​​Microsoft releases second edition of Cyber Signals

• RaaS a dominant business model helping criminals deploy ransomware
• Over 80% of ransomware attacks traced to common configuration errors 

Microsoft released its second edition of Cyber Signals, a regular cyberthreat intelligence brief, spotlighting security trends and insights gathered from Microsoft’s global security signals and experts. 

The tech giant noted that specialisation and consolidation of the cybercrime economy have fueled ransomware-as-a-service (RaaS), becoming a dominant business model, thus enabling a wider range of criminals, regardless of their technical expertise, to deploy ransomware. 

It said this edition of Cyber Signals provides insights on the evolving factors shaping the extortion segment of the cybercrime economy, and the influential rise of RaaS powering ransomware attacks.

It added that the RaaS economy allows cybercriminals to purchase access to ransomware payloads and data leakage as well as payment infrastructure. 

These Ransomware ‘gangs’ are in reality RaaS programs like Conti or REvil, used by many different actors who switch between RaaS programs and payloads, Microsoft said. 

This industrialisation of cybercrime has created specialised roles, like access brokers who sell access to networks and a single compromise often involves multiple cybercriminals in different stages of the intrusion, it said.

Key findings shared within the report include:

• Over 80% of ransomware attacks can be traced to common configuration errors in software and devices;
• Microsoft’s Digital Crimes Unit directed the removal of more than 531,000 unique phishing URLs and 5,400 phish kits between July 2021 and June 2022;
• Median time for an attacker to access a person’s private data if they fall victim to a phishing email is one hour and 12 minutes;
• For endpoint threats, the median time for an attacker to begin moving laterally within a corporate network if a device is compromised is one hour and 42 minutes; and
• Guidance on how businesses can better pre-empt and disrupt extortion threats, by building their credential hygiene, auditing credential exposure, reducing the attack surface, securing their cloud resources and identities, better preventing initial access, and closing security blind spots.

Vasu Jakkal, corporate vice president, security, compliance, identity, and management at Microsoft, said, “The best defenses begin with clarity and prioritisation, that means more sharing of information across and between the public and private sectors and a collective resolve to help each other make the world safer for all.

“At Microsoft, we take that responsibility to heart because we believe security is a team sport,” said Jakkal.

For more information on the RaaS landscape and its evolution, check out the Cyber Signals microsite and report, as well as the Microsoft Security blogpost.

To better understand the cybercrime gig economy and how businesses can protect themselves, visit the Microsoft Security blog.