Microsoft news – Page 14

Posted on December 6, 2022 by — Leave a comment

How a threat actor launched targeted attacks against the cryptocurrency industry

Over the past several years, the cryptocurrency market has considerably expanded, gaining the interest of investors and threat actors. Cryptocurrency itself has been used by cybercriminals for their operations, notably for ransom payment in ransomware attacks, but we have also observed threat actors directly targeting organizations within the cryptocurrency industry for financial gain. Attacks targeting this market have taken many forms, including fraud, vulnerability exploitation, fake applications, and usage of info stealers, as attackers attempt to get their hands on cryptocurrency funds.

We are also seeing more complex attacks wherein the threat actor shows great knowledge and preparation, taking steps to gain their target’s trust before deploying payloads. For example, Microsoft recently investigated an attack where the threat actor, tracked as DEV-0139, took advantage of Telegram chat groups to target cryptocurrency investment companies. DEV-0139 joined Telegram groups used to facilitate communication between VIP clients and cryptocurrency exchange platforms and identified their target from among the members. The threat actor posed as representatives of another cryptocurrency investment company, and in October 2022 invited the target to a different chat group and pretended to ask for feedback on the fee structure used by cryptocurrency exchange platforms. The threat actor had a broader knowledge of this specific part of the industry, indicating that they were well prepared and aware of the current challenge the targeted companies may have.

After gaining the target’s trust, DEV-0139 then sent a weaponized Excel file with the name OKX Binance & Huobi VIP fee comparision.xls which contained several tables about fee structures among cryptocurrency exchange companies. The data in the document was likely accurate to increase their credibility. This weaponized Excel file initiates the following series of activities:

A malicious macro in the weaponized Excel file abuses UserForm of VBA to obfuscate the code and retrieve some data.
The malicious macro drops another Excel sheet embedded in the form and executes it in invisible mode. The said Excel sheet is encoded in base64, and dropped into C:\ProgramData\Microsoft Media\ with the name VSDB688.tmp
The file VSDB688.tmp downloads a PNG file containing three executables: a legitimate Windows file named logagent.exe, a malicious version of the DLL wsock32.dll, and an XOR encoded backdoor.
The file logagent.exe is used to sideload the malicious wsock32.dll, which acts as a DLL proxy to the legitimate wsock32.dll. The malicious DLL file is used to load and decrypt the XOR encoded backdoor that lets the threat actor remotely access the infected system.

diagram — Figure 1. Overview of the attack

Further investigation through our telemetry led to the discovery of another file that uses the same DLL proxying technique. But instead of a malicious Excel file, it is delivered in an MSI package for a CryptoDashboardV2 application, dated June 2022. This may suggest other related campaigns are also run by the same threat actor, using the same techniques.

In this blog post, we will present the details uncovered from our investigation of the attack against a cryptocurrency investment company, as well as analysis of related files, to help similar organizations understand this kind of threat, and prepare for possible attacks. Researchers at Volexity recently published their findings on this attack as well.

As with any observed nation state actor activity, Microsoft directly notifies customers that have been targeted or compromised, providing them with the information they need to secure their accounts. Microsoft uses DEV-#### designations as a temporary name given to an unknown, emerging, or a developing cluster of threat activity, allowing Microsoft Threat Intelligence Center (MSTIC) to track it as a unique set of information until we reach a high confidence about the origin or identity of the actor behind the activity. Once it meets the criteria, a DEV is converted to a named actor.

Initial compromise

To identify the targets, the threat actor sought out members of cryptocurrency investment groups on Telegram. In the specific attack, DEV-0139 got in touch with their target on October 19, 2022 by creating a secondary Telegram group with the name <NameOfTheTargetedCompany> <> OKX Fee Adjustment and inviting three employees. The threat actor created fake profiles using details from employees of the company OKX. The screenshot below shows the real accounts and the malicious ones for two of the users present in the group.

text — Figure 2. Legitimate profiles of cryptocurrency exchange employees (left) and fake profiles created by the threat actor (right)

It’s worth noting that the threat actor appears to have a broad knowledge of the cryptocurrency industry and the challenges the targeted company may face. The threat actor asked questions about fee structures, which are the fees used by crypto exchange platforms for trading. The fees are a big challenge for investment funds as they represent a cost and must be optimized to minimize impact on margin and profits. Like many other companies in this industry, the largest costs come from fees charged by exchanges. This is a very specific topic that demonstrates how the threat actor was advanced and well prepared before contacting their target.

After gaining the trust of the target, the threat actor sent a weaponized Excel document to the target containing further details on the fees to appear legitimate. The threat actor used the fee structure discussion as an opportunity to ask the target to open the weaponized Excel file and fill in their information.

Weaponized Excel file analysis

The weaponized Excel file, which has the file name OKX Binance & Huobi VIP fee comparision.xls (Sha256: abca3253c003af67113f83df2242a7078d5224870b619489015e4fde060acad0), is well crafted and contains legitimate information about the current fees used by some crypto exchanges. The metadata extracted showed that the file was created by the user Wolf:

File name	OKX Binance & Huobi VIP fee comparision.xls
CompObjUserTypeLen	31
CompObjUserType	Microsoft Excel 2003 Worksheet
ModifyDate	2022:10:14 02:34:33
TitleOfParts	Comparison_Oct 2022
SharedDoc	No
Author	Wolf
CodePage	Windows Latin 1 (Western European)
AppVersion	16
LinksUpToDate	No
ScaleCrop	No
LastModifiedBy	Wolf
HeadingPairs	Worksheets, 1
FileType	XLS
FileTypeExtension	xls
HyperlinksChanged	No
Security	None
CreateDate	2022:10:14 02:34:31
Software	Microsoft Excel
MIMEType	application/vnd.ms-excel

graphical user interface, application, Excel — Figure 3. The information in the malicious Excel file

The macro is obfuscated and abuses UserForm (a feature used to create windows) to store data and variables. In this case, the name of the UserForm is IFUZYDTTOP, and the macro retrieves the information with the following code IFUZYDTTOP.MgQnQVGb.Caption where MgQnQVGb is the name of the label in the UserForm and .caption allows to retrieve the information stored into the UserForm.

The table below shows the data retrieved from the UserForm:

Obfuscated data	Original data
IFUZYDTTOP.nPuyGkKr.Caption & IFUZYDTTOP.jpqKCxUd.Caption	MSXML2.DOMDocument
IFUZYDTTOP.QevjtDZF.Caption	b64
IFUZYDTTOP.MgQnQVGb.Caption	bin.base64
IFUZYDTTOP.iuiITrLG.Caption	Base64 encoded Second Worksheet
IFUZYDTTOP.hMcZvwhq.Caption	C:\ProgramData\Microsoft Media
IFUZYDTTOP.DDFyQLPa.Caption	\VSDB688.tmp
IFUZYDTTOP.PwXgwErw.Caption & IFUZYDTTOP.ePGMifdW.Caption	Excel.Application

The macro retrieves some parameters from the UserForm as well as another XLS file stored in base64. The XLS file is dropped into the directory C:\ProgramData\Microsoft Media as VSDB688.tmp and runs in invisible mode.

Additionally, the main sheet in the Excel file is protected with the password dragon to encourage the target to enable the macros. The sheet is then unprotected after installing and running the other Excel file stored in Base64. This is likely used to trick the user to enable macros and not raise suspicion.

Extracted worksheet

The second Excel file, VSDB688.tmp (Sha256: a2d3c41e6812044573a939a51a22d659ec32aea00c26c1a2fdf7466f5c7e1ee9), is used to retrieve a PNG file that is parsed later by the macro to extract two executable files and the encrypted backdoor. Below is the metadata for the second worksheet:

File Name	VSDB688.tmp
CompObjUserType	Microsoft Excel 2003 Worksheet
ModifyDate	2022:08:29 08:07:24
TitleOfParts	Sheet1
SharedDoc	No
CodePage	Windows Latin 1 (Western European)
AppVersion	16
LinksUpToDate	No
ScaleCrop	No
CompObjUserTypeLen	31
HeadingPairs	Worksheets, 1
FileType	XLS
FileTypeExtension	xls
HyperlinksChanged	No
Security	None
CreateDate	2006:09:16 00:00:00
Software	Microsoft Excel
MIMEType	application/vnd.ms-excel

graphical user interface, application — Figure 5. The second file is completely empty but contains the same UserForm abuse technique as the first stage.

The table below shows the deobfuscated data retrieved from the UserForm:

Obfuscated data	Original data
GGPJPPVOJB.GbEtQGZe.Caption & GGPJPPVOJB.ECufizoN.Caption	MSXML2.DOMDocument
GGPJPPVOJB.BkxQNjsP.Caption	b64
GGPJPPVOJB.slgGbwvS.Caption	bin.base64
GGPJPPVOJB.kiTajKHg.Caption	C:\ProgramData\SoftwareCache\
GGPJPPVOJB.fXSPzIWf.Caption	logagent.exe
GGPJPPVOJB.JzrHMGPQ.Caption	wsock32.dll
GGPJPPVOJB.pKLagNSW.Caption	56762eb9-411c-4842-9530-9922c46ba2da
GGPJPPVOJB.grzjNBbk.Caption	/shadow
GGPJPPVOJB.aJmXcCtW.Caption & GGPJPPVOJB.zpxMSdzi.Caption	MSXML2.ServerXMLHTTP.6.0
GGPJPPVOJB.rDHwJTxL.Caption	Get

The macro retrieves some parameters from the UserForm then downloads a PNG file from hxxps://od.lk/d/d021d412be456a6f78a0052a1f0e3557dcfa14bf25f9d0f1d0d2d7dcdac86c73/Background.png. The file was no longer available at the time of analysis, indicating that the threat actor likely deployed it only for this specific attack.

The PNG is then split into three parts and written in three different files: the legitimate file logagent.exe, a malicious version of wsock32.dll, and the XOR encrypted backdoor with the GUID (56762eb9-411c-4842-9530-9922c46ba2da). The three files are used to load the main payload to the target system.

Loader analysis

Two of the three files extracted from the PNG file, logagent.exe and wsock32.dll, are used to load the XOR encrypted backdoor. The following sections present our in-depth analysis of both files.

Logagent.exe

Logagent.exe (Hash: 8400f2674892cdfff27b0dfe98a2a77673ce5e76b06438ac6110f0d768459942) is a legitimate system application used to log errors from Windows Media Player and send the information for troubleshooting.

The file contains the following metadata, but it is not signed:

Description	Value
language	English-US
code-page	Unicode UTF-16 little endian
CompanyName	Microsoft Corporation
FileDescription	Windows Media Player Logagent
FileVersion	12.0.19041.746
InternalName	logagent.exe
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	logagent.exe
ProductName	Microsoft® Windows® Operating System
ProductVersion	12.0.19041.746

The logagent.exe imports function from the wsock32.dll which is abused by the threat actor to load malicious code into the targeted system. To trigger and run the malicious wsock32.dll, logagent.exe is run with the following arguments previously retrieved by the macro: 56762eb9-411c-4842-9530-9922c46ba2da /shadow. Both arguments are then retrieved by wsock32.dll. The GUID 56762eb9-411c-4842-9530-9922c46ba2da is the filename for the malicious wsock32.dll to load and /shadow is used as an XOR key to decrypt it. Both parameters are needed for the malware to function, potentially hindering isolated analysis.

graphical user interface, text, application, email — Figure 8. Command line execution from the running process logagent.exe

Wsock32.dll

The legitimate wsock32.dll is the Windows Socket API used by applications to handle network connections. In this attack, the threat actor used a malicious version of wsock32.dll to evade detection. The malicious wsock32.dll is loaded by logagent.exe through DLL side-loading and uses DLL proxying to call the legitimate functions from the real wsock32.dll and avoid detection. DLL proxying is a hijacking technique where a malicious DLL sits in between the application calling the exported function and a legitimate DLL that implements that exported function. In this attack, the malicious wsock32.dll acts as a proxy between logagent.exe and the legitimate wsock32.dll.

It is possible to notice that the DLL is forwarding the call to the legitimate functions by looking at the import address table:

When the malicious wsock32.dll is loaded, it first retrieves the command line, and checks if the file with the GUID as a filename is present in the same directory using the CreateFile API to retrieve a file handle.

The malicious wsock32.dll loads and decodes the final implant into the memory with the GUID name which is used to remote access the infected machine.

SHA256	2e8d2525a523b0a47a22a1e9cc9219d6526840d8b819d40d24046b17db8ea3fb
Imphash	52ff8adb6e941e2ce41fd038063c5e0e
Rich PE Hash	ff102ff1ac1c891d1f5be7294035d19e
Filetype	PE32+ DLL
Compile Timestamp	2022-08-29 06:33:10 UTC

Once the file is loaded into the memory, it gives remote access to the threat actor. At the time of the analysis, we could not retrieve the final payload. However, we identified another variant of this attack and retrieved the payload, which is discussed in the next section. Identified implants were connecting back to the same command-and-control (C2) server.

