Microsoft: State-backed hackers grow in sophistication, aggressiveness | CyberScoop<\/title> <meta name=\"description\" content=\"Hackers from countries like Iran are increasingly pairing their hacking operations with information operations pushing propaganda.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/iran-russia-microsoft-hacking-operations\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Microsoft: State-backed hackers grow in sophistication, aggressiveness\"> <meta property=\"og:description\" content=\"Hackers from countries like Iran are increasingly pairing their hacking operations with information operations pushing propaganda.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/iran-russia-microsoft-hacking-operations\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2023-10-05T13:00:00+00:00\"> <meta property=\"article:modified_time\" content=\"2023-10-05T17:28:36+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/microsoft-state-backed-hackers-grow-in-sophistication-aggressiveness-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1280\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"AJ Vicens\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@AJVicens\">  <link rel=\"dns-prefetch\" href=\"\/\/cdn.parsely.com\">\n<link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-0\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1695397585g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-4\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress-next\/dist\/css\/related-posts-block-styles.min.css?m=1693499496g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1695741454g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=7af46db108fbc62fdcc9\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/77469\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.3.1\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=77469\">\n<link rel=\"alternate\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Firan-russia-microsoft-hacking-operations%2F\">\n<link rel=\"alternate\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Firan-russia-microsoft-hacking-operations%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-77469 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/iran-russia-microsoft-hacking-operations\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.002824858757\">\n<div class=\"single-article__header-content\" readability=\"30.272727272727\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/news\/geopolitics\/\"> <span>Geopolitics<\/span> <\/a> <\/li>\n<\/ul>\n<p> Hackers from countries like Iran are increasingly pairing their hacking operations with information operations pushing propaganda. <\/p>\n<\/p><\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/microsoft-state-backed-hackers-grow-in-sophistication-aggressiveness.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/microsoft-state-backed-hackers-grow-in-sophistication-aggressiveness-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/microsoft-state-backed-hackers-grow-in-sophistication-aggressiveness-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/microsoft-state-backed-hackers-grow-in-sophistication-aggressiveness-2.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/microsoft-state-backed-hackers-grow-in-sophistication-aggressiveness-2.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/microsoft-state-backed-hackers-grow-in-sophistication-aggressiveness-2.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/microsoft-state-backed-hackers-grow-in-sophistication-aggressiveness-2.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/microsoft-state-backed-hackers-grow-in-sophistication-aggressiveness-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/microsoft-state-backed-hackers-grow-in-sophistication-aggressiveness-2.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/microsoft-state-backed-hackers-grow-in-sophistication-aggressiveness-2.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/microsoft-state-backed-hackers-grow-in-sophistication-aggressiveness-2.jpg?resize=1265,843 1265w\" sizes=\"(max-width: 1013px) 100vw, 1013px\"><figcaption> Iranian flag waving with cityscape on background in Tehran, Iran. (Sir Francis Canker Photography\/Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"61.917665450756\"><body readability=\"124.953745692\"><\/p>\n<p>Iranian cyber operations targeting Western entities are growing more sophisticated and effective as part of an overall shift among state-backed hacking groups toward espionage, researchers with Microsoft said Thursday.<\/p>\n<p>In <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/security-insider\/microsoft-digital-defense-report-2023?rtc=1\">a report published Thursday<\/a> describing the global cybersecurity landscape, Microsoft researchers conclude that state-backed cyber operations are broadly becoming more advanced and aggressive and are increasingly pairing campaigns to breach computer systems with information operations to spread propaganda. <\/p>\n<p>The company\u2019s findings on Iran illustrate this trend. Over the last year, Iranian cyber operators stepped up their work, particularly in the Global South, with enhanced offensive cyber capabilities and a comingling of rudimentary operations with multi-pronged influence campaigns to achieve geopolitical effects. Tehran views these tools as a way to respond to perceived efforts to foment unrest inside Iran, Microsoft\u2019s researchers conclude. <\/p>\n<p>\u201cThey seem to be more intentional and focused in their targeting than we\u2019ve seen before,\u201d Sherrod DeGrippo, Microsoft\u2019s director of threat intelligence strategy, said of Iranian improvements in cyber operations targeting and utilizing cloud computing systems and featuring bespoke software implants. \u201cThey\u2019re getting better at leveraging vulnerabilities, they\u2019re getting better at focused, real cyber operations, so we see them evolving.\u201d<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Thursday\u2019s sprawling 131-page report from Microsoft, its fourth annual Digital Defense Report, surveys and collates broad themes in the cyber operations and cybercrime ecosystems and how those trends are effecting government and private organizations around the world. The report describes trends in nation-state activity, cybercrime, threats to critical infrastructure and internet connected devices around the world, supply chain vulnerabilities and the importance of collective defense.