home to one of the largest Russian diaspora populations in Europe. Many of the soft power organizations’ express purpose is to create people-to-people and party-to-party ties between the two countries, and several Russian state-sponsored media outlets have been based in Germany.[19] Germany’s large Russian-speaking population, estimated at nearly 6 million people, makes Russian cyber-enabled influence operations and propaganda published in both Russian and German more accessible to German audiences.[20] Meanwhile, German policy since the end of the Cold War, during which time Soviet and East German active measures efforts were conducted synergistically,[21] has sought a normalization of relations with Russia bolstered by economic cooperation, with no greater example than the Nord Stream 2 natural gas pipeline. U.S. sanctions against this project, unpopular in both Russia and Germany, gave anti-Western and pro-Russian propaganda and influence operations, particularly on economic and energy topics, a more sympathetic audience.[22]

Throughout Western Europe, readers are exposed to Russian propaganda on both Russian-language sites – including Russian state-owned media sites – and local-language, pro-Russia sites. Consumption of local-language sites in Germany is three times higher than the Western European average, in keeping with Germany’s high levels of Russian propaganda consumption in the aggregate. In Germany, the local-language sites that generate the most traffic are anti-spiegel.ru, uncutnews.ch and the German-language edition of Russia Today (RT), de.rt.com. Local sites focus more attention on local issues. Anti-Spiegel in particular has focused its content on leveraging the current economic climate to promote the Kremlin and vilify the West. The headlines of its three most-read articles, for example, from the last four months are:

1. “That the US wants to destroy the German economy is considered a conspiracy theory and Russian propaganda, but it is obvious.”[23]
2. “The Nord Stream pipelines have been blown up and the Western media are staging what is arguably the stupidest propaganda operation ever.”[24]
3. “I am often asked why I am so convinced that Russian President Putin is not part of [the World Economic Forum] & Co. and its new world order. Here I want to answer that.”[25]

Aside from Germany, many other European nations may also need to reckon with the combined weight of Russian meddling and organic popular discontent. Earlier this year, Russia-affiliated threat actor SEABORGIUM (which overlaps with threat groups tracked as Callisto Group, TA446 and COLDRIVER) targeted the UK, utilizing allegedly stolen material to sow distrust in the British government,[26] while pro-Russia media like Modern Diplomacy and Strategic Culture Foundation, an outlet directed by the Russian Foreign Intelligence Service (SVR),[27] publish content alleging British involvement in the Kerch Strait Bridge explosion.[28]

Ongoing protests in the Czech Republic, meanwhile, have promoted Russia’s talking points on energy and are repeatedly featured in Russian state-owned and state-affiliated media.[29] Ladislav Vrábel – one of the organizers of the protest movement Czech Republic First – has been a repeated guest on Russian media such as Sputnik News since protests began,[30] while PolitNavigator – a Russian-language site reportedly directed by the FSB[31] – sent a correspondent to cover the protests from the beginning.[32] Further, among public figures who supported and spoke at the demonstrations are several politicians with long and well-documented records of pro-Russian activity, such as unofficial trips to occupied Crimea and high-level involvement with Kremlin-funded biker gang Night Wolves.[33]

France, not as reliant on Russian gas as its neighbors, is perhaps less vulnerable to energy-related influence. However, there is an ongoing risk that Russian agencies will seek to meddle in French affairs through inauthentic social media campaigns – building on previous efforts[34] and its success seeding and exploiting anti-French sentiment throughout Africa via propaganda, fake think tanks, and local engagement – which point to Russia’s willingness undermine French leadership.[35] Finally, Italy, with rising energy costs,[36] emerges as an additional target.

Defending the digital domain this winter: A way forward 

In our June 2022 report, Defending Ukraine: Early Lessons from the Cyber War, Microsoft offered a methodology for combating digital threats. Multidimensional threats require multidimensional defenses. At Microsoft, we’ve built our approach around “Four Ds” to counter malicious cyber and influence activity. Throughout the winter and into 2023, we will be working with our customers and in support of democracies to:

• Detect: Collectively identify, across Microsoft’s threat intelligence teams, those cyber actors that may strike at supply chains supporting Ukraine and the energy industry keeping Europe warm this winter. We will also evaluate cyberattacks to determine which are designed to limit support and supplies to Ukraine and which may be part of broader hack-and-leak operations designed to undermine unity of support for Ukraine. For customers, we’ll preemptively evaluate and assess potential risks to those that may be targets of Russia or other nation state threat actors. This vulnerability assessment will closely evaluate transportation, defense and energy companies Microsoft serves to help increase the collective speed of detection and response. Microsoft will also continue to track and identify Russian cyber-enabled influence operations, publishing our findings to notify the public and industry partners to improve information integrity of our own platforms and broader detection efforts.
• Disrupt: Microsoft’s Threat Intelligence Center (MSTIC) will alert customers and the public to emerging cyber methods enabling the entire ecosystem to rapidly employ sensors, patches, and mitigations. Where we encounter cyber-enabled influence campaigns, we will pursue a similar strategy, shining a light on operations aimed at creating doubt, distrust or dissent within Ukraine or across its partners seeking to undermine support for Ukraine. Our team will share this information with our customers and the public to these operations and lessen their impact.
• Defend: Microsoft will increase the collective defenses of the broader cyber ecosystem through increased information sharing and improved technology to defend against Russian threats and address vulnerabilities. Our teams will continue to support nonprofits, journalists and academics both within Ukraine and across allies, allowing those partners to broaden their defense of the information ecosystem. For example, Microsoft recently partnered with International Media Support (IMS) and the Center for Strategic Communication and Information Security within Ukraine to improve rapid information sharing and response between the private sector, NGOs and journalists within Ukraine through a dedicated secure communications hub.
• Deter: Microsoft has been dedicated for more than a decade to securing international norms for cyberspace. This winter, our Digital Diplomacy and Democracy Forward teams will work with affected customers and their representative governments to push for unified action to protect our customers’ supply chains against nation state attacks. And we will continue our ongoing efforts to provide actionable threat intelligence to entities targeted or compromised by Russian actors in Ukraine and in the countries supporting its defense.

