The sophistication of cyberattacks, accelerated by the ‘hybrid war’ in Ukraine, has ushered in a new age of conflict that nations and businesses will have to face. 

Microsoft’s Digital Defence Report 2022  was just released, reflecting a startling trend in the increased commonality and destructiveness of cyberattacks. 

We typically think that nation-state cyberattacks merely target other nation-states, which is problematic enough. 

The report, however, highlights how the sophistication of cybercriminals and the increasing reliance on digital technology has expanded the influence of cyberattacks, and transformed strategies across the digital landscape. 

Any vulnerability in the digital world can be exploited to allow nation-state attackers to target the digital infrastructure and security of a nation. 

The UK was found to be one of the most targeted countries for cyberattacks by nation-state actors. 

This comes after the NCSC’s Annual Review, showing that 34 million cyber attack alerts were issued by the centre in the past year. 

The report also comes after experts warn of the spread of misinformation on social media before the midterm elections in the US, particularly after acquisition of Twitter by Elon Musk and the subsequent firing of thousands of IT workers at the social media giant. 

Of the major concerns the report raises, cyber-influence operations were shown to be growing in their importance and scale as the globe continually battles misinformation and propaganda on social media sites. 

The Cybercrime Landscape

Cybercrime has become more sophisticated – while password hacking and ransomware are still the most common methods, the ecosystem of cybercrimes has become self-sustaining. 

Cybercrime-as-a-service has become industrialised, with marketplaces verifying their products and criminals using analytics to maximise their reach. 

This has made it easier for cybercriminals to enter the market as well as advance their skills and scope – attacks are increasingly ‘audacious,’ targeting governments, businesses and critical infrastructure. 

Internet of things devices are also targeted – unpatched routers allow hackers to infiltrate networks for attacks. 

Cybercriminals enter at any vulnerability, using lateral movements to access their targeted networks. 

Microsoft says the most effective defence would include multi-factor authentication, frequent security patches, and Zero Trust principles. 

Nation-State Threats 

Nation-states’ use of cyberattacks are on the rise, with more sophisticated attacks evading detection and advancing their political influence. 

Russia’s use of cyber warfare in Ukraine is already notorious, as they used wiper malware to target Ukrainian services, and launched missiles on physical data centres. 

Globally, there has been increased targeting of critical infrastructure, especially IT and financial services and transportation and communication systems. 

Nations have identified and exploited unpatched vulnerabilities, using the IT supply chain as a ‘gateway’ to targets. 

Advancements in cloud infrastructure, automation and remote access technologies have enabled nation state actors to increase their range of activity and targets. 

The war in Ukraine has seen a change in overall data protection strategies. 

“Before the invasion of Ukraine, governments thought that data needed to stay inside a country in order to be secure,” Crisitn Flynn Goodwin, Associate General Counsel, Customer Security and Trust at Microsoft said in the report. 

“After the invasion, migrating data to the cloud and moving outside territorial borders is no a part of resilience planning and good governance.”

Devices and Infrastructure 

One of the major vulnerabilities nations face is in their digital infrastructure. 

The pandemic sparked an overall increase in the use of digital devices and has called for major investments into digital infrastructure around the globe. 

IT hardware and software security has increased, but Internet of Things and Operational Technology devices have not kept pace with security threats. 

Attackers are increasingly using these vulnerable devices to infiltrate corporate networks, moving laterally once they find an opening. 

The report found that 32% of the firmware analysed contained at least 10 known vulnerabilities. 

Attacks on remote management devices have increased five fold in the past year. 

The European Commission has proposed the Cyber Resilience Act to mitigate the security risk of connected devices. 

The UK has drafted a bill which would require connected devices to stop using default passwords. 

These simple acts are part of the basic security ‘hygiene’ the report says can mitigate most cybersecurity attacks. 

Microsoft therefore called for a ‘consistent global framework’ to address these sophisticated attacks. 

Cyber Influence Operations

The use of cyber infiltration to promote propaganda and spread misinformation is also on the rise, and is of a global concern. 

Skilled Advanced Persistent Manipulator actors use everything at their disposal, including social media, to increase the reach and influence of their propaganda. 

‘Synthetic media’ is becoming commonplace as more tools enable the creation and spread of artificial media. 

Social media was used by Russia to spread propaganda surrounding their invasion of Ukraine, and the report found the they and other sanctions used social media to increase their international influence. 

Cyber resilience 

Interestingly, despite consistently referencing the increased sophistication of cyberattacks, the report said basic cyber hygiene could prevent most attacks. 

Distributed Denial of Service (DDoS) activity was found to be of unprecedented complexity and scale in the past year, meaning that resiliency is more important than ever. 

Steps Being Taken 

The NCSC is launching a new scanning system to analyse vulnerabilities to cyber attacks in UK systems. 

Specifically, the NCSC will investigate any vulnerabilities in internet-enabled systems throughout the UK, allowing the organisation to assess their level of exposure and track mitigation attempts. 

This audit should prove vital in ensuring a holistic approach to increasing security, as all fronts need to be prepared for cyber threats and attacks.