Related attack

We identified another file using a similar mechanism as logagent.exe and delivering the same payload. The loader is packaged as an MSI package and as posed an application called CryptoDashboardV2 (Hash: e5980e18319027f0c28cd2f581e75e755a0dace72f10748852ba5f63a0c99487). After installing the MSI, it uses a legitimate application called tplink.exe to sideload the malicious DLL called DUser.dll and uses DLL proxying as well.

creation datetime	11/12/2009 11:47
author	168 Trading
title	Installation Database
page count	200
word count	2
keywords	Installer, MSI, Database
last saved	11/12/2009 11:47
revision number	{30CD8B94-5D3C-4B55-A5A3-3FC9C7CCE6D5}
last printed	11/12/2009 11:47
application name	Advanced Installer 14.5.2 build 83143
subject	CryptoDashboardV2
template	x64;1033
code page	Latin I
comments	This installer database contains the logic and data required to install CryptoDashboardV2.

Figure 12. Installation details of the MSI file

Once the package is installed, it runs and side-loads the DLL using the following command: C:\Users\user\AppData\Roaming\Dashboard_v2\TPLink.exe” 27E57D84-4310-4825-AB22-743C78B8F3AA /sven, where it noticeably uses a different GUID.

Further analysis of the malicious DUser.dll showed that its original name is also HijackingLib.dll, same as the malicious wsock32.dll. This could indicate the usage of the same tool to create these malicious DLL proxies. Below are the file details of DUser.dll:

SHA256	90b0a4c9fe8fd0084a5d50ed781c7c8908f6ade44e5654acffea922e281c6b33
Imphash	52ff8adb6e941e2ce41fd038063c5e0e
Rich PE Hash	ff102ff1ac1c891d1f5be7294035d19e
Filetype	Win32 DLL
Compile Timestamp	2022-06-20 07:47:07 UTC

Once the DLL is running, it loads and decodes the implant in the memory and starts beaconing the same domain. In that case, the implant is using the GUID name 27E57D84-4310-4825-AB22-743C78B8F3AA and the XOR key /sven.

Implant analysis

The payload decoded in the memory by the malicious DLL is an implant used by the threat actor to remotely access the compromised machine. We were able to get the one from the second variant we uncovered. Below are the details of the payload:

SHA256	ea31e626368b923419e8966747ca33473e583376095c48e815916ff90382dda5
Imphash	96321fa09a450119a8f0418ec86c3e08
Rich PE Hash	8c4fb0cb671dbf8d859b875244c4730c
Filetype	Win32 DLL
Compile Timestamp	2022-06-20 00:51:33 UTC

First, the sample retrieves some information from the targeted system. It can connect back to a remote server and receive commands from it.

graphical user interface, text, application, chat or text message — Figure 14. The sample is connecting back to the domain name *strainservice[.]com*.

Infrastructure

It is interesting to notice that the threat actor abused OpenDrive in one of the variants to deliver the payload. The OpenDrive account has been set up quickly for a one shot, indicating that it was created for only one target.

We identified one domain used as C2 server, strainservice[.]com and connected back to the two implants. This domain was registered on June 26 on Namecheap, just before the distribution of the first variant. At the time of the attack, the server had port 80, 443, and 2083. The implants were communicated on port 443.

Defending against targeted attacks

In this report we analyzed a targeted attack on cryptocurrency investment fund startups. Such companies are relatively new, but manage hundreds of millions of dollars, raising interest by threat actors.

In this attack we identified that the threat actor has broad knowledge of the cryptocurrency industry as well as the challenges their targets may face, increasing the sophistication of the attack and their chance of success. The threat actor used Telegram, an app widely used in the field, to identify the profile of interest, gained the target’s trust by discussing relevant topics, and finally sent a weaponized document that delivered a backdoor through multiple mechanisms. Additionally, the second attack identified was luring a fake crypto dashboard application.

The cryptocurrency market remains a field of interest for threat actors. Targeted users are identified through trusted channels to increase the chance of success. While the biggest companies can be targeted, smaller companies can also be targets of interest. The techniques used by the actor covered in this blog can be mitigated by adopting the security considerations provided below:

Use the included indicators of compromise to investigate whether they exist in your environment and assess for potential intrusion.
Educate end users about protecting personal and business information in social media, filtering unsolicited communication (in this case, Telegram chat groups), identifying lures in spear-phishing email and watering holes, and reporting of reconnaissance attempts and other suspicious activity.
Educate end users about preventing malware infections, such as ignoring or deleting unsolicited and unexpected emails or attachments sent via instant messaging applications or social networks. Encourage end users to practice good credential hygiene and make sure the Microsoft Defender Firewall (which is enabled by default) is always on to prevent malware infection and stifle propagation.
Change Excel macro security settings to control which macros run and under what circumstances when you open a workbook. Customers can also stop malicious XLM or VBA macros by ensuring runtime macro scanning by Antimalware Scan Interface (AMSI) is on. This feature—enabled by default—is on if the Group Policy setting for Macro Run Time Scan Scope is set to “Enable for All Files” or “Enable for Low Trust Files”.
Turn on attack surface reduction rules to prevent common attack techniques observed in this threat:
- Block Office applications from creating executable content
- Block Office communication application from creating child processes
- Block Win32 API calls from Office macros
Ensure that Microsoft Defender Antivirus is up to date and that real-time behavior monitoring is enabled.

Detection details

Microsoft Defender Antivirus

Microsoft Defender Antivirus detects threat components as the following malware:

TrojanDownloader:O97M/Wolfic.A
TrojanDownloader:O97M/Wolfic.B
TrojanDownloader:O97M/Wolfic.C
TrojanDownloader:Win32/Wolfic.D
TrojanDownloader:Win32/Wolfic.E
Behavior:Win32/WolficDownloader.A
Behavior:Win32/WolficDownloader.B

Microsoft Defender for Endpoint

Alerts with the following titles in the security center can indicate threat activity on your network:

An executable loaded an unexpected dll
DLL search order hijack
‘Wolfic’ malware was prevented

Advanced hunting queries

The following hunting queries locate relevant activity.

Query that looks for Office apps that create a file within one of the known bad directories:

DeviceFileEvents
| where InitiatingProcessFileName has_any ("word", "excel", "access", "outlook" "powerpnt")
| where ActionType == "FileCreated"
| where parse_path( FolderPath ).DirectoryPath has_any( @"C:\ProgramData\Microsoft Media", @"C:\ProgramData\SoftwareCache", @"Roaming\Dashboard_v2" )
| project Timestamp, DeviceName, FolderPath, InitiatingProcessFileName, SHA256, InitiatingProcessAccountName, InitiatingProcessAccountDomain

Query that looks for Office apps that create a file within an uncommon directory (less that five occurrences), makes a set of each machine this is seen on, and each user that has executed it to help look for how many users/hosts are compromised:

DeviceFileEvents
| where InitiatingProcessFileName has_any ("word", "excel", "access", "outlook", "powerpnt")
| where ActionType == "FileCreated"
| extend Path = tostring(parse_path(FolderPath).DirectoryPath)
| summarize PathCount=count(), DeviceList=make_set(DeviceName), AccountList=make_set(InitiatingProcessAccountName) by FileName, Path, InitiatingProcessFileName, SHA256
| where PathCount < 5

Query that summarizes child process of Office apps, looking for less than five occurrences:

DeviceProcessEvents
| where InitiatingProcessFileName has_any ("word", "excel", "access", "powerpnt")
| summarize ProcessCount=count(), DeviceList=make_set(DeviceName), AccountList=make_set(InitiatingProcessAccountName) by FileName, FolderPath, SHA256, InitiatingProcessFileName
| where ProcessCount < 5

Query that lists of all executables with Microsoft as ProcessVersionInfoCompanyName, groups them together by path, then looks for uncommon paths, with less than five occurrences:

DeviceProcessEvents
| where ProcessVersionInfoCompanyName has "Microsoft"
| extend Path = tostring(parse_path(FolderPath).DirectoryPath)
| summarize ProcessList=make_set(FileName) by Path
| where array_length( ProcessList ) < 5

Query that searches for connections to malicious domains and IP addresses:

DeviceNetworkEvents
| where (RemoteUrl has_any ("strainservice.com")) or (RemoteIP has_any ("198.54.115.248"))

Query that searches for files downloaded from malicious domains and IP addresses.

DeviceFileEvents
| where (FileOriginUrl has_any ("strainservice.com")) or (FileOriginIP has_any ("198.54.115.248"))

Query that searchers for Office apps downloading files from uncommon domains, groups users, filenames, and devices together:

DeviceFileEvents
| where InitiatingProcessFileName has_any ("word", "excel", "access", "powerpnt")
| where ActionType == "FileCreated"
| where isnotempty( FileOriginUrl ) or isnotempty( FileOriginIP )
| summarize DomainCount=count(), UserList=make_set(InitiatingProcessAccountName), DeviceList=make_set(DeviceName), FileList=make_set(FileName) by FileOriginUrl, FileOriginIP, InitiatingProcessFileName

Looks for downloaded files with uncommon file extensions, groups remote IPs, URLs, filenames, users, and devices:

DeviceFileEvents
| where InitiatingProcessFileName has_any ("word", "excel", "access", "powerpnt", "outlook")
| where ActionType == "FileCreated"
| where isnotempty( FileOriginUrl ) or isnotempty( FileOriginIP )
| extend Extension=tostring(parse_path(FolderPath).Extension)
| extend Path=tostring(parse_path(FolderPath).DirectoryPath)
| summarize ExtensionCount=count(), IpList=make_set(FileOriginIP), UrlList=make_set(FileOriginUrl), FileList=make_set(FileName), UserList=make_set(InitiatingProcessAccountName), DeviceList=make_set(DeviceName) by Extension, InitiatingProcessFileName

Looks for Office apps that have child processes that match the GUID command line, with a check for Microsoft binaries to reduce the results before the regex:

DeviceProcessEvents
| where InitiatingProcessFileName has_any ("word", "excel", "access", "powerpnt")
| where ProcessVersionInfoCompanyName has "Microsoft"
| where ProcessCommandLine matches regex @"[A-Za-z0-9]+\.exe [A-Za-z0-9]{8}-[A-Za-z0-9]{4}-[A-Za-z0-9]{4}-[A-Za-z0-9]{4}-[A-Za-z0-9]{12} /[A-Za-z0-9]$"

Microsoft Sentinel

Microsoft Sentinel customers can use the TI Mapping analytic to automatically match the malicious IP and domain indicators mentioned in this blog post with data in their workspace. If the TI Map analytics are not currently deployed, customers can install the Threat Intelligence solution from the Microsoft Sentinel Content Hub to have the analytics rule deployed in their Sentinel workspace. More details on the Content Hub can be found here: https://learn.microsoft.com/azure/sentinel/sentinel-solutions-deploy

To supplement this indicator matching customers can use the Advanced Hunting queries listed above against Microsoft 365 Defender data ingested into their workspaces as well as the following Microsoft Sentinel queries:

Indicators of compromise

IOC	Filename/Type	Description
abca3253c003af67113f83df2242a7078d5224870b619489015e4fde060acad0	OKX Binance & Huobi VIP fee comparision.xls	Weaponized Excel file
17e6189c19dedea678969e042c64de2a51dd9fba69ff521571d63fd92e48601b	OKX Binance & Huobi VIP fee comparision.xls	Weaponized Excel file
a2d3c41e6812044573a939a51a22d659ec32aea00c26c1a2fdf7466f5c7e1ee9	VSDB688.tmp	Second worksheet dropped
2e8d2525a523b0a47a22a1e9cc9219d6526840d8b819d40d24046b17db8ea3fb	wsock32.dll / HijackingLib.dll	Malicious dropper that acts as a DLL proxy to legit wsock32.dll
82e67114d632795edf29ce1d50a4c1c444846d9e16cd121ce26e63c8dc4a1629	Duser.dll
90b0a4c9fe8fd0084a5d50ed781c7c8908f6ade44e5654acffea922e281c6b33	Duser.dll / HijackingLib.dll	Malicious dropped that acts as a DLL proxy to the legit Duser.dll
e5980e18319027f0c28cd2f581e75e755a0dace72f10748852ba5f63a0c99487	4acbe3.msi	Fake CryptoDashboard application MSI package delivering Duser.dll
82e67114d632795edf29ce1d50a4c1c444846d9e16cd121ce26e63c8dc4a1629	43d972.msi	Second fake application BloxHolder delviering Duser.dll
ea31e626368b923419e8966747ca33473e583376095c48e815916ff90382dda5	DLL	Implant loaded by Duser.dll
C:\ProgramData\SoftwareCache\wsock32.dll	Path	Path of wsock32.dll
C:\Users\user\AppData\Roaming\Dashboard_v2\DUser.dll	Path	Path of Duser.Dll
C:\Program Files\CryptoDashboardV2\	Path	Path of the fake app
C:\ProgramData\Microsoft Media\VSDB688.tmp	Path	Path of the second worksheet
hxxps://od.lk/d/d021d412be456a6f78a0052a1f0e3557dcfa14bf25f9d0f1d0d2d7dcdac86c73/Background.png	Background.png downloaded from OpenDrive	Png file downloaded on the victim machines
strainservice.com	Domain/C2	Command and control server
198.54.115.248	IP/C2	IP of the C2
56762eb9-411c-4842-9530-9922c46ba2da	GUID	GUID used
27E57D84-4310-4825-AB22-743C78B8F3AA	GUID	GUID used
TPLink.exe” 27E57D84-4310-4825-AB22-743C78B8F3AA /sven	Command line	Command line runs by the legit exe
logagent.exe 56762eb9-411c-4842-9530-9922c46ba2da /shadow	Command line	Command line runs by the legit file

