Microsoft Digital Defense Report 2024 Reveals It Defends Against 600M+ Cyber Attacks Daily

In the last year, the cyber threat landscape continued to become more dangerous and complex. The malign actors of the world are becoming better resourced and better prepared, with increasingly sophisticated tactics, techniques, and tools that challenge even the world’s best cybersecurity defenders.  Even Microsoft has been the victim of well-orchestrated attacks by determined and well-resourced adversaries, and our customers face more than 600 million cybercriminal and nation-state attacks every day, ranging from ransomware to phishing to identity attacks.

Microsoft’s unique, expansive, and global vantage point gives it unprecedented insight into key trends in cybersecurity affecting everyone from individuals to nations. The spectrum of security signals we see is further enhanced by the diversity of our customers and partners, including governments, enterprises large and small, consumers, and gamers.

Geopolitical tensions are a significant factor driving these cyber attacks, with adversaries seeking to disrupt critical infrastructure and steal technological, political, and military secrets. Nation-states often collaborate with cybercriminal organizations, trading resources such as funding and training for technical skills. Although the objectives—financial gain for criminals and intelligence or disruption for state actors—remain the same, the tactics, techniques, and procedures (TTPs) employed have evolved.

Microsoft notes a trend of nation-state actors using established cybercriminal tools, such as information-stealing software and command-and-control (C2) infrastructures, for their attacks. For example, Russian hacker group Storm-2049 has used tools like Xworm and Remcos RAT, commonly utilized by cybercriminals, to target at least 50 Ukrainian military devices. Similarly, during a recent CrowdStrike outage, cybercriminals hid Remcos RAT in fake software patches.

North Korea has adjusted its espionage strategies to include financial motives, deploying a specialized ransomware called FakePenny. This malware has targeted the aerospace and defense sectors, stealing sensitive data for intelligence before encrypting the files and demanding a ransom. Such activities illustrate the increasingly blurred lines between nation-state threat actors and traditional cybercriminal groups.

The report also highlights that most nation-state cyber activities focus on conflict zones or areas of regional tension. Russia, for instance, has targeted Ukraine and NATO countries to gather intelligence on Western responses to the ongoing conflict. Meanwhile, China has concentrated its cyber efforts on Southeast Asia, especially regarding military and political policies related to Taiwan and territorial disputes in the South China Sea.

Election-related influence campaigns have surged, with a noticeable rise in the use of “homoglyph” domains that appear legitimate but are designed to mislead, such as substituting “w” with “vv” or changing “.gov” to “.org” in URLs.

Both China and Russia have also experimented with generative AI to manipulate text, images, videos, and audio for influence campaigns. However, these efforts have had limited success thus far.