Loading story…
Microsoft's 2025 Digital Defense Report emphasizes the urgent need for organizations to elevate cybersecurity to a boardroom-level priority, citing the increasing frequency and sophistication of cyberattacks. The report urges IT leaders to frame cybersecurity as a business risk equivalent to financial or legal challenges, advocating for direct engagement with corporate boards and CEOs to address organizational security weaknesses. Microsoft recommends tracking key security metrics such as multi-factor authentication (MFA) coverage, patch latency, incident counts, and incident response times to provide a comprehensive view of an organization's vulnerability and preparedness. The report highlights the importance of enforcing phishing-resistant MFA across all accounts, including those with administrative privileges, and regularly auditing third-party perimeter access. Over the past year, Microsoft observed a surge in the development of novel attack techniques by threat actors, who continue to exploit known security gaps opportunistically. The majority of attacks in the last six months have targeted the United States, United Kingdom, Israel, and Germany, reflecting a global threat landscape. According to the report, 80% of cyber incidents investigated by Microsoft involved data theft, with over half of attacks driven by extortion or ransomware motives, underscoring the financial incentives behind most cybercrime. Only a small fraction—about 4%—of attacks were attributed solely to espionage. The proliferation of automation, off-the-shelf hacking tools, and AI has enabled even low-skilled cybercriminals to scale their operations, making cybercrime a pervasive threat to organizations of all sizes. Microsoft processes over 100 trillion signals daily, blocks 4.5 million new malware attempts, analyzes 38 million identity risk detections, and screens 5 billion emails for threats, illustrating the scale of the challenge. The report stresses that legacy security measures are insufficient, advocating for modern, AI-driven defenses and cross-sector collaboration to keep pace with evolving threats. Organizational leaders are encouraged to build resilience into their technology and operations from the outset, treating cybersecurity as a strategic imperative. The report also notes that while nation-state actors remain a persistent concern, the immediate risk to most organizations comes from financially motivated, opportunistic criminals. Microsoft’s recommendations aim to help organizations better understand their risk posture and improve their ability to detect, prevent, and respond to cyber incidents. The report’s findings are informed by Microsoft’s extensive threat intelligence and security operations, providing actionable insights for both technical and executive audiences. The emphasis on board-level engagement reflects a broader industry trend recognizing that cybersecurity is integral to overall business resilience and continuity. By adopting the recommended practices, organizations can better defend against the growing spectrum of cyber threats and minimize the impact of potential breaches.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft released its 2025 Digital Defense Report, stating that extortion and ransomware account for more than half of cyberattacks and highlighting boardroom cyber awareness as a top priority. The report publication is the primary real-world event reflected across the references.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Geopolitical instability, rapid technological advancement, and persistent skills shortages are fundamentally reshaping the cybersecurity landscape for organizations worldwide. According to a PwC report, 60% of executives now rank cyber risk investment among their top three strategic priorities, driven by concerns over political instability, trade disputes, and shifting alliances. Despite this heightened awareness, only about half of surveyed organizations feel very capable of withstanding cyberattacks on common vulnerabilities, and a mere 6% report preparedness across all vulnerabilities, highlighting significant exposure through legacy systems and complex supply chains. The financial impact of breaches remains severe, with over a quarter of respondents experiencing incidents costing at least $1 million in the past three years, disproportionately affecting large enterprises and technology-driven sectors. Spending on cybersecurity is increasing, with 78% of organizations expecting budget growth, yet only 24% are channeling more resources into proactive measures such as monitoring, testing, and training, indicating a continued reactive posture. The ENISA Threat Landscape 2025 report underscores the professionalization of cybercrime, the convergence of criminal and state-aligned actors, and the rise of hacktivist groups leveraging ransomware for both ideological and financial gain. Ransomware remains the most disruptive threat across the EU, with groups adopting decentralized operations, double- and triple-extortion tactics, and exploiting regulatory compliance fears to pressure victims. The proliferation of Ransomware-as-a-Service (RaaS), public leaks of builder tools, and the emergence of access brokers have lowered barriers to entry, fueling a diverse and persistent threat ecosystem. Weak authentication practices persist in many organizations, with passwords and SMS codes still dominant despite their vulnerability to phishing and credential theft. A significant portion of employees have never received cybersecurity training, and outdated policies further exacerbate risk, as personal and professional security habits often overlap, creating additional attack vectors. The adoption of stronger authentication methods, such as device-bound passkeys, remains limited, and resistance to multi-factor authentication is common due to perceived complexity. The use of AI in both attack and defense is accelerating, with AI-generated phishing campaigns and adaptive malware becoming more prevalent, while defenders also leverage AI for predictive threat detection. The overall picture is one of rising threat sophistication, uneven organizational preparedness, and a pressing need for sustained investment in proactive security measures, workforce training, and the adoption of advanced technologies to build resilience against an increasingly complex cyber threat landscape.