Finally, for customers, Microsoft encourages the use of strong cyber hygiene and the latest detection and response technology to reduce vulnerabilities to and recover from cyberattacks – a listing of these specific recommendations can be found in the recently released Microsoft Digital Defense Report (MDDR) 2022.[37]

Ukraine has fought a brave defense both online and on-the-ground against a merciless Russian assault. With the help of its partner nations, companies and democratic citizens, we all can ensure that Ukraine and Europe’s infrastructure is protected and democracy resilient in the face of authoritarianism this winter.

---

[1] Cyber-enabled influence operations refer to targeted, online information campaigns designed to shift public opinion through manipulative or subversive means.

[2] https://www.msn.com/en-us/news/world/russian-strikes-on-ukraine-leave-most-of-kyiv-without-running-water/ar-AA13zw4A, https://www.axios.com/2022/10/31/russia-strikes-ukraine-kyiv-water 

[3] Following the attack, Dmitry Peskov, Russian President Vladimir Putin’s press secretary, implied Russia’s intentions with its strikes on Ukraine’s critical infrastructure is to force President Zelenskyy to negotiate.

[4] https://www.wired.com/story/sandworm-kremlin-most-dangerous-hackers/

[5] https://www.darkreading.com/threat-intelligence/3-years-after-notpetya-many-organizations-still-in-danger-of-similar-attacks

[6] https://blogs.microsoft.com/on-the-issues/2022/06/22/defending-ukraine-early-lessons-from-the-cyber-war/

[7] https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/; https://cert.gov.ua/article/39518

[8] https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/

[9] https://techcrunch.com/2022/05/10/russia-viasat-cyberattack/

[10] https://securingdemocracy.gmfus.org/so-what-did-we-learn-looking-back-on-four-years-of-russias-cyber-enabled-active-measures/

[11] https://www.dallasnews.com/news/politics/2019/10/08/russian-trolls-orchestrated-2016-clash-houston-islamic-center-senate-intel-report-says/

[12] https://www.thedailybeast.com/russians-appear-to-use-facebook-to-push-pro-trump-flash-mobs-in-florida

[13] https://www.reuters.com/article/us-germany-russia-idUSKCN0VA31O, https://www.bbc.com/news/blogs-eu-35413134

[14] https://www.theguardian.com/world/2018/dec/17/gilets-jaunes-grassroots-heroes-or-kremlin-tools

[15] https://www.politnavigator.news/fiala-ty-idiot-reportazh-s-prorossijjskogo-mitinga-v-chekhii.html

[16] https://www.vice.com/en/article/y3pqwk/russia-propaganda-rt-ukraine-refugees, https://www.atlanticcouncil.org/blogs/ukrainealert/six-outrageous-lies-russian-disinformation-peddled-about-europe-in-2016/, https://www.dw.com/en/russia-uses-the-refugee-crisis-for-propaganda/a-18989796; https://www.atlanticcouncil.org/blogs/syriasource/russia-s-disinformation-campaign-has-changed-how-we-see-syria/

[17] https://www.politico.eu/article/russia-influence-ukraine-fake-news; https://www.dw.com/en/russian-disinformation-threat-looms-large-over-cold-german-winter/a-63096336

[18] https://sputniknews.com/20220819/germany-should-immediately-launch-nord-stream-2-bundestag-vice-speaker-says-1099755921.html, https://www.rt.com/business/559754-horror-chart-germany-energy-crisis, https://www.rt.com/news/559740-german-mayors-nord-stream-letter, https://www.rt.com/business/567368-germany-russian-gas-alternatives

[19] https://www.csis.org/analysis/kremlin-playbook, https://www.thedailybeast.com/grassroots-media-startup-redfish-is-supported-by-the-kremlin, https://www.reuters.com/world/europe/exclusive-russian-news-agency-berlin-faces-staff-exodus-over-ukraine-invasion-2022-02-28

[20] https://www.dw.com/en/germanys-russian-community-faces-harassment-and-hostility/a-61055867

[21] https://www.wilsoncenter.org/blog-post/operation-denver-kgb-and-stasi-disinformation-regarding-aids, https://www.wilsoncenter.org/publication/kgbstasi-cooperation

[22] https://www.nytimes.com/2022/12/02/world/europe/germany-russia-nord-stream-pipeline.html

[23] https://www.anti-spiegel.ru/2022/mit-hilfe-der-gruenen-die-usa-planen-die-zerstoerung-der-deutschen-wirtschaft/

[24] https://www.anti-spiegel.ru/2022/nord-stream-gesprengt-die-wohl-duemmste-propaganda-aller-zeiten/

[25] https://www.anti-spiegel.ru/2022/sitzt-putin-mit-schwabs-weltwirtschaftsforum-co-in-einem-boot/

[26] https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/

[27] https://home.treasury.gov/news/press-releases/jy0126

[28] https://moderndiplomacy.eu/2022/10/14/the-grayzone-ukraine-blew-up-kerch-bridge-british-spies-plotted-it, https://strategic-culture.org/news/2022/10/13/before-ukraine-blew-up-kerch-bridge-british-spies-plotted-it

[29] https://cz.sputniknews.com/20221122/dalsi-rozpoutani-valky-je-zradou-vuci-cechum-vrabel-rekl-kdo-je-zodpovedny-za-umrti-na-ukrajine–18906016.html, https://www.rt.com/news/565552-czech-protestors-demand-pm-resign/, https://cz.sputniknews.com/20221028/vrabel-ceska-vlada-hraje-valecny-fotbal-kdy-fandi-jedne-strane-proti-druhe-nemuzeme-si-to-dovolit-18803610.html, https://cz.sputniknews.com/20221025/havel-prioritou-vlady-ma-byt-pomoc-cechum-abychom-mohli-pomahat-druhym-musime-nejprve-pomoci-sobe-18789293.html

[30] https://www.idnes.cz/zpravy/domaci/vrabel-rusko-omluva-ukrajina-demonstrace.A220909_143314_domaci_vapo, https://odysee.com/@Sputnjik.Srbija:7/Sputnjik-Intervju—Ladislav-Vrabel:6, https://www.tydenikhrot.cz/clanek/cesko-by-se-melo-orientovat-na-moskvu-tvrdi-organizator-protivladnich-protestu-vrabel

