Chinese Hackers

[kyonides]

Microsoft says it nixed China-linked hackers' apps from Azure cloud

https://www.cyberscoop.com/microsoft-apt...ium-azure/
I gotta admit I'm usually against MS for the way they make business or offer defective products, like the winspooler service for instance, but this time I'd have to state they took a wise decision.
Curiously MS also made a serious mistake by not declaring China was behind the attacks. Especially after other organizations have already linked APT40 to China.

The hacking group — labeled Gadolinium by Microsoft and also known as APT40 — was hosting apps on the Azure Active Directory and using open source tools “to enhance weaponization of their malware payload, attempt to gain command and control all the way to the server, and to obfuscate detection,” the researchers said in a report published Thursday.

APT40 has been linked to China’s government, and recent targets have reportedly included organizations in Taiwan and Malaysia. The typical goal is data exfiltration for espionage, according to researchers at FireEye, Kaspersky and other security companies. Microsoft’s report does not mention China by name, but notes that the hacking group has previously focused on the maritime and health industries.

“Because cloud services frequently offer a free trial or one-time payment (PayGo) account offerings, malicious actors have found ways to take advantage of these legitimate business offerings,” according to researchers Ben Koehl and Joe Hannon. “By establishing free or PayGo accounts, they can use cloud-based technology to create a malicious infrastructure that can be established quickly then taken down before detection or given up at little cost.”

Once again we get confirmation of an APT expanding its targets. It's not just the Trump administration, Microsoft is denouncing them as well. The cyber criminals are going after higher education and regional government organizations.