MITRE ATT&CK techniques

Tactics	Technique ID	Name	Description
Reconnaissance	T1591	Gather Victim Org Information	The attackers gathered information about the targets reaching them on Telegram with a clear understanding of their challenges.
	T1593.001	Social Media	Attackers identified the targets on specific crypto currencies group on Telegram.
Resource Development	T1583.001	Acquire Infrastructure: Domains	Attackers registered the domain “strainservice.com” on June 18
Initial Access	T1566.001	Spearphishing Attachment	Attackers sent a weaponized Excel document. Execution
Execution	T1204.002	User Execution: Malicious File	The targeted user must open the weaponized Excel document and enable macros.
	T1059.005	Command and Scripting Interpreter: Visual Basic	Attackers used VBA in the malicious excel document “OKX Binance & Huobi VIP fee comparision.xls” to deliver the implant.
	T1106	Native API	Usage of CreateProcess API in the excel document to run the executable.
Persistence, Privilege Escalation, Defense Evasion	T1574.002	DLL side-Loading	The attackers abused the legitimate Logagent.exe to side-load the malicious wsock32.dll and the legitimate TPLink.Exe to side load Duser.dll
Defense Evasion	T1027	Obfuscated file or information	The malicious VBA is obfuscated using UserForm to hide variable and data.
	T1036.005	Masquerading: Match Legitimate Name or Location	The attackers are using legitimate DLL name that acts as DLL Proxy to the original one (wsock32.dll and Duser.dll).
	T1027.009	Obfuscated Files or Information: Embedded Payloads	The malicious DLL are dropping the implant into the machine.
Command & Control	T1071.001	Application Layer Protocol: Web Protocols	The implant is communicating to the remote domain through port 80 or 443.
	T1132	Data Encoding	The implant is encoding the data exchanged with the C2.
Exfiltration	T1041	Exfiltration over C2 channel	The implant has the ability to exfiltrate information.

Posted on December 6, 2022 by — Leave a comment

A conversation with Kevin Scott: What’s next in AI

For example, I’ve been playing around with an experimental system I built for myself using GPT-3 designed to help me write a science fiction book, which is something that I’ve wanted to do since I was a teenager. I have notebooks full of synopses I’ve created for theoretical books, describing what the books are about and the universes where they take place. With this experimental tool, I have been able to get the logjam broken. When I wrote a book the old-fashioned way, if I got 2,000 words out of a day, I’d feel really good about myself. With this tool, I’ve had days where I can write 6,000 words in a day, which for me feels like a lot. It feels like a qualitatively more energizing process than what I was doing before.

This is the “copilot for everything” dream—that you would have a copilot that could sit alongside you as you’re doing any kind of cognitive work, helping you not just get more done, but also enhancing your creativity in new and exciting ways.

This increase in productivity is clearly a boost to your satisfaction. Why do these tools bring more joy to work?

All of us use tools to do our work. Some of us really enjoy acquiring the tools and mastering them and figuring out how to deploy them in a super effective way to do the thing that we’re trying to do. I think that is part of what’s going on here. In many cases, people now have new and interesting and fundamentally more effective tools than they’ve had before. We did a study that found using no-code or low-code tools led to more than an 80% positive impact on work satisfaction, overall workload and morale by users. Especially for tools that are in their relatively early stages, that’s just a huge benefit to see.

For some workers, it’s literally enhancing that core flow that you get into when you’re doing the work; it speeds you up. It’s like having a better set of running shoes to go run a race or marathon. This is exactly what we’re seeing with the experiences developers are having with Copilot; they are reporting that Copilot helps them stay in the flow and keeps their minds sharper during what used to be boring and repetitive tasks. And when AI tools can help to eliminate drudgery from a job, something that is super repetitive or annoying or that was getting in their way of getting to the thing that they really enjoy, it unsurprisingly improves satisfaction.

Personally, these tools let me be in flow state longer than I was before. The enemy of creative flow is distraction and getting stuck. I get to a point where I don’t know quite how to solve the next thing, or the next thing is, like, “I’ve got to go look this thing up. I’ve got to context switch out of what I was doing to go solve the subproblem.” These tools increasingly solve the subproblem for me so that I stay in the flow.

In addition to GitHub Copilot and DALL∙E 2, AI is showing up in Microsoft products and services in other ways. How is next-generation AI improving current products such as Teams and Word?

This is the big untold story of AI. To date, most of AI’s benefits are spread across 1,000 different things where you may not even fully appreciate how much of the product experience that you’re getting is coming from a machine learned system.

For example, we’re sitting here in this Teams call on video and, in the system, there are all these parameters that were learned by a machine learning algorithm. There are jitter buffers for the audio system to smooth out the communication. The blur behind you on your screen is a machine learning algorithm at work. There are more than a dozen machine learning systems that make this experience more delightful for the both of us. And that is certainly true across Microsoft.

We’ve gone from machine learning in a few places to literally 1,000 machine learning things spread across different products, everything from how your Outlook email client works, your predictive text in Word, your Bing search experience, to what your feed looks like in Xbox Cloud Gaming and LinkedIn. There’s AI all over the place making these products better.

One of the big things that has changed in the past two years is it used to be the case that you would have a model that was specialized to each one of these tasks that we have across all our products. Now you have a single model that gets used in lots of places because they’re broadly useful. Being able to invest in these models that become more powerful with scale—and then having all the things built on top of the model benefit simultaneously from improvements that you’re making—is tremendous.

Microsoft’s AI research and development continues through initiatives such as AI4Science and AI for Good. What excites you most about this area of AI?

The most challenging problems we face as a society right now are in the sciences. How do you cure these intractably complicated diseases? How do you prepare yourself for the next pandemic? How do you provide affordable, high-quality healthcare to an aging population? How do you help educate more kids at scale in the skills that they will need for the future? How do you develop technologies that will reverse some of the negative effects of carbon emissions into the atmosphere? We’re exploring how to take some of these exciting developments in AI to those problems.

The models in these basic science applications have the same scaling properties as large language models. You build a model, you get it into some self-supervised mode where it’s learning from a simulation or it’s learning from its own ability to observe a particular domain, and then the model that you get out of it lets you dramatically change the performance of an application—whether you’re doing a computational fluid dynamics simulation or you’re doing molecular dynamics for drug design.

There’s immense opportunity there. This means better medicines, it means maybe we can find the catalyst we don’t have yet to fix our carbon emission problem, it means across the board accelerating how scientists and other folks with big ideas can work to try to solve society’s biggest challenges.

How have breakthroughs in computing techniques and hardware contributed to the advances in AI?

The fundamental thing underlying almost all of the recent progress we’ve seen in AI is how critical the importance of scale has proven to be. It turns out that models trained on more data with more compute power just have a much richer and more generalized set of capabilities. If we want to keep driving this progress further—and to be clear, right now we don’t see any end to the benefits of increased scale—we need to optimize and scale up our compute power as much as we possibly can.

We announced our first Azure AI supercomputer two years ago, and at our Build developer conference this year I shared that we now have multiple supercomputing systems that we’re pretty sure are the largest and most powerful AI supercomputers in the world today. We and OpenAI use this infrastructure to train nearly all of our state-of-the-art large models, whether that’s our Turing, Z-code and Florence models at Microsoft or the GPT, DALL∙E and Codex models at OpenAI. And we just recently announced a collaboration with NVIDIA to build a supercomputer powered by Azure infrastructure combined with NVIDIA GPUs.

Some of this progress has just been via brute force compute scale with bigger and bigger clusters of GPUs. But maybe even a bigger breakthrough is the layer of software that optimizes how models and data are distributed across these giant systems, both to train the models and then to serve them to customers. If we’re going to put forth these large models as platforms that people can create with, they can’t only be accessible to the tiny number of tech companies in the world with enough resources to build giant supercomputers.

So, we’ve invested a ton in software like DeepSpeed to boost training efficiency, and the ONNX Runtime for inference. They optimize for cost and latency and generally help us make bigger AI models more accessible and valuable for people. I’m super proud of the teams we have working on these technologies because Microsoft is really leading the industry here, and we’re open sourcing all of it so others can keep improving.

These advances are all playing out amid an ongoing concern that AI is going to impact jobs. How do you think about the issue of AI and jobs?

We live in a time of extraordinary complexity and historic macroeconomic change, and as we look out 5, 10 years into the future, even to just achieve a net neutral balance for the whole world, we’re going to need new forms of productivity for all of us to be able to continue enjoying progress. We want to be building these AI tools as platforms that lots of people can use to build businesses and solve problems. We believe that these platforms democratize access to AI to far more people. With them, you’ll get a richer set of problems solved and you’ll have a more diverse group of people being able to participate in the creation of technology.

With the previous instantiation of AI, you needed a huge amount of expertise just to get started. Now you can call Azure Cognitive Services, you can call the Azure OpenAI Service and build complicated products on top of these things without necessarily having to be so expert at AI that you’ve got to be able to train your own large model from scratch.

Posted on December 6, 2022 by — Leave a comment

Celebrate Dec. 5-11 CSEd Week with Microsoft Education

Computer science (CS) shapes how people live and work. From designing mobile games played by millions to exploring new renewable energy solutions, technology is transforming our world, and to build technology solutions, you need to know computer science. Its prevalence and value make CS an important instructional topic in all K-12 classrooms as well as a potential career opportunity for high school graduates. Research indicates that coding activities result in higher test scores in reading and math, and the number of computer science job openings is expected to grow 15% from 2021 to 2031 according to the U.S. Bureau of Labor Statistics. Realizing the transformative role of computer science begins with K-12 education and increasing student interest at a young age. Microsoft is committed to providing equitable, accessible, and engaging computer science education experiences for all students.

From December 5-11, classrooms around the world will celebrate Computer Science Education Week (CSEdWeek) by participating in an Hour of Code. The goal of this global call-to-action is to inspire K-12 students to explore and learn computer science. Packed with exciting opportunities for students to exercise their creativity, CSEdWeek and Hour of Code are two of the largest education events with millions of participants worldwide.

To celebrate this year’s CSEdWeek and Hour of Code, Microsoft Education is leading the charge with exciting, new learning resources that are guaranteed to energize students and educators. Whether it is building retro-style games in MakeCode’s Code a Carnival or using code to solve mysterious puzzles in Minecraft’s new Hour of Code: Escape Estate, students will have fun, gain valuable skills, and learn through engaging activities. Plus, these resources include embedded training and support so that everyone succeeds. Educators can also develop their own CS skills during collaborative events like Flip’s Creating Equity in Computer Science and this live event with Minecraft gamechangers!

Kick off CSEdWeek and Hour of Code with Microsoft Education!

Use coding to solve puzzles in Minecraft Hour of Code: Escape Estate

[youtube https://www.youtube.com/watch?v=100tW_NOjs8?&wmode=opaque&rel=0&w=640&h=360]

Escape from Dr. Breakowski’s mysterious mansion by dawn in an all-new Hour of Code tutorial and free demo lesson from Minecraft: Education Edition. With block-based and Python coding pathways for novice and expert coders alike, Escape Estate invites students to use code to solve puzzles that unlock secret passageways, hidden clues, and trap doors. It’s a fun, easy-to-teach lesson designed to teach anyone the basics of computational thinking in under an hour.

Teach with Hour of Code

Minecraft Hour of Code offers resources for educators including lesson plan and facilitation guides, a free teacher training on Microsoft Learn, solution guide for each coding challenge, and a walkthrough video. You can even download PowerPoint slides to introduce Hour of Code: Escape Estate to your learners and Digital flyers for promoting Hour of Code in your school or organization. Students will receive the Hour of Code completion certificate at the end of the lesson.

Educators already licensed to use Minecraft: Education Edition can access the Escape Estate world though the main menu in the newest version of the application (download here). Select “New & Featured” and then choose “Hour of Code (Escape Estate).”
Download a free demo to join in the experience if you don’t have a license.