[31] https://apnews.com/article/russia-ukraine-coronavirus-pandemic-health-moscow-media-ff4a56b7b08bcdc6adaf02313a85edd9

[32] https://www.politnavigator.net/fiala-ty-idiot-reportazh-s-prorossijjskogo-mitinga-v-chekhii.html

[33] https://manipulatori.cz/jaroslav-foldyna-a-jeho-nocni-vlci-a-srbsti-nacionaliste/, https://www.lidovky.cz/domov/putinovi-nocni-vlci-dorazili-do-prahy.A190506_122904_ln_domov_zdp, https://blog.aktualne.cz/blogy/roman-maca.php?itemid=39721, https://www.idnes.cz/zpravy/zahranicni/bitva-o-stalingrad-vyroci-75-volgograd-putin-vojenska-prehlidka.A180202_134302_zahranicni_PAS, https://www.parlamentnilisty.cz/arena/rozhovory/Rusku-zapadni-sankce-skutecne-nadmiru-prospivaji-Komunista-Skala-se-vratil-z-Ruska-a-toto-vse-tam-videl-549240, https://hlidacipes.org/__trashed/, https://zpravy.tiscali.cz/na-navstevu-za-chirurgem-sef-nocnich-vlku-prijima-hosty-na-krymu-pozval-i-slovenskeho-prezidenta-kisku-316604, https://www.theguardian.com/world/2015/may/08/pro-putin-bikers-russia-night-wolves-state-funds

[34] https://www.bbc.com/news/blogs-trending-39845105, https://www.politico.eu/article/france-election-2017-russia-hacked-cyberattacks, https://www.theguardian.com/technology/2022/sep/27/meta-takes-down-influence-operations-run-by-china-and-russia, https://www.dw.com/en/frances-yellow-vests-and-the-russian-trolls-that-encourage-them/a-46753388

[35] https://home.treasury.gov/news/press-releases/jy0126, https://www.4freerussia.org/wp-content/uploads/sites/3/2020/09/The-Company-You-Keep-Yevgeny-Prigozhins-Influence-Operations-in-Africa.pdf

[36] https://www.reuters.com/business/energy/italys-regulated-household-electricity-prices-rise-59-q4-arera-2022-09-29/#:~:text=According%20to%20the%20regulator%2C%20the,inflation%20hit%209.1%25%20in%20August., https://www.reuters.com/business/energy/italy-spend-100-bln-euros-this-year-import-energy-2022-09-03/

[37] https://www.microsoft.com/en-us/security/business/security-insider/threat-guidance/using-cybersecurity-to-help-manage-volatility-in-the-global-threat-landscape/

A growing industry of companies called private-sector offensive actors – or PSOAs – is creating and selling cyberweapons that enable their customers to break into people’s computers, phones and internet-connected devices. Now, one of these 21st-century mercenaries, called the NSO Group, is attempting to cloak itself in the legal immunity afforded its government customers, which would shield it from accountability when its weapons inflict harm on innocent people and businesses. The firm also contributes to the urgent cybersecurity challenges discussed by our president Brad Smith last week. We believe the NSO Group’s business model is dangerous and that such immunity would enable it and other PSOAs to continue their dangerous business without legal rules, responsibilities or repercussions. That’s why today we filed an amicus brief – along with Cisco, GitHub, Google, LinkedIn, VMWare and the Internet Association – in a legal case brought by WhatsApp against the NSO Group.

The NSO Group sold governments a program called Pegasus, which could be installed on a device simply by calling the device via WhatsApp; the device’s owner did not even have to answer. According to WhatsApp, the NSO Group used Pegasus to access more than 1,400 mobile devices, including those belonging to journalists and human rights defenders. We believe companies like NSO Group selling tools like Pegasus are concerning for three reasons.

First, their presence increases the risk that the weapons they create fall into the wrong hands. Previously, sophisticated nation-state hacking capabilities resided in a small number of governments with well-funded agencies focused on developing these weapons. Even then, government-created espionage tools got into the hands of other governments who used them in attacks like WannaCry and NotPetya that spread like wildfire beyond the targeted victims and ultimately devastated lives and disrupted businesses around the world. Lowering the barrier for access to these weapons would guarantee that such catastrophes would be repeated.

Even if the tools are sold to governments who use them for narrowly targeted attacks, there are a variety of ways they can still fall into the wrong hands. For example, private actors like the NSO Group and their less sophisticated customers may lack the defenses some governments use to protect the weapons, making them more susceptible to cyber-theft. For example, an Italian company called Hacking Team – one of NSO’s competitors – was itself hacked in 2015. Additionally, targets of these weapons can observe, reverse-engineer and then use these tools for their own purposes.

Second, private-sector companies creating these weapons are not subject to the same constraints as governments. Many governments with offensive cyber capabilities are subject to international laws, diplomatic consequences and the need to protect their own citizens and economic interests from the indiscriminate use of these weapons. Additionally, some governments – like the United States – may share high-consequence vulnerabilities they discover with impacted technology providers so the providers can patch the vulnerability and protect their customers. Private actors like the NSO Group are only incented to keep these vulnerabilities to themselves so they can profit from them, and the exploits they create are constantly recycled by governments and cybercriminals once they get into the wild.

Third, companies like the NSO Group threaten human rights whether they seek to or not. An analysis of recent cyber-attacks was able to identify five countries using offensive cyber capabilities between 2012 and 2015: Russia, China, North Korea, France and Israel. Between 2016 and 2018, however, the cast of characters changed to include countries like the United Arab Emirates and Uzbekistan. And public reporting has identified clients of cyber-surveillance companies like the NSO Group to include Azerbaijan, Bahrain, Egypt, Ethiopia, Kazakhstan, Mexico, Morocco, Nigeria, Oman, Saudi Arabia and Sudan. Reporting also shows foreign governments are using those surveillance tools, bought from PSOAs, to spy on human rights defenders, journalists and others, including U.S. citizens. These tools allow the user to track someone’s whereabouts, listen in on their conversations, read their texts and emails, look at their photographs, steal their contacts list, download their data, review their internet search history and more. Just yesterday The Citizen Lab reported that between July and August of this year NSO’s Pegasus program was used to hack 36 phones belonging to journalists, producers, anchors and executives at Al Jazeera. Privacy is fundamental to the ability of journalists to report, of dissidents to speak their voices and of democracy to flourish and these tools threaten their rights and their lives.

