Microsoft shares latest intelligence on North Korean and Chinese threat actors at CYBERWARCON

Microsoft Threat Intelligence summarizes research presented at CYBERWARCON on nation-state activity: North Korean groups (Sapphire Sleet and Ruby Sleet) have conducted social-engineering-driven cryptocurrency theft, supply-chain compromises (including a backdoored VeraPort), distribution of backdoored VPNs and signed malware, and have used an organized network of remote IT workers to generate revenue and potentially access intellectual property; a China-aligned actor tracked as Storm-2077 conducts broad intelligence collection via phishing, credential harvesting, exploitation of edge devices, and cloud/email exfiltration across government, DIB, aviation, telecoms, and legal/financial sectors.