State of Cybercrime

Human operated ransomware targeting and rate of success model based on Microsoft Defender for Endpoint data (January—June 2022): Of 2,500 potential target organizations, 60 of those will be prioritized targets for perceived profit and encounter activity associated with known ransomware attackers; 20 will be successfully compromised as attackers take advantage of any security weakness found on the network; and 1 of those will fall victim to a successful ransomware event.

Take action
Ransomware attackers are motivated by easy profits, so adding to their cost via security hardening is key in disrupting the cybercriminal economy.

• Build credential hygiene. More so than malware, attackers need credentials to succeed in their operations. The successful human-operated ransomware infection of an entire organization relies on access to a highly privileged account like a Domain Administrator, or abilities to edit a Group Policy.
• Audit credential exposure.
• Prioritize deployment of Active Directory updates.
• Prioritize cloud hardening.
• Reduce the attack surface.
• Harden internet-facing assets and understand your perimeter.
• Reduce SOC alert fatigue by hardening your network to reduce volume and preserve bandwidth for high priority incidents.

• Implement good cyber hygiene and provide cybersecurity training for employees with guidance for avoiding being socially engineered.
• Conduct regular automated user activity anomaly checks through detections at scale to help reduce these types of attacks.
• Update and secure routers on corporate and private networks.

• The technology industry must come together to design a comprehensive response to this new threat.
• Leading technology companies, including Microsoft, have tools to identify malicious traffic associated with DDoS attacks and disable the responsible machines.
• Open source users should keep a heightened watch during times of geopolitical strife.