The expansion of sovereign immunity that NSO seeks would further encourage the burgeoning cyber-surveillance industry to develop, sell and use tools to exploit vulnerabilities in violation of U.S. law. Private companies should remain subject to liability when they use their cyber-surveillance tools to break the law, or knowingly permit their use for such purposes, regardless of who their customers are or what they’re trying to achieve. We hope that standing together with our competitors today through this amicus brief will help protect our collective customers and global digital ecosystem from more indiscriminate attacks.

Tags: amicus brief, cybersecurity, NSO

Two global issues will help shape people’s memories of this time in history – Covid-19 and the increased use of the internet by malign actors to disrupt society. It’s disturbing that these challenges have now merged as cyberattacks are being used to disrupt health care organizations fighting the pandemic. We think these attacks are unconscionable and should be condemned by all civilized society. Today, we’re sharing more about the attacks we’ve seen most recently and are urging governments to act.

In recent months, we’ve detected cyberattacks from three nation-state actors targeting seven prominent companies directly involved in researching vaccines and treatments for Covid-19. The targets include leading pharmaceutical companies and vaccine researchers in Canada, France, India, South Korea and the United States. The attacks came from Strontium, an actor originating from Russia, and two actors originating from North Korea that we call Zinc and Cerium.

Among the targets, the majority are vaccine makers that have Covid-19 vaccines in various stages of clinical trials. One is a clinical research organization involved in trials, and one has developed a Covid-19 test. Multiple organizations targeted have contracts with or investments from government agencies from various democratic countries for Covid-19 related work.

Strontium continues to use password spray and brute force login attempts to steal login credentials. These are attacks that aim to break into people’s accounts using thousands or millions of rapid attempts. Zinc has primarily used spear-phishing lures for credential theft, sending messages with fabricated job descriptions pretending to be recruiters. Cerium engaged in spear-phishing email lures using Covid-19 themes while masquerading as World Health Organization representatives. The majority of these attacks were blocked by security protections built into our products. We’ve notified all organizations targeted, and where attacks have been successful, we’ve offered help.

These are just among the most recent attacks on those combating Covid-19. Cyberattacks targeting the health care sector and taking advantage of the pandemic are not new. Attackers recently used ransomware attacks to target hospitals and healthcare organizations across the United States. Earlier in the pandemic, attacks targeted Brno University Hospital in the Czech Republic, Paris’s hospital system, the computer systems of Spain’s hospitals, hospitals in Thailand, medical clinics in the U.S. state of Texas, a health care agency in the U.S. state of Illinois and even international bodies such as the World Health Organization. In Germany, we recently saw the resulting threat to human health become tragic reality when a woman in Dusseldorf reportedly became the first known death as a result of a cyberattack on a hospital.

Today, Microsoft’s president Brad Smith is participating in the Paris Peace Forum where he will urge governments to do more. Microsoft is calling on the world’s leaders to affirm that international law protects health care facilities and to take action to enforce the law. We believe the law should be enforced not just when attacks originate from government agencies but also when they originate from criminal groups that governments enable to operate – or even facilitate – within their borders. This is criminal activity that cannot be tolerated.

The good news is that we’re not alone. Our voice at Microsoft is just one of many speaking up from the multi-stakeholder coalition that will be needed to make progress. In today’s virtual Paris Peace Forum event addressing an audience of international leaders, Brad will discuss these issues with France’s Minister for Foreign Affairs Jean-Yves le Drian, Ambassador Guilherme de Aguiar Patriota of Brazil and Ambassador Jürg Lauber of Switzerland. Ambassador Patriota is chair of the UN’s Group of Governmental Experts, and Ambassador Lauber is chair of the UN’s Open-Ended Working Group – both important bodies in determining the future of cyberspace.

In the leadup to this year’s Paris Peace Forum, more than 65 health care-related organizations have joined the Paris Call for Trust and Security in Cyberspace. They include organizations like Merck working on vaccines, top hospitals like Hospital Metropolitano in Ecuador, and government health institutes like Poland’s National Institute of Public Health. There is no question the attacks we’ve seen in recent months are creating energy for action across the health sector. The Paris Call remains the largest multi-stakeholder coalition addressing these issues, and its first principle is the prevention of malicious cyber activities that threaten indiscriminate or systemic harm to people and critical infrastructure.

In May, a 136-strong group of the world’s most prominent international law experts, in what has become known as the Oxford Process, issued a statement making it clear that international law protects medical facilities at all times. In August, the Oxford Process issued a second statement emphasizing that organizations that research, manufacture and distribute of Covid-19 vaccines are also protected.

Earlier this year, the CyberPeace Institute and International Committee of the Red Cross led an effort by 40 international leaders calling on governments to stop the attacks on healthcare. They included former secretary of state Madeline Albright, Archbishop Emeritus of Cape Town Desmond Tutu, former Member of the European Parliament Marietje Schaake and former Secretary-General of the United Nations Ban Ki-moon among many others.

Organizations are also taking steps to protect themselves. In April, we announced that we were making AccountGuard, our threat notification service, available to health care and human rights organizations working on Covid-19. Since then 195 of these organizations have enrolled in the service and we now protect 1.7 million email accounts for health care-related groups. Any health care-related organizations that wish to enroll can do so here.

At a time when the world is united in wanting an end to the pandemic and anxiously awaiting the development of a safe and effective vaccine for Covid-19, it is essential for world leaders to unite around the security of our health care institutions and enforce the law against cyberattacks targeting those who endeavor to help us all. You can learn more about what Microsoft is doing to advance cybersecurity here.

Tags: COVID-19, cyberattacks, cybersecurity, Microsoft AccountGuard

October is National Cyber Security Awareness Month (NCSAM). And there is still a lot to do!

For the last 17 years, the National Cybersecurity Awareness Month (NCSAM) campaign, driven by the Department of Homeland Security, has raised awareness about the importance of cyber security across the Nation with the mission of ensuring that all Americans have the resources they need to be safer and more secure online.

