Tag: Recent News

Today, the White House announced that the United States and 60 other governments have signed a new Declaration for the Future of the Internet. As the world grapples with so many technology challenges, this Declaration represents a vital step at a critical moment. At Microsoft, we applaud the White House for its leadership, we are grateful for such broad global support, and we look forward to doing our part in supporting the Declaration’s principles.

As I read through the Declaration, there are few aspects that jump out as not just important but incredibly timely.

First and most broadly, the Declaration, using its own words, “reclaims the promise of the internet in the face of the global opportunities and challenges presented by the 21st century.”

This is precisely what the world needs.

Almost three decades ago when I first joined Microsoft, we all looked at the Internet and saw the promise of the digital age. In hindsight, we were too absorbed by the internet’s promise, and we paid too little attention to the potential pitfalls and even perils that would lie ahead. We collectively did too little to solve problems when they were small, and we failed to foresee the potential use and abuse of the internet by the autocrats of the world. As we approach the start of the second quarter of the 21st century, digital technology has become both the world’s most powerful tool and most formidable weapon.

This is a time for new leadership to reset and reclaim a brighter future for technology that is hardheaded and clear-eyed about the challenges we face. And it’s a time when a realistic grounding in technology challenges can help the world move faster and farther to make real a more optimistic vision for the internet’s future. The Declaration not only speaks to this future but provides with specificity the principles that will be needed to achieve it.

Second, while the Declaration embraces an important variety of critical and even timeless values, I think it’s right that it starts with a focus on human rights. Today’s new Declaration rightly grounds this focus on an explicit reference to the Universal Declaration of Human Rights, adopted when the world’s nations came together in 1948. That Declaration was forged by a generation that had not only witnessed but won the most global and terrible war in human history. World War II had claimed the lives of more than 70 million people, more that 50 million of whom were civilians. The generation that won the war rightly came together a year later to sign the Fourth Geneva Convention and adopt one of the most important advances of the 20th century, the proposition that governments must protect civilians even in a time of war.

Almost 75 years later, our generation is being put to a new test. The war in Ukraine is being fought not only on the ground, in the air, and at sea, but literally on the internet as well. As we reported yesterday, the Russian military is waging the world’s first “hybrid war” by combining cyber and kinetic weapons, and, tragically, it is targeting, destroying and killing Ukrainian civilians. All of this is being coupled with a disinformation battle that is being fought on the internet on a global scale. Today’s new Declaration points not only to the urgent technology issues we must address to grapple with the war in Ukraine, but to the many varied human needs that require our generation to step forward and act collectively to protect human rights on the internet.

Finally, today’s Declaration rightly calls for the protection and strengthening of a multistakeholder system of internet governance. This reflects one of the big differences between the worlds of the 20th and 21st centuries. As technology has evolved, governmental leadership is as important as ever. But governments can neither manage the internet nor solve the world’s greatest problems by acting alone. We need new and innovative internet initiatives that bring governments together with NGOs, academic researchers, tech companies and many others from across the business community.

This decade will require that the tech sector mature and adapt to regulation. We equally will need governments that can work together more cohesively and effectively across borders. Today’s Declaration for the Future of the Internet should help inspire us all to help build a brighter future that will benefit the generations that will come after we are gone.

Any day that brings together so many countries to embrace principles of such vital importance is a good day indeed.

Tags: cyberattacks, cybersecurity, Government, Internet, Internet governance, Russia, Ukraine

Today, we released a report detailing the relentless and destructive Russian cyberattacks we’ve observed in a hybrid war against Ukraine, and what we’ve done to help protect Ukrainian people and organizations. We believe it’s important to share this information so that policymakers and the public around the world know what’s occurring, and so others in the security community can continue to identify and defend against this activity. All of this work is ultimately focused on protecting civilians from attacks that can directly impact their lives and their access to critical services.

Starting just before the invasion, we have seen at least six separate Russia-aligned nation-state actors launch more than 237 operations against Ukraine – including destructive attacks that are ongoing and threaten civilian welfare. The destructive attacks have also been accompanied by broad espionage and intelligence activities. The attacks have not only degraded the systems of institutions in Ukraine but have also sought to disrupt people’s access to reliable information and critical life services on which civilians depend, and have attempted to shake confidence in the country’s leadership. We have also observed limited espionage attack activity involving other NATO member states, and some disinformation activity. 

