RCE Vulnerability Affecting Microsoft Defender
A remote attacker can exploit this vulnerability to take control of an affected system. This vulnerability was detected in exploits in the wild. Keep Reading
CISA Alert: Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments
CISA has also seen this APT actor utilizing additional credentials and Application Programming Interface (API) access to cloud resources of private and public sector organizations. Keep Reading
Group Behind Alleged Russia Hack Broke into Microsoft’s Internal Systems
Microsoft had previously said it was among thousands of companies that discovered malware on its systems after downloading a routine software update from the IT company SolarWinds containing a possible "backdoor" for hackers to gain access to sensitive company data. Keep Reading
Advice for Incident Responders on Recovery from Systemic Identity Compromises
Re-establishing trust in the organization’s on-premises and cloud environments with minimal business impact requires in-depth investigation and an understanding of potential methods of persistence. Keep Reading
CISA Releases Free Detection Tool for Azure/M365 Environment
CISA has created a free tool for detecting unusual and potentially malicious activity that threatens users and applications in an Azure/Microsoft O365 environment. Keep Reading
Suspected Russian Hacking Campaign Hit Over 40 Organizations, Microsoft Says
While many victims were government agencies, companies that contract with governments or think tanks and information and technology companies were also frequently hit, Microsoft found. Keep Reading
Microsoft Links Vietnamese State Hackers to Crypto-Mining Malware Campaign
Vietnamese government-backed hackers have been recently spotted deploying cryptocurrency-mining malware alongside their regular cyber-espionage toolkits, Microsoft said on Monday. Keep Reading
CIA Awards Secret Multibillion-Dollar Cloud Contract
The Central Intelligence Agency has awarded its long-awaited Commercial Cloud Enterprise, or C2E, contract to five companies—Amazon Web Services, Microsoft, Google, Oracle and IBM. Keep Reading
Microsoft Says Iranian Hackers Targeted ‘High Profile’ Conference Attendees
The group, known as Phosphorus (or APT35), sent spoofed emails masquerading as organizers of the Munich Security Conference, one of the main global security and policy conferences attended by heads of state, and the Think 20 Summit in Saudi Arabia. Keep Reading
NCSC Releases Alert on Microsoft SharePoint Vulnerability
An attacker could exploit this vulnerability to take control of an affected system. Applying patches from Microsoft’s October 2020 Security Advisory for CVE-2020-16952 can prevent exploitation of this vulnerability. Keep Reading
Microsoft Releases Security Updates to Address Remote Code Execution Vulnerabilities
Microsoft has released security updates to address remote code execution vulnerabilities affecting Windows Codecs Library and Visual Studio Code. An attacker could exploit these vulnerabilities to take control of an affected system. Keep Reading
Intact Partners Inc. Launches Intact Defense
New subsidiary Intact Defense will spearhead and facilitate the delivery of its 100% Microsoft cloud technology solutions to the Federal Government and Department of Defense. Keep Reading
ForgeRock Joins Microsoft Intelligent Security Association
ForgeRock announced it joined the Microsoft Intelligent Security Association (MISA), an ecosystem of independent software vendors that have integrated their solutions to better defend against a world of increasing threats. Keep Reading
CISA Releases Emergency Directive on Microsoft Windows Netlogon Remote Protocol
An unauthenticated attacker with network access to a domain controller could exploit this vulnerability to compromise all Active Directory identity services. Keep Reading
Abnormal Security Announces Alliance with Microsoft
Abnormal’s data science approach allows customers to deploy behavioral AI to stop sophisticated phishing, fraud and social engineering cyberattacks. Keep Reading
Defense Department Review Confirms JEDI Contract Award for Microsoft
However, the US Defense Department (DoD) said that “contract performance” by Microsoft (MSFT) will not start immediately due to the preliminary injunction order issued by the Court of Federal Claims on February 13. Keep Reading
Microsoft to Continue Discussions on Potential TikTok Purchase in the United States
It is committed to acquiring TikTok subject to a complete security review and providing proper economic benefits to the United States, including the United States Treasury. Keep Reading
Windows 10 Update Is Causing Critical Laptop Errors: What to Do Now
Meant as an important security update, KB4556799 is causing everything from the Blue Screen of Death to audio problems and temporary data loss. Keep Reading
CISA Issues Microsoft Office 365 Security Recommendations for Teleworkers
As organizations adapt or change their enterprise collaboration capabilities to meet “telework” requirements, many organizations are migrating to Microsoft Office 365 (O365) and other cloud collaboration services. Keep Reading
OIG Report Finds No Evidence of Political Bias in JEDI Contract Award
The Department of Defense's Inspector General released its report Wednesday examining the litany of legal controversies that have dogged the Joint Enterprise Defense Initiative (JEDI) cloud contract since its inception more than two years ago. Keep Reading