In alignment with this noble mission, Microsoft Security is providing educational content and executive speakers to empower our customers, employees and families. Tune into the CyberTalks recap to listen to the keynoted delivered by @Ann Johnson, Corporate Vice President of Security, Compliance and Identity, on how to future proof your security strategy.

Cyber security podcasts

In addition to the blog series that is taking over our blog in October, Microsoft Security is also sponsoring two security podcasts in CyberScoop.com we want to encourage our community to tune in and listen to both conversations.

• Available now: Enabling secure remote work by embracing Zero Trust—One of the greatest challenges we often hear from public and private sector CISOs, when it comes to achieving a Zero Trust IT operating environment, is the question of how to tackle such a massive undertaking—and where to begin. Tune in to listen to CTO, Steve Faehl, to learn more about Microsoft’s journey towards Zero Trust.
• Available October 19: Risk Reduction—Podcast featuring GM, Alym Rayani who delivers an in-depth conversation about compliance and its connection to security.

Additional security blogs to read

Government agency audit traceability

The reality today for many government agencies is there is no audit traceability to determine which email messages and content an attacker may have seen during a breached session into a user’s mailbox. The standard level of Office 365 auditing includes events that a user logged into their mailbox but does not include detailed information on the activity that occurs within the mailbox. As a result, organizations have no choice but to assume all content within the mailbox is compromised whether sensitive data or PII was viewed by the adversary. To learn more about how using Advanced Audit can help improve forensic investigation capability, read this blog from Matthew Littleton, Principal Technical Specialist on this Public Sector blog.

Top 5 security questions asked by US Government customers

In an era of remote work, end users wanted to collaborate with outside agencies but in a way that meant their data was secure. IT Admins wanted to know which configuration options best fit their organization’s security posture. CIO’s wanted to lean in and give their workforce the best in class technology, all while following US Government accreditation standards. The common theme in most questions asked by our customers was around security. Read more about the top 5 security questions asked by our US Government customers for Microsoft Teams.

October is my favorite time of year, between the change of season, Major League Baseball playoffs, and with football underway. It’s also National Cybersecurity Awareness Month, though with so many cyberattacks and incidents in the news, one month of dedicated focus hardly seems sufficient. Learn how Microsoft delivers on an end-to-end security strategy to reduce risk and deliver on its commitment to customers.

To learn more about how to be #Cybersmart visit the cybersecurity website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity.

Today, we’re sharing that we have detected and worked to stop a series of cyberattacks from the threat actor Phosphorous masquerading as conference organizers to target more than 100 high-profile individuals. Phosphorus, an Iranian actor, has targeted with this scheme potential attendees of the upcoming Munich Security Conference and the Think 20 (T20) Summit in Saudi Arabia. The Munich Security Conference is the most important gathering on the topic of security for heads of state and other world leaders, and it has been held annually for nearly 60 years. Likewise, T20 is a highly visible event that shapes policy ideas for the G20 nations and informs their critical discussions.

Based on current analysis, we do not believe this activity is tied to the U.S. elections in any way.

The attackers have been sending possible attendees spoofed invitations by email. The emails use near-perfect English and were sent to former government officials, policy experts, academics and leaders from non-governmental organizations. Phosphorus helped assuage fears of travel during the Covid-19 pandemic by offering remote sessions.

We believe Phosphorus is engaging in these attacks for intelligence collection purposes. The attacks were successful in compromising several victims, including former ambassadors and other senior policy experts who help shape global agendas and foreign policies in their respective countries.

Figure 1: Flow of a typical Phosphorus attack in this campaign

This activity was uncovered by Microsoft’s Threat Intelligence Information Center, or MSTIC, which tracks the world’s nation-state and cybercrime actors so we can better protect our customers. MSTIC is also critical to the work of our Defending Democracy Program, powering our AccountGuard threat notification service available in 30 countries worldwide and fueling the intelligence we share to help keep elections secure. We build new protections into our products regularly based on the threats MSTIC uncovers.

We’ve already worked with conference organizers who have warned and will continue to warn their attendees, and we’re disclosing what we’ve seen so that everyone can remain vigilant to this approach being used in connection with other conferences or events.

We recommend people evaluate the authenticity of emails they receive about major conferences by ensuring that the sender address looks legitimate and that any embedded links redirect to the official conference domain. As always, enabling multi-factor authentication across both business and personal email accounts will successfully thwart most credential harvesting attacks like these. For anyone who suspects they may have been a victim of this campaign, we also encourage a close review of email-forwarding rules in accounts to identify and remove any suspicious rules that may have been set during a successful compromise.

We are also sharing the indicators of compromise (IOCs) observed during these activities. We encourage IT teams to implement detections and protections to identify possible prior campaigns and prevent future campaigns against their users. These indicators include phony email accounts and domains or websites used to steal victims’ credentials.

INDICATOR	TYPE	DESCRIPTION
t20saudiarabia[@]outlook.sa	Email	Masquerading as the organizer of the Think 20 (T20) conference
t20saudiarabia[@]hotmail.com	Email	Masquerading as the organizer of the Think 20 (T20) conference
t20saudiarabia[@]gmail.com	Email	Masquerading as the organizer of the Think 20 (T20) conference
munichconference[@]outlook.com	Email	Masquerading as the organizer of the Munich Security Conference
munichconference[@]outlook.de	Email	Masquerading as the organizer of the Munich Security Conference
munichconference1962[@]gmail.com	Email	Masquerading as the organizer of the Munich Security Conference
de-ma[.]online	Domain	Domain used for credential harvesting
g20saudi.000webhostapp[.]com	Subdomain	Subdomain used for credential harvesting
ksat20.000webhostapp[.]com	Subdomain	Subdomain used for credential harvesting

As we noted in our recent Digital Defense Report, nation-state cyberattackers routinely pursue think tanks, policy organizations and governmental and non-governmental organizations, seeking information that an attacker can use for their benefit. We will continue to use a combination of technology, operations, legal action and policy to disrupt and deter malicious activity, but nothing replaces vigilance from people who are likely targets of these operations.