Register for Free Hour of Code Student Workshop

If you’re totally new to Minecraft and coding, sign up for a Live Workshop to have a guest teacher facilitate Hour of Code virtually for your class. These engaging 75-minute, live events are run by expert educators who will provide you and your class with all the necessary knowledge to successfully navigate Escape Estate. Register now to reserve a spot so that you and your class aren’t trapped in the mansion forever. The workshops are happening at multiple times each day during CSEdWeek December 6-8, 2022.

Build CS knowledge and connect with experts during Flip live events

Explore issues like equity in computer science and meet the professionals that make Minecraft a playful learning experience on Flip throughout computer science education week. Informative and insightful, Flip events offer a chance to see how coding and CS can meaningfully impact everyone’s lives. Learn about the scheduled events and join the discussion by registering today.

Build a better world with code

Meet Lydia Winters and Cory Scheviak, who spend their days at Mojang Studios in Stockholm, Sweden, working on Minecraft. They’re both passionate about using the power of play to build a better world and the creativity of code to design features for the bestselling game of all time.

Suggested Audience: Educators, parents, and students
Date/Time: December 8, 2022 at 10:00 AM PST
Registration

Creating equity in computer science

Computer Science should be an integral part of all K-12 student experiences. Join us as we discuss the importance of computer science education with industry professionals, educators, and non-profits who are making this happen every day.

Suggested Audience: Educators, clubs, organizations, and professionals
Date/Time: December 5, 2022 at 3:00 PM PST
Registration

Design exciting games with Code a Carnival and Wakanda Forever from MakeCode

[youtube https://www.youtube.com/watch?v=fEZJCDnuwy8?&wmode=opaque&rel=0&w=640&h=360]Give students the chance to strengthen their coding skills by designing video games with MakeCode Arcade. Built with both novices and experts in mind, MakeCode Arcade introduces computer science concepts like sequences and loops using blocks that snap together to create code or text-based programming. To celebrate this year’s CSEdWeek and Hour of Code, MakeCode is offering two new free engaging and entertaining experiences which are already available for use in the classroom.

Code a Carnival is MakeCode’s new collection of video game projects. Students will be introduced to game design as they create carnival activities like “Whack-the-Mole” and “Bustin’ Balloons.” They can also build alongside millions of other coders as they create multiplayer versions of games to play with their friends. Plus, Code a Carnival comes with teacher-ready resources like lesson plans and introductory PowerPoint slides.

If there are Black Panther fans in your classroom, give them the opportunity to learn coding fundamentals through an action-packed activity inspired by Marvel Studios’^© Black Panther: Wakanda Forever. Letitia Wright, the actress who plays Wakanda’s lead technologist Shuri, introduces why learning how to code is essential for becoming an expert scientist like her character.

[youtube https://www.youtube.com/watch?v=ygSHKnmC_IU?&wmode=opaque&rel=0&w=640&h=360]

Use the new Wakanda Forever tutorial and the corresponding lesson plan to inspire students to help Shuri, Okoye, and Riri Williams escape Namor.

Learn alongside the Code Ninjas

Look for exciting collaborations with Code Ninjas throughout Computer Science Education Week. They will be hosting a Carnival of Code with daily dress themes like “cozy coding in your pajamas” as well as activities from the MakeCode Hour of Code 2022 website. There will even be projects that incorporate Makey Makey so that students can design their own controllers and learn about physical computing with MakeCode.

Microsoft Education has everything necessary to bring Hour of Code 2022 to life during CSEdWeek. From an engaging collection of Hour of Code learning experiences to events that inspire, students will be excited to explore the possibilities that computer science has to offer.

Explore more fun and engaging ways to bring computer science into the classroom in these posts:

Posted on December 5, 2022 by — Leave a comment

Microsoft Quantum Innovator Series: The path to quantum at scale

The path to quantum at scale; Microsoft Quantum Innovator Series” image of Quantum hardware chandelier

Get the inside, first-hand account of Microsoft’s strategy to scaled quantum computing in a new webinar series where you’ll hear directly from Microsoft Azure Quantum scientists and leaders about the path to quantum at scale and how to get involved today.

In this ongoing series, scientists and researchers can hear directly from Microsoft’s quantum scientists and leaders like Krysta Svore, Chetan Nayak, Matthias Troyer, and others about our strategy, progress, and most importantly, how Microsoft aims to empower innovators to make a breakthrough impact with quantum at scale.

Save my spot. Register for the Microsoft Quantum Innovator Series now.

The series kicks off with our first event “Have you started developing for practical quantum advantage?” on January 31 from 9:00–9:30 AM PT. Our speaker will be Dr. Krysta Svore, distinguished engineer and VP of Quantum Software, Microsoft. During this webinar, you will:

Learn what’s required for scalable quantum computing and what can be done now to get ready for it.
See the new Azure Quantum Resource Estimator—the first end-to-end toolset that provides estimates for the number of logical and physical qubits as well as runtime required to execute quantum applications on post-NISQ, fault-tolerant quantum computers.
Understand the number of qubits required for a quantum solution and the differences between qubit technologies.
Explore how Microsoft is empowering innovators today by co-designing tools to optimize quantum solutions and to run small instances of algorithms on today’s diverse and maturing quantum systems and prepare for tomorrow’s scaled quantum computers.
Participate in a live Q&A chat with the Azure Quantum team and be one of the first to hear about recent advancements.

Krysta Svore | Distinguished Engineer and VP of Quantum Software, Microsoft

About the Speaker:

Dr. Svore has published over 70 refereed articles and filed over 30 patents. She is a Fellow of the American Association for the Advancement of Science. She won the 2010 Yahoo! Learning to Rank Challenge with a team of colleagues, received an ACM Best of 2013 Notable Article award, and was recognized as one of Business Insider’s Most Powerful Female Engineers of 2018. A Kavli Fellow of the National Academy of Sciences, she also serves as an advisor to the National Quantum Initiative, the Advanced Scientific Computing Advisory Committee of the Department of Energy, and the ISAT Committee of DARPA, in addition to numerous other quantum centers and initiatives globally.

Microsoft Quantum Innovator Series: Why and what is the future of the topological qubit?

On February 28, we will focus on why Microsoft decided to design its quantum machine with topological qubits—an approach that is both more challenging and more promising than others—and what’s next for Microsoft’s hardware ambitions. This episode will share more about Microsoft’s quantum hardware journey, specifically touching on Microsoft’s physics breakthrough outlined in Dr. Nayak’s recent paper, and will also focus on the physics behind the topological qubit. Join our speaker Chetan Nayak, Technical Fellow and and VP of Quantum Hardware and Systems Engineering, Microsoft to:

Learn about topological phases in physics and how they are applied to quantum computing.
Explore how topological properties create a level of protection that can, in principle, help a qubit retain quantum information despite what’s happening in the environment around it.
Understand the role of the topological gap and the recently discovered Majorana zero modes, and how together they impact a topological qubit’s stability, size, and speed.
Learn how to examine the raw data and analysis from Microsoft’s hardware research on Azure Quantum.
Use interactive Jupyter notebooks and explore what’s next in engineering the world’s first topological qubit.
Participate in a live Q&A chat with the Azure Quantum team and be one of the first to hear about recent advancements.

Chetan Nayak | Technical Fellow and VP of Quantum Hardware and Systems Engineering, Microsoft

About the Speaker:

Dr. Nayak is a pioneer of the study of quantum matter, including topological and non-equilibrium phases. He holds a bachelor’s degree from Harvard and a PhD in physics from Princeton. He was an assistant, associate, and full professor at UCLA, a visiting professor at Nihon University in Tokyo, and is a professor of physics at UCSB. Chetan was a trustee of the Aspen Center for Physics and an editor of Annals of Physics. He is a Fellow of the American Physical Society and a recipient of an Alfred P. Sloan Foundation Fellowship and a National Science Foundation CAREER award. He has published more than 150 refereed articles with more than 20,000 citations and has been granted more than 20 patents.

Microsoft Quantum Innovator Series: What kind of problems can we solve today with quantum simulation?

On April 20, we will feature Matthias Troyer, Microsoft Technical Fellow, who will discuss what kind of problems we can solve today with quantum simulation. Learn how years of Microsoft research reveal that the discovery of new chemicals, materials, and drugs that will ultimately help solve the world’s most challenging problems will greatly benefit from quantum computing. Dr. Troyer will explain what is happening today and how chemical and materials science innovators can get started on their quantum journey:

Learn how real progress can be made today by combining high performance computing (HPC), state-of-the-art machine learning, and quantum knowledge to fundamentally transform our ability to model and predict the outcome of chemical processes.
Get real-world insights from co-innovation projects happening right now with leading chemical and materials science companies around the world.
Find out how researchers in chemical and materials fields can get started on their quantum journey today.
Participate in a live Q&A chat with the Azure Quantum team and be one of the first to hear about recent advancements.

Matthias Troyer | Technical Fellow, Microsoft

About the Speaker:

Dr. Troyer is a Fellow of the American Physical Society, Vice President of the Aspen Center for Physics, a recipient of the Rahman Prize for Computational Physics of the American Physical Society “for pioneering numerical work in many seemingly intractable areas of quantum many body physics and for providing efficient sophisticated computer codes to the community” and of the Hamburg Prize for Theoretical Physics.

After receiving his PhD in 1994 from ETH Zurich in Switzerland, he was a postdoc at the University of Tokyo before returning to ETH Zurich where he was a professor of Computational Physics until joining Microsoft’s quantum computing program in early 2017. He works on a variety of topics in quantum computing, from the simulation of materials and quantum devices to quantum software, algorithms and applications of future quantum computers. His broader research interests span from high performance computing and quantum computing to the simulations of quantum devices and island ecosystems.

Microsoft Quantum Innovator Series

The path to quantum at scale.

Posted on December 5, 2022 by — Leave a comment

New integration of Adobe Acrobat streamlines the PDF experience in Microsoft Teams

Apps designed for collaboration can help keep employees in the flow of work by bringing the apps, data, and workflows to the user. With Adobe Acrobat Sign and Adobe Creative Cloud, Adobe has played a vital role in bringing collaborative apps to Teams. Building on this momentum, we’re excited to announce the new integration of Adobe Acrobat into Microsoft Teams. This new experience helps remove the friction of switching between apps for organizations that prefer to work with their PDFs through Adobe Acrobat. This new integration may help result in more efficiency, improved security, and reduce costs.

Managing PDFs in Microsoft Teams with Adobe Acrobat

This deep integration allows Acrobat to be set as the default app for PDFs in Teams. People can stay in the flow of work by securely accessing and collaborating on PDFs directly from within the Acrobat viewer in Teams. This includes the ability to share and review PDFs, collaborate in real time with comments and annotations, get notifications of comments, and easily access PDFs that are stored in Microsoft SharePoint and OneDrive. Here’s what’s now available:

Adobe Acrobat Comparison Full.jpg

Set Adobe Acrobat as the default PDF experience for Microsoft Teams

To access this new integration, your IT admin must set Acrobat as the default PDF app through the Teams admin center. Once the app is set as default, all PDF files from chat, channels, and files will open directly in the Acrobat app within Teams. Users won’t need an Adobe Acrobat subscription or Adobe ID to view PDF files, but will need an Acrobat Standard or Pro account for premium features listed above. Learn more about getting started with Adobe Acrobat for Microsoft Teams.

Building on a foundation of security and trust

Protecting sensitive information is core to every person and organization. From a digital security standpoint, PDFs collaborated on are sent to Adobe Document Cloud servers in the region in which the user is located for transient processing. They are then deleted within 24 hours. The documents remain encrypted both in transit and at rest during this process. Discover more about security for Acrobat.

Moving forward

This integration is just one of many ways we are working with Adobe to help increase efficiency across your organization. With Adobe tools and services built into Microsoft 365, everyone can transact business and collaborate faster in their favorite Microsoft 365 apps. We look forward to sharing our updates with you on our collaboration with Adobe. Please reach out to filesteamsfeedback@microsoft.com with any questions about the Adobe Acrobat Teams integration.

Adobe Acrobat Microsoft Teams_1920x1080.png

Posted on December 5, 2022 by — Leave a comment

Preparing for a Russian cyber offensive against Ukraine this winter

As we report more fully below, in the wake of Russian battlefield losses to Ukraine this fall, Moscow has intensified its multi-pronged hybrid technology approach to pressure the sources of Kyiv’s military and political support, domestic and foreign. This approach has included destructive missile and cyber strikes on civilian infrastructure in Ukraine, cyberattacks on Ukrainian and now foreign-based supply chains, and cyber-enabled influence operations[1]—intended to undermine US, EU, and NATO political support for Ukraine, and to shake the confidence and determination of Ukrainian citizens.

