The new Microsoft security initiative update promises more sweeping changes. This move is also likely tied directly to the company's security woes and issues with cyber threats in 2023 and early 2024.
Microsoft has experienced another security lapse after inadvertently exposing employee credentials for accessing internal databases and systems via an unsecured Azure cloud server, which was accessible over the public Internet without a password for nearly a month after discovery.
The CSRB found that the security breach was preventable, and that a "a corporate culture that deprioritized enterprise security investments and rigorous risk management" ended up leaving open doors for the Chinese hackers.
Microsoft is now saying that the Russian hackers accessed "some" source code. And while customer-facing systems were not breached, the hackers accessed some confidential emails to customers.
Cybercriminals inserted malicious ads into Microsoft Bing Search AI chatbot to trick unsuspecting users into downloading trojanized software from spoofed domains.
Initial access broker with close links to ransomware groups is targeting organizations with Microsoft Teams phishing attacks, with malicious links leading to a malicious SharePoint-hosted file.
The data leak reportedly stems from the activity of two AI researchers, who had disk backups of their workstations exposed. This included some 30,000 messages with assorted Microsoft team members in addition to private keys, login credentials and internal secrets.
Microsoft has traced the signing key theft back to a "crash dump" error. A breach of a Microsoft engineer's work account by the Chinese hackers then yielded access to the crash dump and the embedded signing key.
Though Microsoft is hardly alone in terms of cloud services experiencing serious security breaches, a string of Redmond mishaps appears to have prompted new security reviews by the Cyber Safety Review Board (CSRB).
Microsoft's threat research team says that the Chinese hackers breached at least two dozen organizations in total, including government email accounts at multiple federal agencies. Campaign reportedly began in mid-May.