Tags: cyberattacks, cybersecurity, Defending Democracy Program, Microsoft AccountGuard, Microsoft Threat Intelligence Center, MSTIC

I wrote a series of blogs last year on how gamified learning through cyber ranges can create more realistic and impactful cybersecurity learning experiences and help attract tomorrow’s security workforce. With the global talent shortage in this field, we need to work harder to bring people into the field. This blog is for new cyber professionals or perhaps younger aspirants considering getting into cyber. From an employee’s perspective, it can seem daunting to know where to start, especially when you’re entering an organization with established technology investments, priorities, and practices. Having come to this field later in my career than others, I say from experience that we need to do a better job collectively in providing realistic and interesting role-based learning, paths toward the right certifications and endorsements, and more definitive opportunities to advance one’s career.

I’m still a big fan of gamified learning, but if gaming isn’t your thing, then another way to acquire important baseline learning is to look at simpler, more proactive management tools that up-level different tasks and make your work more efficient. Microsoft has recently released two important cloud security posture management tools that can help a newer employee quickly grasp basic yet critically important security concepts AND show immediate value to your employer. They’re intuitive to learn and deserve more attention.  I’m talking about Azure Security Defaults and Microsoft Secure Score (also including Azure Secure Score). While tools like these don’t typically roll off the tongue, and your experience won’t grab you like an immersive gaming UI, their purpose-built capabilities that focus on commonly-accepted cyber hygiene best practices reinforce solid foundational practices that are no less important than SecOps, incident response, or forensics and hunting. Learning how to use these tools can make you a champion and influencer, and we encourage you to learn more below. These capabilities are also built directly into our larger Azure and M365 services, so by using built-in tools, you’ll help your organization maximize its investments in our technologies and help save money and reduce complexity in your environment.

Azure Security Defaults is named for what it does—setting often overlooked defaults. With one click, you automatically enable several foundational security controls that if left unaddressed are convenient and time-tested targets for attackers to go after your organization. One question that I frequently receive is why Microsoft doesn’t simply pre-configure these settings by default and force customers to turn them off. Several large, high-threat customers have asked specifically that we do that. It’s tempting, but until or unless we make such a move, this is a great self-service add-on. As explained in this blog, ASD does the following:

• Requires all users to register for Azure Multi-Factor Authentication.
• Requires admins to perform MFA.
• Blocks legacy authentication protocols.
• Requires users to perform MFA when necessary.
• Protects privileged activities to access the Azure Portal.

A recent important addition to ASD is that Microsoft announced on August 12^th that ASD is now also available through Azure Security Center. This is an important and beneficial addition in that it adds another opportunity for your IT organization—whether identity and access management, or security operations—to implement the defaults. I’ve noticed on several occasions when briefing or providing a demo on Azure Security Center to a CISO team that a challenge in effectively using this service may come down to organizational issues, specifically, Who OWNS it?  Is ASC a CISO tool? Regardless of who may own the responsibility, we want to provide the capability upfront.

MICROSOFT SECURE SCORE is a relatively new feature that is designed to quantify your security posture based on how you configure your Microsoft resources. What’s cool and impactful about it is that it provides in a convenient top-down meu approach the relative approach your organization has taken compared (anonymously) with your industry segment’s peers (given in many cases similar reference architectures), and provides clear recommendations for what you can do to improve your score. From a Microsoft perspective, this is what we’d say all carrot and no stick. Though as covered above we provide Azure Security Defaults, customers are still on point to make a proactive decision to implement controls based on your particular work culture, compliance requirements, priorities, and business needs. Take a look at how it works:

This convenient landing page provides an all-up view into the current state of your organization’s security posture, with specific recommendations to improve certain configuration settings based on an art-of-the-possible. In this demo example, if you were to turn enable every security control to its highest level, your score would be 124, as opposed to the current score of 32, for a percentage of 25.81. Looking to the right of the screen, you get a sense of comparison against peer organizations. You can further break down your score by categories such as identity, data, device, apps, and infrastructure; this in turn gives a security or compliance team the opportunity to collaborate with hands-on teams that control those specific resources and who might be operating in silos, not necessarily focused on security postures of their counterparts.

Azure Secure Score

You’ll also find Secure Score in the Azure Security Center blade where it provides recommendations front and center, and a color-coded circular graph on important hybrid infrastructure configurations and hygiene.

Drilling deeper, here we see a variety of recommendations to address specific findings.  For example, the top line item is advice to ‘remediate vulnerabilities’, indicating that 35 of 59 resources that ASC is monitoring are in some way not optimized for security. optimized for security.

Going a level further into the ‘secure management ports’ finding, we see a sub-heading list of actions you can take specific to these resources’ settings. Fortunately, in this case, the administrator has addressed previously-discovered findings, leaving just three to-do’s under the third subheading. For added convenience, the red/green color-coding on the far right draws your attention.

Clicking on the third item above shows you a description of what ASC has found, along with remediation steps.  You have two options to remediate:  more broadly enable and require ‘just in time’ VM access; or, manually enable JIT for each resource. Again, Microsoft wants to incentivize and make it easier for your organization to take more holisitic and proactive steps across your resources such as enabling important settings by default; but we in no way penalize you for the security settings that you implement.

To learn more about Microsoft Security solutions visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity.

The importance of cybersecurity in facilitating productive remote work was a significant catalyst for the two years-worth of digital transformation we observed in the first two months of the COVID-19 pandemic. In this era of ubiquitous computing, security solutions don’t just sniff out threats, they serve as control planes for improving productivity and collaboration by giving end-users easier access to more corporate resources. Microsoft recently concluded a survey of nearly 800 business leaders of companies of more than 500 employees in India (IN), Germany (DE), the United Kingdom (UK) and the United States (US) to better understand their views of the pandemic threat landscape, implications for budgets and staffing, and how they feel the pandemic could reshape the cyber-security long-term.

Among the key insights are data showing that an alarming number of businesses are still impacted by phishing scams, security budgets, and hiring increased in response to COVID-19, and cloud-based technologies and architectures like Zero Trust are significant areas of investment moving forward.

Improving Productivity & Mitigating Threats

Security and IT teams have been working overtime to meet business goals while simultaneously staying ahead of new threats and scams. “Providing secure remote access to resources, apps, and data” is the #1 challenge reported by security leaders. For many businesses, the limits of the trust model they had been using, which leaned heavily on company-managed devices, physical access to buildings, and limited remote access to select line-of-business apps, got exposed early on in the pandemic. This paradigm shift has been most acute in the limitations of basic username/password authentication. As a result, when asked to identify the top security investment made during the pandemic the top response was Multi-factor authentication (MFA).