In recent months, cyberthreat actors affiliated with Russian military intelligence have launched destructive wiper attacks against energy, water and other critical infrastructure organizations’ networks in Ukraine as missile strikes knocked out power and water supplies to civilians across the country. Russian military operators also expanded destructive cyberactivity outside Ukraine to Poland, a critical logistics hub, in a possible attempt to disrupt the movement of weapons and supplies to the front.

Meanwhile, Russian propaganda seeks to amplify the intensity of popular dissent over energy and inflation across Europe by boosting select narratives online through state-affiliated media outlets and social media accounts to undermine elected officials and democratic institutions. To date, these have had only limited public impact, but they foreshadow what may become broadening tactics during the winter ahead.

We believe these recent trends suggest that the world should be prepared for several lines of potential Russian attack in the digital domain over the course of this winter. First, we can expect a continuation of Russia’s cyber offensive against Ukrainian critical infrastructure. We should also be prepared for the possibility that Russian military intelligence actors’ recent execution of a ransomware-style attack – known as Prestige – in Poland may be a harbinger of Russia further extending cyberattacks beyond the borders of Ukraine. Such cyber operations may target those countries and companies that are providing Ukraine with vital supply chains of aid and weaponry this winter.

Second, we should also be prepared for cyber-enabled influence operations that target Europe to be conducted in parallel with cyberthreat activity. Russia will seek to exploit cracks in popular support for Ukraine to undermine coalitions essential to Ukraine’s resilience, hoping to impair the humanitarian and military aid flowing to the region. The good news is that, when equipped with more information, a media-savvy public can act with awareness and judgment to counter this threat.

Here’s what we are seeing at Microsoft since Ukraine’s counteroffensive has pushed the Russian army into retreat, what we anticipate Russia’s cyber and influence operations might look like headed into the winter months, and how we at Microsoft will help prepare and prevent harm to Microsoft customers and democracies facing these attacks.

Combined missile and cyber strikes focus on destruction of civilian infrastructure

As Russia retreated from formerly occupied territory in Ukraine in late October, the Kremlin unleashed new missile and drone strikes against Ukrainian cities and the energy and transportation infrastructure that supports them. Missile barrages cut power to more than 10 million Ukrainians and left up to 80% of Kyiv’s population without running water.[2] The intent to inflict suffering on Ukraine’s civilians has been clear, and was effectively acknowledged by Russian officials.[3]

Notably, these recent missile strikes have been accompanied by cyberattacks on the same sectors, perpetrated by a threat group – known at Microsoft by the element name IRIDIUM and by others as Sandworm – associated with Russia’s military intelligence service, the GRU. The repeated temporal, sectoral and geographic association of these cyberattacks by Russian military intelligence with corresponding military kinetic attacks indicate a shared set of operational priorities and provides strong circumstantial evidence that the efforts are coordinated, as reflected in the timelines below.

Microsoft’s research of IRIDIUM shows a history of destructive attacks against Ukraine’s critical energy infrastructure that dates back nearly a decade. Following Russia’s annexation of Crimea in 2014, IRIDIUM launched a series of wintertime operations against Ukrainian electricity providers, cutting power to hundreds of thousands of citizens in 2015 and 2016.[4] The group’s pursuit of destruction in Ukraine spread globally in 2017 with the NotPetya attack, which inflicted $10 billion of damage to companies including international firms such as Maersk, Merck and Mondelēz, and underscores the risk of this actor’s operations to the global digital ecosystem.[5]

The wave of Russian destructive cyberattacks that began on February 23, and subsequent destructive attacks against Ukrainian targets in support of the Russian war effort have been the responsibility of IRIDIUM, as we have previously reported.[6] In October, IRIDIUM’s destructive attacks against Ukrainian critical services networks spiked, after two months of little to no wiper activity. As the Ukrainian counteroffensive progressed and winter approached, Microsoft observed that IRIDIUM deployed Caddywiper and FoxBlade wiper malware to destroy data from networks of organizations involved in power generation, water supply and the transportation of people and goods. The predominant focus was on the Kyiv region, as well as the southern and central-eastern regions of the country, where the physical conflict has been the most intense.

Cyber and missile strikes on transportation and logistics companies may interfere with the transportation of weapons and supplies. However, such attacks can also disrupt the passage of humanitarian aid to Ukrainian citizens, compounding the harm from curtailing the supply of electricity.This tactic of targeting civilian infrastructure has been in play since the beginning of the conflict. Of the roughly 50 Ukrainian organizations that Russian military operators have hit with destructive wiper malware since February 2022, 55% were critical infrastructure organizations, including in the energy, transportation, water, law enforcement and emergency services, and health care sectors.In most instances, threat actors have deployed wipers against the business networks of the targeted critical infrastructure organizations. However, operational technology networks are also vulnerable. For example, IRIDIUM attempted to inflict severe damage on energy production in April by targeting the industrial control systems (ICS) of a Ukrainian energy provider.[7] Quick action by CERT-UA and international partners thwarted the attack, but the risk of future ICS attacks that would disrupt or destroy the productive capacity of Ukrainian power or water infrastructure is high.

Russian cyberattacks extend outside Ukraine

Russian cyber strikes extended outside Ukraine in October, when IRIDIUM deployed its novel Prestige ransomware against several logistics and transportation sector networks in Poland and Ukraine.[8] This was the first war-related cyberattack against entities outside of Ukraine since the Viasat KA-SAT attack at the start of the invasion.[9]

The Prestige event in October may represent a measured shift in Russia’s cyberattack strategy, reflecting a willingness by Moscow to use its cyberweapons against organizations outside Ukraine in support of its ongoing war. Since Spring 2022, Microsoft has observed that IRIDIUM and suspected Russian state operators have targeted transportation and logistics organizations across Ukraine in probable attempts to collect intelligence on or disrupt the flow of military and humanitarian aid through the country. But these recent attacks in Poland suggest that Russian state-sponsored cyberattacks may increasingly be used outside Ukraine in an effort to undermine foreign-based supply chains.

IRIDIUM’s success in the Prestige destructive attack was limited. Early customer notifications and rapid response, including from Microsoft’s Detection and Response Team (DART) and the Microsoft Threat Intelligence Center (MSTIC), along with local incident responders in Poland, reportedly helped contain the attack’s impact to less than 20% of one targeted organization’s network. However, while the destructive impact was limited, IRIDIUM almost certainly collected intelligence on supply routes and logistics operations that could facilitate future attacks.

Perhaps in part because the impact was successfully limited by the defenders and responders in this instance, international outcry against this new extension of the hybrid war beyond the borders of Ukraine has been muted. Nevertheless, this attack highlights the continued risk of Russian destructive cyberattacks to European organizations that directly supply or transport humanitarian and military assistance to Ukraine.

Cyber-enabled influence operations seek to fuel real-world discord across Europe

This winter, European populations seeking to keep warm amid energy shortages and heightened inflation will likely be targeted by Russian attempts to stir up and potentially mobilize grievances through cyber-enabled influence operations.

Such operations offer the Kremlin a more deniable but nonetheless effective method of shaping discourse around conflict and major geopolitical events. Russia’s “active measures” approach involves infiltrating the constituencies of Kremlin adversaries while elevating candidates and officials who share Russia’s preferred foreign policy positions. Since 2014, Russia has sought to achieve its objectives “through the force of politics, rather than the politics of force,”[10] across democratic contests including the 2016 Brexit referendum and elections in the US, France and Germany, among others. Russia has also exploited political, economic and social divisions to mobilize citizens and even incite violence inside democracies. It is likely that these tools will be deployed in Europe and globally to reduce support for Ukraine’s defense.

Russia has a well-established ability to sway public opinion both in the U.S. and Europe through cyber-enabled influence operations. In 2016, the Internet Research Agency in St. Petersburg, known better as the Russian “troll farm,” famously orchestrated protests in Texas[11] and Florida.[12] Earlier that same year, Russian state media ran a story about an alleged assault of a young girl by migrants in Germany – accusations later disproved – and promoted the narrative that the German government had deliberately concealed the truth. The subsequent media flurry sparked a series of protests within Germany’s sizeable Russian diaspora, who were outraged by what they were being told was failure on the part of the German justice system.[13]

In 2018, the same Kremlin trolls involved in the 2016 US presidential election amplified the “yellow vest” protests in France. Russia did not organize these protests, but its online campaigns elevated calls to protest President Emmanuel Macron’s government by using a blend of overt, state-sponsored media to promote the cause while boosting the movement’s hashtag #giletsjaunes via covert accounts online.[14]

Our Digital Threat Analysis Center (DTAC) team closely tracks cyber-enabled influence operations. Protests in Europe this fall related to energy, inflation, and the war in Ukraine broadly – and their steady promotion by Russian propaganda outlets – foreshadow additional operations we may encounter this winter in support of Russian objectives by seeking to increase European dissatisfaction with energy supply, energy pricing and inflation.[15] If energy and electricity disruptions in Ukraine lead to more refugees throughout Europe, Russian cyber-enabled influence operations may seek to increase frictions over migration to create intra- and inter-country conflicts – a theme visible in the Kremlin’s campaigns over the last decade as refugees fled to Eastern and Central Europe during the Syrian Civil War.[16]

In the coming months, European nations will likely be subjected to a range of influence techniques tailored to their populations’ concerns about energy prices and inflation more broadly. Russia has and will likely continue to focus these campaigns on Germany, a country critical for maintaining Europe’s unity and home to a large Russian diaspora, seeking to nudge popular and elite consensus toward a path favorable to the Kremlin.[17] Strong connections between Kremlin-affiliated ideologues and Germany’s far right will likely be leveraged both online and offline in campaigns targeting German audiences with hardline narratives on the war in Ukraine as well as criticism of the government’s handling of the energy crisis.[18]

Recent quantitative analyses support these assessments. Microsoft’s AI for Good Lab has created a Russian Propaganda Index (RPI) to monitor the consumption of news from Russian state-controlled and state-sponsored news outlets and amplifiers. This index measures the proportion of this propaganda flow to overall news traffic on the internet. The RPI in Germany currently is the highest in Western Europe, over three times the regional average.

Higher Russian propaganda consumption in Germany may be in part due to decades of Russian investment in soft power and public diplomacy targeting the country, home to one of the largest Russian diaspora populations in Europe. Many of the soft power organizations’ express purpose is to create people-to-people and party-to-party ties between the two countries, and several Russian state-sponsored media outlets have been based in Germany.[19] Germany’s large Russian-speaking population, estimated at nearly 6 million people, makes Russian cyber-enabled influence operations and propaganda published in both Russian and German more accessible to German audiences.[20] Meanwhile, German policy since the end of the Cold War, during which time Soviet and East German active measures efforts were conducted synergistically,[21] has sought a normalization of relations with Russia bolstered by economic cooperation, with no greater example than the Nord Stream 2 natural gas pipeline. U.S. sanctions against this project, unpopular in both Russia and Germany, gave anti-Western and pro-Russian propaganda and influence operations, particularly on economic and energy topics, a more sympathetic audience.[22]

Throughout Western Europe, readers are exposed to Russian propaganda on both Russian-language sites – including Russian state-owned media sites – and local-language, pro-Russia sites. Consumption of local-language sites in Germany is three times higher than the Western European average, in keeping with Germany’s high levels of Russian propaganda consumption in the aggregate. In Germany, the local-language sites that generate the most traffic are anti-spiegel.ru, uncutnews.ch and the German-language edition of Russia Today (RT), de.rt.com. Local sites focus more attention on local issues. Anti-Spiegel in particular has focused its content on leveraging the current economic climate to promote the Kremlin and vilify the West. The headlines of its three most-read articles, for example, from the last four months are:

“That the US wants to destroy the German economy is considered a conspiracy theory and Russian propaganda, but it is obvious.”[23]
“The Nord Stream pipelines have been blown up and the Western media are staging what is arguably the stupidest propaganda operation ever.”[24]
“I am often asked why I am so convinced that Russian President Putin is not part of [the World Economic Forum] & Co. and its new world order. Here I want to answer that.”[25]

Aside from Germany, many other European nations may also need to reckon with the combined weight of Russian meddling and organic popular discontent. Earlier this year, Russia-affiliated threat actor SEABORGIUM (which overlaps with threat groups tracked as Callisto Group, TA446 and COLDRIVER) targeted the UK, utilizing allegedly stolen material to sow distrust in the British government,[26] while pro-Russia media like Modern Diplomacy and Strategic Culture Foundation, an outlet directed by the Russian Foreign Intelligence Service (SVR),[27] publish content alleging British involvement in the Kerch Strait Bridge explosion.[28]

Ongoing protests in the Czech Republic, meanwhile, have promoted Russia’s talking points on energy and are repeatedly featured in Russian state-owned and state-affiliated media.[29] Ladislav Vrábel – one of the organizers of the protest movement Czech Republic First – has been a repeated guest on Russian media such as Sputnik News since protests began,[30] while PolitNavigator – a Russian-language site reportedly directed by the FSB[31] – sent a correspondent to cover the protests from the beginning.[32] Further, among public figures who supported and spoke at the demonstrations are several politicians with long and well-documented records of pro-Russian activity, such as unofficial trips to occupied Crimea and high-level involvement with Kremlin-funded biker gang Night Wolves.[33]

France, not as reliant on Russian gas as its neighbors, is perhaps less vulnerable to energy-related influence. However, there is an ongoing risk that Russian agencies will seek to meddle in French affairs through inauthentic social media campaigns – building on previous efforts[34] and its success seeding and exploiting anti-French sentiment throughout Africa via propaganda, fake think tanks, and local engagement – which point to Russia’s willingness undermine French leadership.[35] Finally, Italy, with rising energy costs,[36] emerges as an additional target.

