Microsoft has published the annual analytical report of Microsoft Security Intelligence Report on threats in the Internet for the period from the first quarter of 2016 to the first quarter of 2017. According to the new report, the number of attacks aimed at hacking the credentials of users of cloud services tripled. The number of attempts to log into Microsoft accounts from malicious IP addresses has increased by 44% compared to data for 2015-2016. Attackers hack into user accounts using the selection method and re-use their credentials to enter other services. The report assumes that comparing the IP address of the requesting device with trusted IP addresses or trusted devices can reduce the risks of potential attacks.

The report also reports that organizations using cloud services are at greater risk. An attacker can create a foothold in the cloud infrastructure, compromising and controlling several virtual machines. These virtual machines can be designed to launch attacks, including brute force attacks, spam campaigns that can be used for phishing attacks, port scanning, and other malicious actions.

According to Microsoft, a large number of attacks on Azure services in the first quarter of 2017 were carried out from IP-addresses located in China and the United States, which amounted to 35.1% and 32.5% respectively. Korea took the third place - 3.1%. Compromised virtual machines are often used as C & C servers. In the first quarter of 2017, Microsoft recorded 89% of connections to compromised Azure virtual machines from IP addresses located in China.

Microsoft warns about infections by hidden file downloads (drive-by download). In March 2017, the Bing search engine found 0.17% of such infections per 1000 pages. The largest number of pages with hidden downloads was recorded in Taiwan (7.4% per 1000 addresses), Iran (1.5%) and Russia (0.6%). The lowest number was recorded in Luxembourg (0.001%), Kuwait (0.001%) and Belize (0.002).

The most popular exploit kits in the first half of 2016 were Angler (Axpergle) and Neutrino. In June and September 2016, they were replaced by a set of exploits RIG, which during the first three months of 2017 occupied the leading role in the exploit market.

The most popular vulnerabilities in the first quarter of 2017:.

-CVE-2017-0149 (Internet Explorer).

-CVE-2017-0144 (Windows SMB).

-CVE-2017-0005 (Windows GDI).