In other ways, pandemic security risks feel all too familiar. Asked to identify their best pre-pandemic security investment, most identified anti-phishing technology.  Microsoft Threat Intelligence teams reported a spike in COVID-19 attacks in early March as cybercriminals applied pandemic themed lures to known scams and malware. Business leaders reported phishing threats as the biggest risk to security in that same timeframe, with 90% of indicating that phishing attacks have impacted their organization. More than half said clicking on phishing emails was the highest risk behavior they observed and a full 28% admitted that attackers had successfully phished their users.  Notably, successful phishing attacks were reported in significantly higher numbers from organizations that described their resources as mostly on-premises (36%) as opposed to being more cloud-based.

Security Impacting Budgets and Staffing

The role of security in remote work is having a direct impact on security budgets and staffing in 2020 as businesses scale existing solutions, enabling critical new capabilities like MFA, and implement a Zero Trust strategy. In order to adapt to the many business implications of the pandemic, a majority of business leaders reported budget increases for security (58%) and compliance (65%). At the same time, 81% also report feeling pressure to lower overall security costs.  Business leaders from organizations with resources mostly on-premises are especially likely to feel budget pressure, with roughly 1/3rd feeling ‘very pressured.’

To rein in expenses in the short-term, leaders say they are working to improve integrated threat protection to reduce the risk of costly breaches and acquire security solutions with self-help options for users to drive efficiency. In the longer-term, nearly 40% of businesses say they are prioritizing investments in Cloud Security (Cloud Access Security Broker, Cloud Workload Protection Platform, Cloud Security Posture Management), followed by Data & Information Security (28%) and anti-phishing tools (26%).

Technology alone cannot keep pace with the threats and demands facing businesses and their largely remote workforces. Human security expertise is at a premium with more than 80% of companies adding security professionals in response to COVID-19.

5 Ways the Pandemic is Changing Cybersecurity long-term

The pandemic has accelerated digital transformation is several ways that are likely to change the security paradigm for the foreseeable future.

1. Security has proven to be the foundation for digital empathy in a remote workforce during the pandemic. When billions of people formed the largest remote workforce in history, overnight, teams learned much more than how to scale Virtual Private Networks. Companies were reminded that security technology is fundamentally about improving productivity and collaboration through inclusive end-user experiences. Improving end-user experience and productivity while working remotely is the top priority of security business leaders (41%), with “extend security to more apps for remote work” identified as the most positively received action by users. Not surprisingly, then, “providing secure remote access to resources, apps, and data” is the biggest challenge. For many businesses, the journey begins with MFA adoption.

2. Everyone is on a Zero Trust journey. Zero Trust shifted from an option to a business priority in the early days of the pandemic. In light of the growth in remote work, 51% of business leaders are speeding up the deployment of Zero Trust capabilities. The Zero Trust architecture will eventually become the industry standard, which means everyone is on a Zero Trust journey. That reality is reflected in the numbers like 94% of companies report that they are in the process of deploying new Zero Trust capabilities to some extent.

3. Diverse data sets mean better Threat Intelligence. The pandemic illustrated the power and scale of the cloud as Microsoft tracked more than 8 trillion daily threat signals from a diverse set of products, services, and feeds around the globe. A blend of automated tools and human insights helped to identify new COVID-19 themed threats before they reached customers – sometimes in a fraction of a second. In other cases, cloud-based filters and detections alert security teams to suspicious behavior. Not surprisingly, 54% of security leaders reported an increase in phishing attacks since the beginning of the pandemic.

4. Cyber resilience is fundamental to business operations. Cybersecurity provides the underpinning to operationally resiliency as more organizations enable secure remote work options. To maintain cyber resilience, businesses need to regularly evaluate their risk threshold and ability to execute cyber resilience processes through a combination of human efforts and technology products and services. The cloud makes developing a comprehensive Cyber Resilience strategy and preparing for a wide range of contingencies simpler.

More than half of cloud forward and hybrid companies report having cyber-resilience strategy for most risk scenarios compared to 40% of primarily on-premises organization. 19% of companies relying primarily upon on-premises technology do not expect to maintain a documented cyber-resilience plan.

5. The cloud is a security imperative. Where people often thought about security as a solution to deploy on top of existing infrastructure, events like Covid-19 showcase the need for truly integrated security for companies of all sizes. As a result, integrated security solutions are now seen as imperative.

These insights from security leaders echo many of the best practices that Microsoft has been sharing with customers and working around the clock to help them implement. The bottom line is that the pandemic is clearly accelerating the digital transformation of cyber-security. Microsoft is here to help.  If any of the insights we’ve shared today resonate with you and your teams, here are a few things you should consider

• Listen to employees and take steps to build digital empathy. Enabling self-help options is a win-win for end-users and IT.
• Hire diverse security talent and empower them with great threat intelligence and tools.
• Embrace the reality that remote work is having a lasting impact on the security paradigm. Lean into the power of the cloud for built-in security spanning endpoints to the cloud.

To learn more about Microsoft Security solutions visit our website.  Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity.

Today, Microsoft and partners across 35 countries took coordinated legal and technical steps to disrupt one of the world’s most prolific botnets, called Necurs, which has infected more than nine million computers globally. This disruption is the result of eight years of tracking and planning and will help ensure the criminals behind this network are no longer able to use key elements of its infrastructure to execute cyberattacks.

A botnet is a network of computers that a cybercriminal has infected with malicious software, or malware. Once infected, criminals can control those computers remotely and use them to commit crimes. Microsoft’s Digital Crimes Unit, BitSight and others in the security community first observed the Necurs botnet in 2012 and have seen it distribute several forms of malware, including the GameOver Zeus banking trojan.

The Necurs botnet is one of the largest networks in the spam email threat ecosystem, with victims in nearly every country in the world. During a 58-day period in our investigation, for example, we observed that one Necurs-infected computer sent a total of 3.8 million spam emails to over 40.6 million potential victims.