<\/p>\n<p>To describe that landscape, the report relies on what Tom Burt, Microsoft\u2019s corporate vice president for customer security and trust, described in a call ahead of its release as the company\u2019s \u201cunique vantage point\u201d \u2014 the ubiquity of Microsoft software around the world. <\/p>\n<p>The report concludes that government-sponsored spying and influence operations have proliferated over the last year and shifted in important ways, away from noisy high-profile cyberattacks and toward espionage. \u201cThe predominant motivation has swung back to a desire to steal information, covertly monitor communication, or to manipulate what people read,\u201d Burt <a href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2023\/10\/05\/microsoft-digital-defense-report-2023-global-cyberattacks\/\">wrote in a blog post<\/a> accompanying the report\u2019s release.<\/p>\n<p>That conclusion <a href=\"https:\/\/cyberscoop.com\/russia-hacking-law-enforcement\/\">aligns with recent reporting from Ukraine\u2019s top cyber defense agency<\/a>, which has said that while destructive Russian cyber attacks continue, their networks are seeing more espionage and intelligence gathering, particularly against law enforcement targets.<\/p>\n<p>Nation-state activity remains \u201cmost pronounced against the U.S., Ukraine, and Israel, and pervasive throughout Europe,\u201d the Microsoft report reads. But operations increased in the Middle East as a result of more Iranian operations across a range of sectors, the researchers said, particularly against education, government, information technology and communications targets. Countries in the Global South, particularly Latin America and sub-Saharan Africa, have seen a particular increase in attacks, Burt said. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The report also highlights a sharp rise in human-operated ransomware incidents \u2014 up more than 200%, according to the company\u2019s data \u2014 which make up just one slice of a cybercrime ecosystem that\u2019s evolving toward \u201cmore effective and damaging attacks, which often take place at scale,\u201d the company wrote in the report.<\/p>\n<p>Dwell time, or the time between a system being breached and that breach being detected, has decreased, but attackers are getting more adept at pivoting within systems, exfiltrating files, encrypting and ransoming the organization, DeGrippo said. \u201cThe ransomware activity now is so fast, it\u2019s like the blink of an eye,\u201d she added.<\/p>\n<p>To disrupt the financial and technological systems underpinning cybercrime, Microsoft is increasingly collaborating with law enforcement agencies around the world and carrying out domain seizures to disrupt criminal groups. The company has in recent months <a href=\"https:\/\/cyberscoop.com\/microsoft-cobalt-strike-hacking-tool\/\">cracked down on illicit copies of Cobalt Strike<\/a>, a security testing application, alongside Fortra, the company that produces it, and has worked with the U.S. government to identify and deter Chinese <a href=\"http:\/\/cyberscoop.com\/china-critical-infrastructure-volt-typhoon\/(opens%20in%20a%20new%20tab)\">targeting of<strong> <\/strong>facilities in Guam<\/a>.<\/p>\n<p>\u201cWhile we have a long way to go, as detailed in the report, we have had some early successes in doing this work and we will continue to focus on it whenever we can in collaboration with law enforcement and others in the private sector to increase the impact of these disruptions,\u201d Burt said.<\/p>\n<p>The report also highlights the proliferation of private contractors and firms who supply governments and others with spyware and offensive cyber capabilities. Citing <a href=\"https:\/\/carnegieendowment.org\/files\/Feldstein_Global_Spyware.pdf\">a March 2023 report<\/a> from the Carnegie Endowment for International Peace, the researchers note that 74 governments have contracted firms to access spyware and digital forensics technology.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>From spyware to private-sector malware developers, examples abound and could muddy an already complicated geopolitical picture. \u201cAttribution is going to become harder and more important as these kinds of threat actors come online,\u201d DeGrippo said.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"1.1358024691358\">\n<div class=\"author-card\" readability=\"8\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/microsoft-state-backed-hackers-grow-in-sophistication-aggressiveness-1.jpg?w=640&ssl=1\" alt=\"AJ Vicens\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by AJ Vicens<\/h4>\n<p> AJ covers nation-state threats and cybercrime. He was previously a reporter at Mother Jones. Get in touch via Signal\/WhatsApp: (810-206-9411). <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/iran-russia-microsoft-hacking-operations\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft: State-backed hackers grow in sophistication, aggressiveness | CyberScoop Skip<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[964,313,302,513,1006,625,270,354],"tags":[967,316,306,517,1008,630,276,358],"class_list":["post-1843","post","type-post","status-publish","format-standard","hentry","category-africa","category-cyberespionage","category-geopolitics","category-iran","category-latin-america","category-microsoft","category-russia","category-ukraine","tag-africa","tag-cyberespionage","tag-geopolitics","tag-iran","tag-latin-america","tag-microsoft","tag-russia","tag-ukraine"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/africa\/\" rel=\"category tag\">Africa<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cyberespionage\/\" rel=\"category tag\">cyberespionage<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/geopolitics\/\" rel=\"category tag\">Geopolitics<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/iran\/\" rel=\"category tag\">Iran<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/latin-america\/\" rel=\"category tag\">Latin America<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/microsoft\/\" rel=\"category tag\">Microsoft<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/russia\/\" rel=\"category tag\">Russia<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ukraine\/\" rel=\"category tag\">Ukraine<\/a>","tag_info":"Ukraine","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/1843","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=1843"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/1843\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=1843"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=1843"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=1843"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":1843,"date":"2023-10-05T13:00:00","date_gmt":"2023-10-05T13:00:00","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=77469"},"modified":"2023-10-05T13:00:00","modified_gmt":"2023-10-05T13:00:00","slug":"microsoft-state-backed-hackers-grow-in-sophistication-aggressiveness","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2023\/10\/05\/microsoft-state-backed-hackers-grow-in-sophistication-aggressiveness\/","title":{"rendered":"Microsoft: State-backed hackers grow in sophistication, aggressiveness"},"content":{"rendered":"