Microsoft Wary Of China

New developments have made Microsoft wary of China. Microsoft asserted that China is stockpiling a number of unknown security flaws to use against its opponents in the West.

China’s laws have recently been amended to enable the government to keep newly discovered faults hidden from the public. According to a recent report from the company. Then, when the moment is right, it will be able to employ it against weak endpoints.

The Register adds that China passed a new rule in 2021. Requiring organizations to notify local authorities first if they find a defect before making it public. The Atlantic Council released a report on the effects of the move a year later. Noting that reports of vulnerabilities coming from China were decreasing but reports from anonymous sources were increasing.

Microsoft wary of China: “Extremely skilled” threat actors

According to Microsoft, “China-based attackers’ increasing use of zero days over the past year likely reflects the first full year of China’s vulnerability disclosure requirements for the Chinese security community and a big step in the exploitation of zero-day exploits as a state priority.”

The Redmond behemoth added that Chinese threat actors were “especially skilled” in identifying and exploiting zero-day flaws.

However, the 114-page research from Microsoft also discusses North Korea, Iran, and Russia in addition to China. The Russian government’s “relentless targeting” of the Ukrainian government and its critical infrastructure was the focus of the document. Iran “aggressively” sought to penetrate US critical infrastructure. Such as port authorities, as part of a larger war effort against its neighbor to the southwest.

On the other side, North Korea was seen continuing its effort of stealing cryptocurrencies from financial and technology firms to keep the government’s operations funded.

Although nation-state actors can be technically skilled and use a range of strategies, Microsoft said that good cyber hygiene can frequently lessen the impact of their attacks. Many of these actors don’t invest in creating specialized exploits or using targeted social engineering to accomplish their goals, preferring to use relatively low-tech methods, such as spear-phishing emails, to transmit sophisticated malware.