Necurs is believed to be operated by criminals based in Russia and has also been used for a wide range of crimes including pump-and-dump stock scams, fake pharmaceutical spam email and “Russian dating” scams. It has also been used to attack other computers on the internet, steal credentials for online accounts, and steal people’s personal information and confidential data. Interestingly, it seems the criminals behind Necurs sell or rent access to the infected computer devices to other cybercriminals as part of a botnet-for-hire service. Necurs is also known for distributing financially targeted malware and ransomware, cryptomining, and even has a DDoS (distributed denial of service) capability that has not yet been activated but could be at any moment.

On Thursday, March 5, the U.S. District Court for the Eastern District of New York issued an order enabling Microsoft to take control of U.S.-based infrastructure Necurs uses to distribute malware and infect victim computers. With this legal action and through a collaborative effort involving public-private partnerships around the globe, Microsoft is leading activities that will prevent the criminals behind Necurs from registering new domains to execute attacks in the future.

This was accomplished by analyzing a technique used by Necurs to systematically generate new domains through an algorithm. We were then able to accurately predict over six million unique domains that would be created in the next 25 months. Microsoft reported these domains to their respective registries in countries around the world so the websites can be blocked and thus prevented from becoming part of the Necurs infrastructure. By taking control of existing websites and inhibiting the ability to register new ones, we have significantly disrupted the botnet.

Microsoft is also taking the additional step of partnering with Internet Service Providers (ISPs) and others around the world to rid their customers’ computers of malware associated with the Necurs botnet. This remediation effort is global in scale and involves collaboration with partners in industry, government and law enforcement via the Microsoft Cyber Threat Intelligence Program (CTIP). Through CTIP, Microsoft provides law enforcement, government Computer Emergency Response Teams (CERTs), ISPs and government agencies responsible for the enforcement of cyber laws and the protection of critical infrastructure with better insights into criminal cyber infrastructure located within their jurisdiction, as well as a view of compromised computers and victims impacted by such criminal infrastructure.

For this disruption, we are working with ISPs, domain registries, government CERTs and law enforcement in Mexico, Colombia, Taiwan, India, Japan, France, Spain, Poland and Romania, among others. Each of us has a critical role to play in protecting customers and keeping the internet safe.

To make sure your computer is free of malware, visit support.microsoft.com/botnets.

Tags: botnet, CTIP, cyberattacks, cybercrime, Microsoft Cyber Threat Intelligence Program, necurs

I’ve often said our teams should be as diverse as the problems we are trying to solve. Hiring a diverse security team isn’t just the right thing to do, it’s also good business. This is a topic I’m very passionate about, so I was delighted to interview Jane Frankland for the second podcast of Afternoon Cyber Tea, From threat intelligence to chatbots.

Jane founded and ran a cybersecurity company that conducted penetration testing. She also authored the book Insecurity: Why a Failure to Attract and Retain Women in Cybersecurity Is Making Us All Less Safe, and she provides consulting for the cybersecurity community.

Jane and I talked about how important it is for defenders to think like an attacker and the security challenges facing chatbots and other artificial intelligence (AI) technologies. One critical concern that we need to address is the replication of cultural bias in our AI. We both agreed that staffing AI teams with a diverse group of people can help. Jane is a powerful advocate for making cybersecurity and technology spaces more inclusive of women, and she talked through a few research-backed approaches that organizations can take to attract more women to their organizations. It was a great conversation, and I hope you’ll listen to this episode of Afternoon Cyber Tea with Ann Johnson on Apple Podcasts or Podcast One.

Join me at RSA Conference 2020

If you will be in San Francisco in February for the RSA Conference, I will be delivering a keynote, “Why your people are still your best cyber defense,” on February 26, 2020 at 4:05 PM. Over the years, I’ve learned that the companies that are most successful at recovering from a cyberattack tend to have two things in common: the right technology and good people. AI and machine learning will be vital tools in the fight for cybersecurity, but so will the human spirit. Join me at this keynote to hear how to create a culture where people are your best defense.

What’s next

In this important cyber series, I talk with cybersecurity influencers about trends shaping the threat landscape and explore the risk and promise of systems powered by AI, Internet of Things (IoT), and other emerging tech.

You can listen to Afternoon Cyber Tea with Ann Johnson on:

• Apple Podcasts—You can also download the episode by clicking the Episode Website link.
• Podcast One—Includes option to subscribe, so you’re notified as soon as new episodes are available.
• CISO Spotlight page—Listen alongside our CISO Spotlight episodes, where customers and security experts discuss similar topics such as Zero Trust, compliance, going passwordless, and more.

In the meantime, bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity. Or reach out to me on LinkedIn or Twitter if you have guest or topic suggestions.

Threat intelligence is often spoken about as being a key pillar of cybersecurity. But what is it and why is it so important?

In our latest #TechTalk, John Lambert, Distinguished Engineer and General Manager of the Microsoft Threat Intelligence Center (MSTIC), explains how, while all organizations work to manage their security risks in cyberspace, these risks become threats when combined with malicious intent. The goal of threat intelligence is to give organizations context and awareness about the online threats they face and to help them prioritize their responses.

Cybersecurity threats reflect the geopolitical contests, competitions and conflicts occurring in the world, John explains. This means that many organizations face threats from adversaries seeking to cause financial, reputational, or even geopolitical damage. Microsoft studies the most significant threat actors in order to understand the techniques they use, and to build defensive measures into the services offered to customers. Every month Microsoft blocks around five billion attacks – including malware attacks and phishing emails, as well as more targeted threats – by tracking and limiting the actors behind them.

John also discusses how the use of artificial intelligence (AI) systems, which can be taught to detect and respond to cyberattacks, is speeding and scaling up Microsoft’s defensive efforts. However, he also warns of the new cyber-challenges that the same technology can bring, particularly in relation to the manipulation of image and speech patterns to spread disinformation via ‘deep fakes’.

In order to respond to the growth and sophistication of cyberthreats, John argues that organizations facing common threat actors need to work together far more proactively and share information to be able to anticipate and defend against common threats. At the same time, individuals can help protect themselves more thoroughly by better managing their passwords and credentials.

Watch the full #TechTalk below:

Tags: #TechTalk, AI, cybersecurity