Defending the digital domain this winter: A way forward

In our June 2022 report, Defending Ukraine: Early Lessons from the Cyber War, Microsoft offered a methodology for combating digital threats. Multidimensional threats require multidimensional defenses. At Microsoft, we’ve built our approach around “Four Ds” to counter malicious cyber and influence activity. Throughout the winter and into 2023, we will be working with our customers and in support of democracies to:

Detect: Collectively identify, across Microsoft’s threat intelligence teams, those cyber actors that may strike at supply chains supporting Ukraine and the energy industry keeping Europe warm this winter. We will also evaluate cyberattacks to determine which are designed to limit support and supplies to Ukraine and which may be part of broader hack-and-leak operations designed to undermine unity of support for Ukraine. For customers, we’ll preemptively evaluate and assess potential risks to those that may be targets of Russia or other nation state threat actors. This vulnerability assessment will closely evaluate transportation, defense and energy companies Microsoft serves to help increase the collective speed of detection and response. Microsoft will also continue to track and identify Russian cyber-enabled influence operations, publishing our findings to notify the public and industry partners to improve information integrity of our own platforms and broader detection efforts.
Disrupt: Microsoft’s Threat Intelligence Center (MSTIC) will alert customers and the public to emerging cyber methods enabling the entire ecosystem to rapidly employ sensors, patches, and mitigations. Where we encounter cyber-enabled influence campaigns, we will pursue a similar strategy, shining a light on operations aimed at creating doubt, distrust or dissent within Ukraine or across its partners seeking to undermine support for Ukraine. Our team will share this information with our customers and the public to these operations and lessen their impact.
Defend: Microsoft will increase the collective defenses of the broader cyber ecosystem through increased information sharing and improved technology to defend against Russian threats and address vulnerabilities. Our teams will continue to support nonprofits, journalists and academics both within Ukraine and across allies, allowing those partners to broaden their defense of the information ecosystem. For example, Microsoft recently partnered with International Media Support (IMS) and the Center for Strategic Communication and Information Security within Ukraine to improve rapid information sharing and response between the private sector, NGOs and journalists within Ukraine through a dedicated secure communications hub.
Deter: Microsoft has been dedicated for more than a decade to securing international norms for cyberspace. This winter, our Digital Diplomacy and Democracy Forward teams will work with affected customers and their representative governments to push for unified action to protect our customers’ supply chains against nation state attacks. And we will continue our ongoing efforts to provide actionable threat intelligence to entities targeted or compromised by Russian actors in Ukraine and in the countries supporting its defense.

Finally, for customers, Microsoft encourages the use of strong cyber hygiene and the latest detection and response technology to reduce vulnerabilities to and recover from cyberattacks – a listing of these specific recommendations can be found in the recently released Microsoft Digital Defense Report (MDDR) 2022.[37]

Ukraine has fought a brave defense both online and on-the-ground against a merciless Russian assault. With the help of its partner nations, companies and democratic citizens, we all can ensure that Ukraine and Europe’s infrastructure is protected and democracy resilient in the face of authoritarianism this winter.

[1] Cyber-enabled influence operations refer to targeted, online information campaigns designed to shift public opinion through manipulative or subversive means.

[2] https://www.msn.com/en-us/news/world/russian-strikes-on-ukraine-leave-most-of-kyiv-without-running-water/ar-AA13zw4A, https://www.axios.com/2022/10/31/russia-strikes-ukraine-kyiv-water

[3] Following the attack, Dmitry Peskov, Russian President Vladimir Putin’s press secretary, implied Russia’s intentions with its strikes on Ukraine’s critical infrastructure is to force President Zelenskyy to negotiate.

[4] https://www.wired.com/story/sandworm-kremlin-most-dangerous-hackers/

[5] https://www.darkreading.com/threat-intelligence/3-years-after-notpetya-many-organizations-still-in-danger-of-similar-attacks

[6] https://blogs.microsoft.com/on-the-issues/2022/06/22/defending-ukraine-early-lessons-from-the-cyber-war/

[7] https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/; https://cert.gov.ua/article/39518

[8] https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/

[9] https://techcrunch.com/2022/05/10/russia-viasat-cyberattack/

[10] https://securingdemocracy.gmfus.org/so-what-did-we-learn-looking-back-on-four-years-of-russias-cyber-enabled-active-measures/

[11] https://www.dallasnews.com/news/politics/2019/10/08/russian-trolls-orchestrated-2016-clash-houston-islamic-center-senate-intel-report-says/

[12] https://www.thedailybeast.com/russians-appear-to-use-facebook-to-push-pro-trump-flash-mobs-in-florida

[13] https://www.reuters.com/article/us-germany-russia-idUSKCN0VA31O, https://www.bbc.com/news/blogs-eu-35413134

[14] https://www.theguardian.com/world/2018/dec/17/gilets-jaunes-grassroots-heroes-or-kremlin-tools

[15] https://www.politnavigator.news/fiala-ty-idiot-reportazh-s-prorossijjskogo-mitinga-v-chekhii.html

[16] https://www.vice.com/en/article/y3pqwk/russia-propaganda-rt-ukraine-refugees, https://www.atlanticcouncil.org/blogs/ukrainealert/six-outrageous-lies-russian-disinformation-peddled-about-europe-in-2016/, https://www.dw.com/en/russia-uses-the-refugee-crisis-for-propaganda/a-18989796; https://www.atlanticcouncil.org/blogs/syriasource/russia-s-disinformation-campaign-has-changed-how-we-see-syria/

[17] https://www.politico.eu/article/russia-influence-ukraine-fake-news; https://www.dw.com/en/russian-disinformation-threat-looms-large-over-cold-german-winter/a-63096336

[18] https://sputniknews.com/20220819/germany-should-immediately-launch-nord-stream-2-bundestag-vice-speaker-says-1099755921.html, https://www.rt.com/business/559754-horror-chart-germany-energy-crisis, https://www.rt.com/news/559740-german-mayors-nord-stream-letter, https://www.rt.com/business/567368-germany-russian-gas-alternatives

[19] https://www.csis.org/analysis/kremlin-playbook, https://www.thedailybeast.com/grassroots-media-startup-redfish-is-supported-by-the-kremlin, https://www.reuters.com/world/europe/exclusive-russian-news-agency-berlin-faces-staff-exodus-over-ukraine-invasion-2022-02-28

[20] https://www.dw.com/en/germanys-russian-community-faces-harassment-and-hostility/a-61055867

[21] https://www.wilsoncenter.org/blog-post/operation-denver-kgb-and-stasi-disinformation-regarding-aids, https://www.wilsoncenter.org/publication/kgbstasi-cooperation

[22] https://www.nytimes.com/2022/12/02/world/europe/germany-russia-nord-stream-pipeline.html

[23] https://www.anti-spiegel.ru/2022/mit-hilfe-der-gruenen-die-usa-planen-die-zerstoerung-der-deutschen-wirtschaft/

[24] https://www.anti-spiegel.ru/2022/nord-stream-gesprengt-die-wohl-duemmste-propaganda-aller-zeiten/

[25] https://www.anti-spiegel.ru/2022/sitzt-putin-mit-schwabs-weltwirtschaftsforum-co-in-einem-boot/

[26] https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/

[27] https://home.treasury.gov/news/press-releases/jy0126

[28] https://moderndiplomacy.eu/2022/10/14/the-grayzone-ukraine-blew-up-kerch-bridge-british-spies-plotted-it, https://strategic-culture.org/news/2022/10/13/before-ukraine-blew-up-kerch-bridge-british-spies-plotted-it

[29] https://cz.sputniknews.com/20221122/dalsi-rozpoutani-valky-je-zradou-vuci-cechum-vrabel-rekl-kdo-je-zodpovedny-za-umrti-na-ukrajine–18906016.html, https://www.rt.com/news/565552-czech-protestors-demand-pm-resign/, https://cz.sputniknews.com/20221028/vrabel-ceska-vlada-hraje-valecny-fotbal-kdy-fandi-jedne-strane-proti-druhe-nemuzeme-si-to-dovolit-18803610.html, https://cz.sputniknews.com/20221025/havel-prioritou-vlady-ma-byt-pomoc-cechum-abychom-mohli-pomahat-druhym-musime-nejprve-pomoci-sobe-18789293.html

[30] https://www.idnes.cz/zpravy/domaci/vrabel-rusko-omluva-ukrajina-demonstrace.A220909_143314_domaci_vapo, https://odysee.com/@Sputnjik.Srbija:7/Sputnjik-Intervju—Ladislav-Vrabel:6, https://www.tydenikhrot.cz/clanek/cesko-by-se-melo-orientovat-na-moskvu-tvrdi-organizator-protivladnich-protestu-vrabel

[31] https://apnews.com/article/russia-ukraine-coronavirus-pandemic-health-moscow-media-ff4a56b7b08bcdc6adaf02313a85edd9

[32] https://www.politnavigator.net/fiala-ty-idiot-reportazh-s-prorossijjskogo-mitinga-v-chekhii.html

[33] https://manipulatori.cz/jaroslav-foldyna-a-jeho-nocni-vlci-a-srbsti-nacionaliste/, https://www.lidovky.cz/domov/putinovi-nocni-vlci-dorazili-do-prahy.A190506_122904_ln_domov_zdp, https://blog.aktualne.cz/blogy/roman-maca.php?itemid=39721, https://www.idnes.cz/zpravy/zahranicni/bitva-o-stalingrad-vyroci-75-volgograd-putin-vojenska-prehlidka.A180202_134302_zahranicni_PAS, https://www.parlamentnilisty.cz/arena/rozhovory/Rusku-zapadni-sankce-skutecne-nadmiru-prospivaji-Komunista-Skala-se-vratil-z-Ruska-a-toto-vse-tam-videl-549240, https://hlidacipes.org/__trashed/, https://zpravy.tiscali.cz/na-navstevu-za-chirurgem-sef-nocnich-vlku-prijima-hosty-na-krymu-pozval-i-slovenskeho-prezidenta-kisku-316604, https://www.theguardian.com/world/2015/may/08/pro-putin-bikers-russia-night-wolves-state-funds

[34] https://www.bbc.com/news/blogs-trending-39845105, https://www.politico.eu/article/france-election-2017-russia-hacked-cyberattacks, https://www.theguardian.com/technology/2022/sep/27/meta-takes-down-influence-operations-run-by-china-and-russia, https://www.dw.com/en/frances-yellow-vests-and-the-russian-trolls-that-encourage-them/a-46753388

[35] https://home.treasury.gov/news/press-releases/jy0126, https://www.4freerussia.org/wp-content/uploads/sites/3/2020/09/The-Company-You-Keep-Yevgeny-Prigozhins-Influence-Operations-in-Africa.pdf

[36] https://www.reuters.com/business/energy/italys-regulated-household-electricity-prices-rise-59-q4-arera-2022-09-29/#:~:text=According%20to%20the%20regulator%2C%20the,inflation%20hit%209.1%25%20in%20August., https://www.reuters.com/business/energy/italy-spend-100-bln-euros-this-year-import-energy-2022-09-03/

[37] https://www.microsoft.com/en-us/security/business/security-insider/threat-guidance/using-cybersecurity-to-help-manage-volatility-in-the-global-threat-landscape/

Posted on December 5, 2022 by — Leave a comment

Microsoft presents latest AI and machine learning research at NeurIPS 2022

abstract banner for Microsoft at NeurIPS 2022

Microsoft is proud to be a platinum sponsor of the 36th annual conference on Neural Information Processing Systems (NeurIPS), which is widely regarded as the world’s most prestigious research conference on artificial intelligence and machine learning.

Microsoft has a strong presence at NeurIPS again this year, with more than 150 of our researchers participating in the conference and 122 of our research papers accepted. Our researchers are also taking part in 10 workshops, four competitions and a tutorial.

In one of the workshops, AI for Science: Progress and Promises, a panel of leading researchers will discuss how artificial intelligence and machine learning have the potential to advance scientific discovery. The panel will include two Microsoft researchers: Max Welling, Vice President and Distinguished Scientist, Microsoft Research AI4Science, who will serve as moderator, and Peter Lee, Corporate Vice President, Microsoft Research and Incubations.

