Bluepurple Pulse: week ending July 16th

Chinese actor #1 acquired Microsoft account (MSA) consumer signing key. Chinese actor #2 spotted and exploited a loophole in Microsoft Windows kernel driver singing - ye ha!

Welcome to the weekly highlights and analysis of the blueteamsec subreddit (and my wider reading). Not everything makes it in, but the best bits do.

Operationally this week it has been about the fact that a Chinese APT managed to forge authentication tokens through acquired a Microsoft account (MSA) consumer signing key leading e-mail access (see reporting below). That and the rash of vulnerabilities in web based file sharing platforms continues and the fact a Chinese threat actor found a loophole in Microsoft Windows Kernel driver signing. Our thoughts are with MSRC this week..

In the high-level this week:

• FACT SHEET: Biden-⁠Harris Administration Publishes the National Cybersecurity Strategy Implementation Plan - The Department of State will publish an International Cyberspace and Digital Policy Strategy that incorporates bilateral and multilateral activities. State will also work to catalyze the development of staff knowledge and skills related to cyberspace and digital policy that can…