Bluepurple Pulse: week ending July 16th
Chinese actor #1 acquired Microsoft account (MSA) consumer signing key. Chinese actor #2 spotted and exploited a loophole in Microsoft Windows kernel driver singing - ye ha!
Welcome to the weekly highlights and analysis of the blueteamsec subreddit (and my wider reading). Not everything makes it in, but the best bits do.
Operationally this week it has been about the fact that a Chinese APT managed to forge authentication tokens through acquired a Microsoft account (MSA) consumer signing key leading e-mail access (see reporting below). That and the rash of vulnerabilities in web based file sharing platforms continues and the fact a Chinese threat actor found a loophole in Microsoft Windows Kernel driver signing. Our thoughts are with MSRC this week..
In the high-level this week:
FACT SHEET: Biden-Harris Administration Publishes the National Cybersecurity Strategy Implementation Plan - The Department of State will publish an International Cyberspace and Digital Policy Strategy that incorporates bilateral and multilateral activities. State will also work to catalyze the development of staff knowledge and skills related to cyberspace and digital policy that can…
Keep reading with a 7-day free trial
Subscribe to Cyber Defence Analysis for Blue & Purple Teams to keep reading this post and get 7 days of free access to the full post archives.