Jun 29, 2026
The cybersecurity landscape in 2025 is marked by a rapid acceleration in both the frequency and sophistication of cyberattacks, with cloud environments and supply chains emerging as primary targets. According to the Microsoft Digital Defense Report 2025, financially motivated cyberattacks and nation-state operations have intensified, leveraging artificial intelligence to increase the speed, scale, and profitability of attacks. AI-powered phishing campaigns now achieve up to 50 times greater profitability by automating personalized attacks, while the window for compromising cloud containers has shrunk to just 48 hours after deployment. North Korean threat actors have embedded tens of thousands of operatives globally, exploiting the remote workforce as a persistent attack vector. Microsoft telemetry reveals an 87% increase in disruptive campaigns targeting Azure environments, with credential theft and data exfiltration attempts rising by 23% and 58%, respectively. Azure Blob Storage, a critical component for storing unstructured data, is increasingly targeted by threat actors seeking to compromise data integrity and business continuity. Microsoft’s Secure Future Initiative has responded by strengthening default security measures and providing actionable recommendations for defending against these evolving threats, including leveraging Microsoft Defender for Cloud’s Defender for Storage plan. The broader industry is also witnessing a surge in supply chain breaches, with 2025 statistics showing a 68% increase in such incidents, now accounting for 15% of all data breaches. Nearly one-third of all breaches are linked to third-party vendors or partners, and Gartner predicts that 45% of organizations will experience a supply chain breach by the end of 2025. No industry is immune, as interconnected digital ecosystems expand the attack surface and expose organizations to cascading risks from less secure partners. Cloud security incidents are on the rise, with 80% of organizations reporting an increase and 45% of breaches being cloud-based, resulting in an average cost of $4.35 million per breach. Disaster Recovery-as-a-Service (DRaaS) and cyber recovery solutions are increasingly critical for ensuring business continuity and resilience, focusing on restoring clean, uncompromised systems after disruptions. The need for robust security baselines, continuous monitoring, and strategic recovery planning is underscored by the evolving tactics of threat actors and the growing complexity of cloud and supply chain environments. Organizations are urged to adopt a proactive, layered defense strategy, leveraging AI-driven detection, secure configuration, and rapid incident response to mitigate the impact of these accelerating threats. The convergence of cloud and supply chain vulnerabilities demands heightened vigilance, cross-functional collaboration, and investment in advanced security technologies to safeguard critical assets and maintain operational resilience in the face of relentless cyber adversaries.
Jun 29, 2026
Microsoft’s 2026 Digital Defense Report says cyber risk is increasingly interconnected across identities, endpoints, cloud environments, applications, infrastructure, and software supply chains. Government agencies and services were the most targeted sector in Microsoft-observed activity, accounting for 27% between July 2025 and June 2026, up from 17% the prior year. Phishing represented 23% of observed intrusions, while compromised identities, exposed applications, social engineering, and legitimate administrative tools remained leading access paths; 52.2% of intrusions involving valid accounts resulted in additional credential theft. The report assesses that attackers currently gain greater near-term advantage from AI, using it to accelerate reconnaissance, vulnerability discovery, phishing, malware and exploit development, and post-compromise activity. Microsoft warns that AI-assisted flaw discovery may outpace patch validation and deployment, reducing exploitation windows to less than 24 hours, and cites activity by China-, Russia-, and North Korea-linked operators, though attacks generally still require human direction. It recommends cross-domain telemetry correlation, rapid incident coordination and continuity planning, public-private intelligence sharing, and AI-agent controls covering identity, authorization, data and model security, prompt injection, agent memory, behavior, and revocation of access.
Oct 3, 2026