Microsoft presents the global cybercrime counter programme for Europe

At the end of April, Microsoft announced a series of investments and initiatives in the Old Continent to underline its willingness to support European technological development. In the articulate speech, it started from the Cloud to cyber resilience, promising reliable and lasting support regardless of geopolitical turmoil. A little over a month later, here is the announcement in Berlin of the ambitious high-level cyber security programme, aimed mostly at European and state-level support. The European Security Program seeks to provide a more organised and coherent response to evolving cyber threats, both governmental (those conducted by state hackers) and criminal, and aims to strengthen the cyber resilience of European governments, consolidate defensive capabilities through strategic partnerships, and foster real-time intelligence sharing.

Europe is one of the main theatres of action for many cyber groups sponsored by states such as Russia, China, Iran and North Korea, each with their own peculiarities and modalities. The bulk of Russian operations these days, for instance and predictably, focus on targets related to Ukraine and nations supporting the Kiev government. China, on the other hand, has been increasingly targeting academic circles and strategic think tanks, with the aim of gaining access to sensitive research data. Iran and North Korea, for their part, are involved in digital espionage campaigns, often based on stealing credentials or using vulnerabilities to penetrate government or corporate networks, but the Pyongyang regime in particular does not disdain to pull off a few high-value ransomware attacks to oil its financial resources severely strained by the international embargo. As far as traditional cybercrime is concerned, i.e. that motivated exclusively by economic aims, it should be noted that it is becoming more and more organised and evolving with increasingly accessible and powerful ransomware-as-a-service models, making the cybercriminal's career within anyone's reach also thanks to the advent of AI, which is used extensively for reconnaissance activities, malware development, evasion of defences, script creation and targeted attacks.

The scenario is therefore very complex and the idea of tackling it in an organised manner is certainly worthy of praise. It is a little strange that such a well-articulated plan should come from a private entity (and even from outside the EC) instead of being developed by the supranational government. Going into detail, the plan has three main pillars on which to base its operations. The first is the extension of security information sharing with European governments. Besides providing up-to-date and customised data on national threats, Microsoft intends to offer operational insights generated with the support of AI. The information covers the tactics, techniques and procedures of APT groups (Advanced Persistent Threat, the most organised and powerful groups, often connected to governmental entities), including malicious uses of artificial intelligence.

The programme also includes access to the Cybercrime Threat Intelligence Program (CTIP), based on the work of Microsoft's Digital Crimes Unit, which provides timely information on the criminal infrastructure to support coordinated actions with law enforcement agencies. Equally central is the monitoring of foreign influence operations conducted by state hacker groups. These campaigns, which are increasingly supported by AI, are analysed by the Microsoft Threat Analysis Center, which offers detailed reports on platforms, narratives and methods used to alter public perception and undermine trust in democracy.

In addition, security communications, including vulnerabilities and patches, will be made available to programme partners in advance to increase situational awareness and shorten response times.