As today’s report details, Russia’s use of cyberattacks appears to be strongly correlated and sometimes directly timed with its kinetic military operations targeting services and institutions crucial for civilians. For example, a Russian actor launched cyberattacks against a major broadcasting company on March 1st, the same day the Russian military announced its intention to destroy Ukrainian “disinformation” targets and directed a missile strike against a TV tower in Kyiv. On March 13th, during the third week of the invasion, a separate Russian actor stole data from a nuclear safety organization weeks after Russian military units began capturing nuclear power plants sparking concerns about radiation exposure and catastrophic accidents. While Russian forces besieged the city of Mariupol, Ukrainians began receiving an email from a Russian actor masquerading as a Mariupol resident, falsely accusing Ukraine’s government of “abandoning” Ukrainian citizens.

The destructive attacks we’ve observed – numbering close to 40, targeting hundreds of systems – have been especially concerning: 32% of destructive attacks directly targeted Ukrainian government organizations at the national, regional and city levels. More than 40% of destructive attacks were aimed at organizations in critical infrastructure sectors that could have negative second-order effects on the Ukrainian government, military, economy and civilians. Actors engaging in these attacks are using a variety of techniques to gain initial access to their targets including phishing, use of unpatched vulnerabilities and compromising upstream IT service providers. These actors often modify their malware with each deployment to evade detection. Notably, our report attributes wiper malware attacks we previously disclosed to a Russian nation-state actor we call Iridium.

Today’s report also includes a detailed timeline of the Russian cyber-operations we’ve observed. Russia-aligned actors began pre-positioning for conflict as early as March 2021, escalating actions against organizations inside or allied with Ukraine to gain a larger foothold into Ukrainian systems. When Russian troops first started to move toward the border with Ukraine, we saw efforts to gain initial access to targets that could provide intelligence on Ukraine’s military and foreign partnerships. By mid-2021, Russian actors were targeting supply chain vendors in Ukraine and abroad to secure further access not only to systems in Ukraine but also NATO member states. In early 2022, when diplomatic efforts failed to de-escalate mounting tensions around Russia’s military build-up along Ukraine’s borders, Russian actors launched destructive wiper malware attacks against Ukrainian organizations with increasing intensity. Since the Russian invasion of Ukraine began, Russian cyberattacks have been deployed to support the military’s strategic and tactical objectives. It’s likely the attacks we’ve observed are only a fraction of activity targeting Ukraine.

Microsoft security teams have worked closely with Ukrainian government officials and cybersecurity staff at government organizations and private enterprises to identify and remediate threat activity against Ukrainian networks. In January of this year, when the Microsoft Threat Intelligence Center (MSTIC) discovered wiper malware in more than a dozen networks in Ukraine, we alerted the Ukrainian government and published our findings. Following that incident, we established a secure line of communication with key cyber officials in Ukraine to be sure that we could act rapidly with trusted partners to help Ukrainian government agencies, enterprises and organizations defend against attacks. This has included 24/7 sharing of threat intelligence and deployment of technical countermeasures to defeat the observed malware.

Given Russian threat actors have been mirroring and augmenting military actions, we believe cyberattacks will continue to escalate as the conflict rages. Russian nation-state threat actors may be tasked to expand their destructive actions outside of Ukraine to retaliate against those countries that decide to provide more military assistance to Ukraine and take more punitive measures against the Russian government in response to the continued aggression. We’ve observed Russian-aligned actors active in Ukraine show interest in or conduct operations against organizations in the Baltics and Turkey – all NATO member states actively providing political, humanitarian or military support to Ukraine. The alerts published by CISA and other U.S. government agencies, and cyber-officials in other countries, should be taken seriously and the recommended defensive and resilience measures should be taken – especially by government agencies and critical infrastructure enterprises. Our report includes specific recommendations for organizations that may be targeted by Russian actors as well as technical information for the cybersecurity community. We will continue to provide updates as we observe activity and believe we can safely disclose new developments.

Tags: cyberattacks, cybersecurity, Microsoft Threat Intelligence Center, Russia, Ukraine