Of the 122 Microsoft research papers accepted for the conference, seven have been selected for oral presentations during the virtual NeurIPS experience the week of December 4^th. The oral presentations provide a deeper dive into each of the featured research topics.

In addition, two other Microsoft research papers received Outstanding Paper Awards for NeurIPS 2022. One of those papers, Gradient Estimation with Discrete Stein Operators, explains how researchers developed a gradient estimator that achieves substantially lower variance than state-of-the-art estimators with the same number of function evaluations, which has the potential to improve problem solving in machine learning. In the other paper, A Neural Corpus Indexer for Document Retrieval, researchers demonstrate that an end-to-end deep neural network that unifies training and indexing stages can significantly improve the recall performance of traditional document retrieval methods.

Below we have provided the titles, authors and abstracts for all seven of the Microsoft research papers chosen for oral presentations at NeurIPS, with links to additional information for those who want to explore the topics more fully:

Uni[MASK]: Unified Inference in Sequential Decision Problems

Micah Carroll, Orr Paradise, Jessy Lin, Raluca Georgescu, Mingfei Sun, David Bignell, Stephanie Milani, Katja Hofmann, Matthew Hausknecht, Anca Dragan, Sam Devlin

Abstract: Randomly masking and predicting word tokens has been a successful approach in pre-training language models for a variety of downstream tasks. In this work, we observe that the same idea also applies naturally to sequential decision making, where many well-studied tasks like behavior cloning, offline RL, inverse dynamics, and waypoint conditioning correspond to different sequence maskings over a sequence of states, actions, and returns. We introduce the UniMASK framework, which provides a unified way to specify models which can be trained on many different sequential decision-making tasks. We show that a single UniMASK model is often capable of carrying out many tasks with performance similar to or better than single-task models. Additionally, after fine tuning, our UniMASK models consistently outperform comparable single-task models.

K-LITE: Learning Transferable Visual Models with External Knowledge

Sheng Shen, Chunyuan Li, Xiaowei Hu, Yujia Xie, Jianwei Yang, Pengchuan Zhang, Zhe Gan, Lijuan Wang, Lu Yuan, Ce Liu, Kurt Keutzer, Trevor Darrell, Anna Rohrbach, Jianfeng Gao

Abstract: The new generation of state-of-the-art computer vision systems are trained from natural language supervision, ranging from simple object category names to descriptive captions. This form of supervision ensures high generality and usability of the learned visual models, based on the broad concept coverage achieved through large-scale data collection process. Alternatively, we argue that learning with external knowledge about images is a promising way which leverages a much more structured source of supervision and offers sample efficiency.

In this paper, we propose K-LITE (Knowledge-augmented Language-Image Training and Evaluation), a simple strategy to leverage external knowledge for building transferable visual systems: In training, it enriches entities in natural language with WordNet and Wiktionary knowledge, leading to an efficient and scalable approach to learning image representations that uses knowledge about the visual concepts; In evaluation, the natural language is also augmented with external knowledge and then used to reference learned visual concepts (or describe new ones) to enable zero-shot and few-shot transfer of the pre-trained models. We study the performance of K-LITE on two important computer vision problems, image classification and object detection, benchmarking on 20 and 13 different existing datasets, respectively. The proposed knowledge-augmented models show significant improvement in transfer learning performance over existing methods. Our code is released at https://github.com/microsoft/klite.

Extreme Compression for Pre-trained Transformers Made Simple and Efficient

Xiaoxia Wu, Zhewei Yao, Minjia Zhang, Conglong Li, Yuxiong He

Abstract: Extreme compression, particularly ultra-low bit precision (binary/ternary) quantization, has been proposed to fit large NLP models on resource-constraint devices. However, to preserve the accuracy for such aggressive compression schemes, cutting-edge methods usually introduce complicated compression pipelines, e.g., multi-stage expensive knowledge distillation with extensive hyperparameter tuning. Also, they oftentimes focus less on smaller transformer models that have already been heavily compressed via knowledge distillation and lack a systematic study to show the effectiveness of their methods.

In this paper, we perform a very comprehensive systematic study to measure the impact of many key hyperparameters and training strategies from previous. As a result, we find out that previous baselines for ultra-low bit precision quantization are significantly under-trained. Based on our study, we propose a simple yet effective compression pipeline for extreme compression.

Our simplified pipeline demonstrates that:

(1) we can skip the pre-training knowledge distillation to obtain a 5-layer \bert while achieving better performance than previous state-of-the-art methods, like TinyBERT;

(2) extreme quantization plus layer reduction is able to reduce the model size by 50x, resulting in new state-of-the-art results on GLUE tasks.

On the Complexity of Adversarial Decision Making

Dylan J Foster, Alexander Rakhlin, Ayush Sekhari, Karthik Sridharan

Abstract: A central problem in online learning and decision making—from bandits to reinforcement learning—is to understand what modeling assumptions lead to sample-efficient learning guarantees. We consider a general adversarial decision-making framework that encompasses (structured) bandit problems with adversarial rewards and reinforcement learning problems with adversarial dynamics. Our main result is to show—via new upper and lower bounds—that the Decision-Estimation Coefficient, a complexity measure introduced by Foster et al. in the stochastic counterpart to our setting, is necessary and sufficient to obtain low regret for adversarial decision making. However, compared to the stochastic setting, one must apply the Decision-Estimation Coefficient to the convex hull of the class of models (or, hypotheses) under consideration. This establishes that the price of accommodating adversarial rewards or dynamics is governed by the behavior of the model class under convexification, and recovers a number of existing results –both positive and negative. En route to obtaining these guarantees, we provide new structural results that connect the Decision-Estimation Coefficient to variants of other well-known complexity measures, including the Information Ratio of Russo and Van Roy and the Exploration-by-Optimization objective of Lattimore and György.

Maximum Class Separation as Inductive Bias in One Matrix

Tejaswi Kasarla, Gertjan J. Burghouts, Max van Spengler, Elise van der Pol, Rita Cucchiara, Pascal Mettes

Abstract: Maximizing the separation between classes constitutes a well-known inductive bias in machine learning and a pillar of many traditional algorithms. By default, deep networks are not equipped with this inductive bias and therefore many alternative solutions have been proposed through differential optimization. Current approaches tend to optimize classification and separation jointly: aligning inputs with class vectors and separating class vectors angularly.

This paper proposes a simple alternative: encoding maximum separation as an inductive bias in the network by adding one fixed matrix multiplication before computing the softmax activations. The main observation behind our approach is that separation does not require optimization but can be solved in closed-form prior to training and plugged into a network. We outline a recursive approach to obtain the matrix consisting of maximally separable vectors for any number of classes, which can be added with negligible engineering effort and computational overhead. Despite its simple nature, this one matrix multiplication provides real impact. We show that our proposal directly boosts classification, long-tailed recognition, out-of-distribution detection, and open-set recognition, from CIFAR to ImageNet. We find empirically that maximum separation works best as a fixed bias; making the matrix learnable adds nothing to the performance. The closed-form implementation and code to reproduce the experiments are available on GitHub.

Censored Quantile Regression Neural Networks for Distribution-Free Survival Analysis

Tim Pearce, Jong-Hyeon Jeong, Yichen Jia, Jun Zhu

Abstract: This paper considers doing quantile regression on censored data using neural networks (NNs). This adds to the survival analysis toolkit by allowing direct prediction of the target variable, along with a distribution-free characterization of uncertainty, using a flexible function approximator. We begin by showing how an algorithm popular in linear models can be applied to NNs. However, the resulting procedure is inefficient, requiring sequential optimization of an individual NN at each desired quantile. Our major contribution is a novel algorithm that simultaneously optimizes a grid of quantiles output by a single NN. To offer theoretical insight into our algorithm, we show firstly that it can be interpreted as a form of expectation-maximization, and secondly that it exhibits a desirable `self-correcting’ property. Experimentally, the algorithm produces quantiles that are better calibrated than existing methods on 10 out of 12 real datasets.

Learning (Very) Simple Generative Models Is Hard

Sitan Chen, Jerry Li, Yuanzhi Li

Abstract: Motivated by the recent empirical successes of deep generative models, we study the computational complexity of the following unsupervised learning problem. For an unknown neural network $F:\mathbb{R}^d\to\mathbb{R}^{d’}$, let $D$ be the distribution over $\mathbb{R}^{d’}$ given by pushing the standard Gaussian $\mathcal{N}(0,\textrm{Id}_d)$ through $F$. Given i.i.d. samples from $D$, the goal is to output ${any}$ distribution close to $D$ in statistical distance.

We show under the statistical query (SQ) model that no polynomial-time algorithm can solve this problem even when the output coordinates of $F$ are one-hidden-layer ReLU networks with $\log(d)$ neurons. Previously, the best lower bounds for this problem simply followed from lower bounds for $supervised$ $learning$ and required at least two hidden layers and $poly(d)$ neurons [Daniely-Vardi ’21, Chen-Gollakota-Klivans-Meka ’22].

The key ingredient in our proof is an ODE-based construction of a compactly supported, piecewise-linear function $f$ with polynomially-bounded slopes such that the pushforward of $\mathcal{N}(0,1)$ under $f$ matches all low-degree moments of $\mathcal{N}(0,1)$.

Posted on December 2, 2022 by — Leave a comment

After 40 years, creativity is still at the heart of Adobe

In this episode of “Digital Now,” Cynthia Stoddard, Adobe senior vice president and chief information officer, says that the creative spirit that has always flourished at Adobe – famous for its groundbreaking tools for designers, producers, developers and photographers – now extends to the company’s digital transformation initiatives.

She shares the example of Lab82, named for the year Adobe was born, where employees have an opportunity to use and react to collaborative workspaces before they are widely deployed. She also explains how the company uses data to inform automation that “eliminates toil” so that employees can focus on what’s important.

“Digital Now” is a video series hosted by Andrew Wilson, chief digital officer at Microsoft, who invites friends and industry leaders inside and outside of Microsoft to share how they are tackling digital and business transformation, and explores themes like the future of work, security, artificial intelligence and the democratization of code and data.

Visit Digital Now on YouTube to view more episodes.

Posted on December 2, 2022 by — Leave a comment

Int’l Day of Persons with Disabilities is Dec. 3; Read 3 stories of progress through inclusive learning

On December 3^rd, we celebrate International Day of Persons with Disabilities to acknowledge the more than 1 billion people in the world with disabilities and their roles as vibrant and valuable members of society. Considering that 1 in every 10 children is a child with a disability, students need classroom technology that is inclusively designed; giving them multiple ways to create, engage, and participate in constructing knowledge regardless of ability, income, language, location, or identity.

Inclusive design opens Microsoft’s education tools to more students with a wider range of abilities. To support the unique needs of all learners, tools––like Microsoft 365, Teams, and Windows 11––offer powerful accessibility options that are built-in, mainstream, and non-stigmatizing.

Profiles in inclusive learning

When the pandemic broke the routines of many children in 2020, this disruption in learning strongly impacted schools specializing in the education of children with special needs. Educators all over the world utilized technology to create more inclusive learning environments so that all students, regardless of unique needs, could thrive.

Inclusive education tools give more students access to curriculum, optimize educator time, and improve learning outcomes. Students can grow their potential and gain independence while educators are more empowered to engage every learner.

Discover how real educators are using Microsoft education solutions to create more accessible and engaged learning experiences.

The Loom School: Virtual solutions for real-world results

The Loom School in Decatur, Georgia, is a small private school for children with learning disabilities and mental health issues. As the COVID-19 health crisis swept across the country, the school’s leadership team realized the safest thing to do was to move to primarily virtual learning and services. And since the school already utilized Microsoft 365, they realized that Microsoft Teams for Education had everything they needed to create a rich virtual learning environment.

Teams provided the kind of integrated communications experience and accessibility features the Loom community was accustomed to even with virtual instruction. Features such as the Whiteboard app, YouTube for Teams, screen sharing, and chat kept students engaged and included.

“When you work with kids with special needs, it’s just so important to have an emotional connection and build a great learning group. Teams does that for our school.” – Katrina Todd, Executive Director, The Loom School

Newmark Education: Leaving its mark on a new world of learning

Founded by Dr. Regina Peter and Cynthia Allman in 2001, New Jersey’s Newmark Education K-8 and High School is committed to the academic and personal success of students with behavioral disorders and disabilities. And when COVID-19 led Newmark to suspend in-person learning, the school was well-prepared to transition to a remote learning environment, thanks to dedication, a 1:1 program, and Microsoft Teams.

Early investment in Microsoft Teams enabled a smooth and speedy transition. OneDrive—perfect for students who needed to develop executive functioning skills like organization and time management—and the Insights tab—allowing educators to be more efficient with response time and feedback—worked to enable remote learning and increase engagement. Beyond classroom content, Newmark has also used Teams to meet the mental health needs of those students: creating social groups for students helped them to connect with each other through Teams when not in class.

