Data Privacy Weekly: Your Industry News Series

03. Chinese Hackers Breach US Government Emails in Microsoft Cloud Exploit

Chinese hackers breached US government emails through a Microsoft Cloud exploit, gaining unauthorized access to email accounts for a month before being detected. The breach, carried out by a China-based hacking group referred to as “Storm-0558,” targeted email systems for intelligence collection and impacted around 25 organizations, including government agencies in Western Europe and the US. Microsoft has implemented mitigations and is working with authorities to protect affected users, while the exact number of compromised organizations and government agencies remains undisclosed.

05. Hackers Exploit Windows Policy Loophole, Forge Kernel-Mode Driver Signatures

Hackers are exploiting a Windows policy loophole to forge signatures on kernel-mode drivers, primarily targeting Chinese-speaking threat actors. Cisco Talos reported that the attackers are using open-source tools to alter driver signing dates and load malicious drivers with expired certificates. Microsoft has taken steps to block all certificates and stated that no compromise of Microsoft accounts has been identified.

The weakness stems from an exception allowing cross-signed drivers under specific conditions. Threat actors use signature timestamp forging software to deploy thousands of unsigned drivers, bypassing Microsoft’s verification process. This method poses a significant threat, granting full access and compromising the system.