Microsoft issues warning over “opportunistic” cyber criminals targeting big business
Microsoft has called on governments to do more to support organizations
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
You are now subscribed
Your newsletter sign-up was successful
More than half of cyber attacks are now motivated by extortion and ransomware, according to Microsoft, with legacy security measures no longer enough to counter the threat.
In its sixth annual Digital Defense Report, the company said attackers sought to steal data, mostly for financial gain, in 80% of the cyber incidents its security teams investigated last year.
"That’s at least 52% of incidents fueled by financial gain, while attacks focused solely on espionage made up just 4%," said Amy Hogan-Burney, CVP for customer security and trust.
"Nation-state threats remain a serious and persistent threat, but most of the immediate attacks organizations face today come from opportunistic criminals looking to make a profit."
Critical public services are a main target, the study noted. Hospitals and local governments, for example, store sensitive data and often have tight cybersecurity budgets with limited incident response capabilities.
Healthcare or other critical organizations, meanwhile, may feel greater pressure to pay a ransom because of the vital importance of their services.
Nation-state hackers are shaking up tactics
While the proportion of attacks by nation-state actors remains low, the number is growing.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
China is continuing its broad push across industries to conduct espionage and steal sensitive data, and increasingly attacking non-governmental organizations (NGOs), using covert networks and vulnerable internet-facing devices to gain entry and avoid detection.
Hackers backed by the regime have also become faster at operationalizing newly disclosed vulnerabilities, Microsoft said.
Iran, meanwhile, is going after a wider range of targets than ever before, from the Middle East to North America, including recent attacks on shipping and logistics firms in Europe and the Persian Gulf that gave ongoing access to sensitive commercial data.
Notably, Russia has expanded its range beyond Ukraine, targeting small businesses in countries supporting Ukraine, perhaps viewing them as being easier to access than larger organizations.
North Korean IT workers are a serious problem
Microsoft warned that North Korea remains focused on revenue generation and espionage.
A new tactic involves thousands of state-affiliated North Korean remote IT workers applying for jobs with companies around the world, sending their salaries back to the government as remittances.
When discovered, Microsoft said some of these workers have turned to extortion.
"The cyber threats posed by nation-states are becoming more expansive and unpredictable. In addition, the shift by at least some nation-state actors to further leveraging the cybercriminal ecosystem will make attribution even more complicated," warned Hogan-Burney.
"This underscores the need for organizations to stay abreast of the threats to their industries and work with both industry peers and governments to confront the threats posed by nation-state actors."
AI tools are a cyber crime enabler
Advances in automation and readily available off-the-shelf tools have enabled cyber criminals — even those with limited technical expertise — to expand their operations significantly.
The use of AI, meanwhile, has allowed cyber criminals to accelerate malware development and create more realistic synthetic content, improving the efficiency of activities such as phishing and ransomware attacks.
More than 97% of identity attacks are password attacks, with the number surging by 32% in the first half of 2025 alone, mostly through large-scale password guessing via credential leaks.
"However, credential leaks aren’t the only place where attackers can obtain credentials. This year, we saw a surge in the use of infostealer malware by cyber criminals. Infostealers can secretly gather credentials and information about your online accounts, like browser session tokens, at scale," said Hogan-Burney.
"Cyber criminals can then buy this stolen information on cyber crime forums, making it easy for anyone to access accounts for purposes such as the delivery of ransomware."
The report calls on governments to do more to help by building frameworks that signal credible and proportionate consequences for malicious activity that violates international rules.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
Low-budget devices are the biggest casualty of the RAM crisisNews Say goodbye to budget devices; vendors are doubling down on high-end options to absorb costs
-
Sectigo taps Clint Maddox to lead global field operationsReviews The appointment follows a year of strong momentum for the security vendor as it expands its global channel footprint
-
Is your new hire an AI clone? Microsoft says North Korean hackers are using AI to impersonate job seekers and steal company secretsNews The groups are increasingly using face-changing or voice-changing software to make their fake identities more plausible
-
Using AI to generate passwords is a terrible idea, experts warnNews Researchers have warned the use of AI-generated passwords puts users and businesses at risk
-
Researchers called on LastPass, Dashlane, and Bitwarden to up defenses after severe flaws put 60 million users at risk – here’s how each company respondedNews Analysts at ETH Zurich called for cryptographic standard improvements after a host of password managers were found lacking
-
‘They are able to move fast now’: AI is expanding attack surfaces – and hackers are looking to reap the same rewards as enterprises with the technologyNews Potent new malware strains, faster attack times, and the rise of shadow AI are causing havoc
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacksNews Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
Notepad++ hackers remained undetected and pushed malicious updates for six months – here’s who’s responsible, how they did it, and how to check if you’ve been affectedNews Hackers remained undetected for months and distributed malicious updates to Notepad++ users after breaching the text editor software – here's how to check if you've been affected.
-
CISA’s interim chief uploaded sensitive documents to a public version of ChatGPT – security experts explain why you should never do thatNews The incident at CISA raises yet more concerns about the rise of ‘shadow AI’ and data protection risks
