Introduction to the Threat Landscape

Most of the attacks (more than 90% according to GROUP-IB’s global experience) targeting organizations’ networks are run against Windows environments. It derives from the market dominance of the Microsoft Windows operating system, familiarity for most users in the world, software diversity in terms of it supporting a vast range of applications, backward compatibility, which makes it tough to eliminate several severe cybersecurity issues that were discovered in the past, and a bunch of legacy systems that don’t support the latest versions of these operating systems.

We (the authors) have been involved in hundreds of incident response engagements in many organizations on many continents of all sizes in a variety of industries, including government, the financial sector (banks, brokers, and cryptocurrency exchange), pharmacies and healthcare, critical industries, retail, construction, IT, and more, with different levels of cybersecurity maturity: where there were no cybersecurity teams to companies with huge security operations center (SOC) teams with dedicated roles covered by professionals with 10+ years of experience, automations and worked out like a Swiss watch. There is no silver bullet but there are some best practices that can be implemented to reduce – but not eliminate – cybersecurity risks.

This chapter explores the intricate web of threat intelligence levels, which can help organizations identify and categorize potential cyber threats targeting their Windows systems. In terms of all threat intelligence levels, we will discuss how they contribute to an organization’s overall cybersecurity posture.

We will also examine the main types of threat actors, their motivations, and the tactics they employ when targeting organizations with Windows environments.

Additionally, we will present real-world use cases that highlight the importance of understanding the cyber threat landscape, illustrating how organizations can proactively identify vulnerabilities, prioritize risks, and prepare for developing effective countermeasures for their Windows systems.

This chapter will cover the following topics:

• Getting familiar with the cyber threat landscape
• Types of threat actors and their motivations, including advanced persistent threats (APTs), cybercriminals, hacktivists, competitors, insider threats, terrorist groups, and script kiddies
• Building a cyber threat landscape

Let’s take a look!