“The number one thing is using Teams to stay connected, because there’s nothing like human connection.” – Dr. Regina Peter, Founder of Newmark Education

Hamlin Robinson School: Empowering students with inclusive function

Seattle, Washington’s Hamlin Robinson School serves students with dyslexia and other language-based learning differences. After roughly a week into pandemic-necessitated distance learning, the school realized they needed a more robust solution than sending home packets of schoolwork.

Hamlin Robinson School was drawn to Microsoft resources because of built-in accessibility features. Students who had trouble typing, for instance, used the Dictate tool, or speech-to-text, a function of Office 365. These learning and accessibility tools are embedded across Microsoft 365 products and can support students with visual impairments, hearing loss, and cognitive disabilities.

“[Microsoft] Teams seems to be easiest platform for our students to use in terms of the way it’s organized and its user interface. The fact that a student could have an assignment issued to them, could use the accessibility tools, complete the assignment, and then return the assignment all within Teams is what made it clear that this was going to be the right app for our students.” – Josh Phillips, Head of Middle School, Hamlin Robinson

Tools built for accessibility

Microsoft 365 and Microsoft Teams for Education support accessible learning experiences whether online, blended, or in-person.

Word, PowerPoint, OneNote, and Microsoft Teams go beyond screen reading, providing alternative pathways to foster comprehension. Through built-in tools, like Immersive Reader, students have access to supports such as line focus, translation, and picture dictionary.
Tools such as dictation in Word and OneNote can make the digital world more accessible for students with dyslexia or other cognitive differences.
For students who are hard of hearing, have hearing loss, or have deafness, Microsoft’s specialized features can provide solutions including live captions and live transcriptions in Teams, with translation and mono sound.
Accessibility Checker offers inspection results and recommended actions to help ensure files are accessible for everyone in Microsoft Word, PowerPoint, Excel, OneNote, and Outlook.

Windows 11 built-in accessibility features empower every student to fully participate in learning.

Vision features. Students can view content in a way that makes sense to them or skip the screen entirely. Narrator, Windows built-in screen reader, simplifies navigation and describes images for students in a natural, human-sounding voice.
Hearing features. Students can take in every word from any audio with Windows 11 live captions.
Mobility features. Voice access, eye control, and voice typing empower students to interact with their devices in a way that fits their unique needs.
Neurodiversity and learning features. Students can use tools to enhance focus, attention, and reading comprehension, while building healthy digital habits and boosting productivity with Focus sessions.

Microsoft believes accessibility is essential to the progress of all people. Accessible technologies help students with disabilities unlock their full potential. Students are growing, changing, and adapting to the world around them every day. Microsoft designs their tools to reflect that diversity.

Learn more about accessible tools and features in the following blog posts:

Posted on December 2, 2022 by — Leave a comment

The metaverse: An evolution in transportation, travel and hospitality

The amount of hype around the metaverse is overwhelming

It has been 30 years since author Neal Stephenson’s sci-fi novel Snow Crash appeared and the term metaverse was coined. During that timeframe, we have seen the launch of online networks that embody many of the metaverse’s most important concepts, without ever using the term.

The rebranding of Facebook to Meta in October 2021 significantly increased metaverse conversation, and the hype has been driven by a variety of technology players preemptively claiming to be metaverse companies or to be creating a metaverse.

Metaverse is one of the latest technology buzzwords to hit the headlines. What is it and will it revolutionize everything? The answer is yes, no, and maybe. Is it simply the latest phase in the evolution of business transformation? Certainly, the metaverse expands the traditional notion of an ecosystem into a 21st-century virtual business, social, and collaborative interaction space.

Microsoft for Automotive

Accelerating the future of mobility.

I hope to shed a bit of light and stimulate conversation about this latest evolution of the internet.

What is the metaverse?

According to Matthew Ball—venture capitalist and author—the metaverse is a massively scaled and interoperable network of real-time rendered 3D virtual worlds that can be experienced synchronously and persistently by an effectively unlimited number of users with an individual sense of presence, and with continuity of data, such as identity, history, entitlements, objects, communications, and payments.¹

We see it as a set of technologies that allow for persistent digital representation, connected to aspects of the real world. Meta means, “beyond,” and verse means “universe.” Together, the metaverse refers to a virtual world parallel to the real world that can be experienced more completely with technologies such as augmented reality (AR) and virtual reality (VR). These virtual worlds will connect to a social system and fully functioning economy in which data, digital goods, content, and intellectual property (IP) can pass, and individual users, organizations, and companies can create content and goods to ensure that the metaverse continues to expand and evolve.

In 2014, Microsoft acquired Mojang Studios, which launched Minecraft, for $2.5 billion (about $8 per person in the United States) and over time, made virtual reality versions available on Oculus Rift, PlayStation, and Microsoft HoloLens.

The beauty of Minecraft is that like Lego blocks, it offers infinite possibilities within an infinite digital space to allow anyone to create their own metaverse. With over 130 million monthly users, Minecraft is but one early example of the metaverse impacting our daily lives.

The metaverse: An evolution of the internet

The metaverse will not fundamentally replace the internet, but instead, build upon and iteratively transform it. It is a logical evolution of the internet. Just like fixed-line internet ushered in the age of personal computing and mobile internet increased the proliferation of content and access to the internet, the metaverse will place everyone inside a “virtual” version of the internet on a continuous basis. It will enable us to constantly be “within” the internet, creating more immediate experiences.

Technology is extending the imagination boundary

From a technical standpoint, the building blocks of the metaverse, VR, AR, AI, and blockchain are rapidly evolving. VR enables the use of computer simulation to generate a three-dimensional space of the virtual world, and a way to provide the user the visual and other sensory stimulation to feel as if they are in the real world.

Identity and the economic system will leverage blockchain technology to establish credibility. As a distributed database or ledger shared among computer network nodes, blockchain guarantees the accuracy and security of a record of data without the need for a trusted third party.

To ensure the plurality of the metaverse, edge computing technology is needed to ensure a consistent experience for all users.

Metaverse use cases

A quick web search for metaverse shows increased mentions across the entire mobility sector. Microsoft is also active in this space by supporting both the consumer and industrial metaverse. A recent announcement mentioned how Microsoft and Meta are partnering to deliver immersive experiences for the future of work and play. And, at the Microsoft Ignite conference in September, examples of current industrial metaverse applications were shared, like Kawasaki Heavy Industries demonstrating metaverse enabling collaborative spaces for engineers, service technicians, and frontline workers utilizing the Internet of Things (IoT), digital twins, and mixed reality.

Metaverse in automotive

We see the convergence of digital and physical worlds evolving in the automotive industry in areas including virtual vehicle design and physical production, led by real-time collaboration on engineering design and materials.

In manufacturing and supply chain operations, the metaverse and digital twin models are enabling rapid production processes that require significantly less physical testing, improving efficiency. This results in reduced risk and improved quality control with detailed, physics-based designs to shrink the margin of error for production. A metaverse-based digital twin can also be used to streamline and optimize supply chain management, from product design through procurement, manufacturing, and inventory.

With vehicle sales, the metaverse is bridging the gap between the dealership and customers opting for online purchasing. 2D and 3D solutions in this space are offering virtual viewing of vehicles, test drives, and explanations of complex technology features to create a more fluid customer journey and buying experience for consumers.

Opportunities to enhance the in-car customer experience are also being explored. Entertainment, gaming, and productivity are all potential opportunities that can engage vehicle occupants where appropriate. When it comes to service, the metaverse is accelerating the upskill of existing technicians and enabling remote virtual diagnostics and repair of vehicles. This touchless, frictionless approach will result in greater customer satisfaction to improved customer retention.

Metaverse in transportation

While some argue that the metaverse will enable more satisfying virtual social interaction and therefore less need for physical mobility, others look towards a more efficient multi-modal mobility future.

The metaverse will enable intelligently networked, constantly evolving, and integrated multi-modal transportation networks. By leveraging digital twins of physical infrastructure like airports and major roadway systems, all the way down to transit infrastructure, the coordination of transporting people and goods will improve dramatically. With AI automation dynamically creating less friction between origins, stops, and destinations, travelers will plan and execute journeys across multiple transportation modes in an increasingly more cost-effective and efficient manner as these services become part of the larger metaverse network.

Metaverse in travel and hospitality

While the metaverse cannot replace travel, it can enable the travel industry to provide enhanced experiences and the opportunity to engage with the customer more deeply with new and unexpected adventures.

The metaverse will help the hospitality business meet evolving guest expectations. In the area of pre-travel planning, a virtual concierge can enable travelers to take virtual, three-dimensional walkthroughs of hotel room options, airport terminals, destinations, and attractions. The objective will be to provide travelers with options and a clear idea of what they might expect when they visit their destination. This will enhance the booking experience, improve guest satisfaction, and increase booking volume.

Status—where are we now?

As I have shared, there are several examples of actual metaverse scenarios impacting the industry today. There are also many opportunities yet to be explored as the technology is still in its initial stages. As these examples continue to develop, we see metaverse experiences classified as industrial or consumer metaverse, further defining the intended applications. In either application, removing walled gardens is important to ensure continued growth and adoption. This means that the metaverse will require a mutually agreed-upon set of underlying standards that make it possible for people to live, work, and play in the metaverse together and to move between different instances with persistent digital identities and profiles.

Other key elements will include the creator economy, universally accepted rules of behavior, recognition of digital currencies and a means of converting them into real-world currencies, digital object ownership rights, security standards and processes, and Web 3.0.

Web 3.0 and the metaverse

In Web 1.0, internet browsers connected everyone online. Web 2.0 extended this connectivity and has revolutionized the availability, speed, and access to information and transformed the way we connect and interact with people and the world around us.

Web 3.0 is known as the next generation of the internet. It will introduce new capabilities such as blockchain with aspirations to become more equitable, transparent, and decentralized, concentrating the power (and data) in the hands of users, instead of entities. It will analyze, understand, intelligently integrate, and interpret information to provide users with an enhanced, hyper-personalized, and interactive experience.

While Web 3.0 is focused on who will own and control tomorrow’s decentralized internet, the metaverse is focused on new ways in which users will experience the internet of the future. Web 3.0 and the metaverse complement each other, with Web 3.0 serving as the basis for connectivity in the metaverse, and the creator economy in the metaverse supplementing the vision of Web 3.0.

What’s next

We have only begun to scratch the surface of possibilities with the metaverse. It will continue to be an evolving platform that will dramatically change the way we interact with the world around us. From an industrial metaverse or consumer metaverse point of view, we see growing interest, application, and exploration of metaverse capabilities in the broader mobility industry, and with adjacent industries like retail, banking and insurance, and energy as well. The future may well be shaped by the visions created within the metaverse today.

¹Framework for the Metaverse, The Metaverse Primer, MatthewBall.vc.

Initial compromise

Weaponized Excel file analysis

Extracted worksheet

Loader analysis

Logagent.exe

Wsock32.dll

Related attack

Implant analysis

Infrastructure

Defending against targeted attacks

Detection details

Microsoft Defender Antivirus

Microsoft Defender for Endpoint

Advanced hunting queries

Microsoft Sentinel

Indicators of compromise

MITRE ATT&CK techniques

Use coding to solve puzzles in Minecraft Hour of Code: Escape Estate

Teach with Hour of Code

Register for Free Hour of Code Student Workshop

Build CS knowledge and connect with experts during Flip live events

Build a better world with code

Creating equity in computer science

Design exciting games with Code a Carnival and Wakanda Forever from MakeCode

Learn alongside the Code Ninjas

Microsoft Quantum Innovator Series: Why and what is the future of the topological qubit?

Microsoft Quantum Innovator Series: What kind of problems can we solve today with quantum simulation?

Microsoft Quantum Innovator Series

Managing PDFs in Microsoft Teams with Adobe Acrobat

Set Adobe Acrobat as the default PDF experience for Microsoft Teams

Building on a foundation of security and trust

Moving forward

Microsoft Research Summit 2022

Uni[MASK]: Unified Inference in Sequential Decision Problems

K-LITE: Learning Transferable Visual Models with External Knowledge

Extreme Compression for Pre-trained Transformers Made Simple and Efficient

On the Complexity of Adversarial Decision Making

Maximum Class Separation as Inductive Bias in One Matrix

Censored Quantile Regression Neural Networks for Distribution-Free Survival Analysis

Learning (Very) Simple Generative Models Is Hard

Profiles in inclusive learning

The Loom School: Virtual solutions for real-world results

Newmark Education: Leaving its mark on a new world of learning

Hamlin Robinson School: Empowering students with inclusive function

Tools built for accessibility

The amount of hype around the metaverse is overwhelming

Microsoft for Automotive

What is the metaverse?

The metaverse: An evolution of the internet

Technology is extending the imagination boundary

Metaverse use cases

Metaverse in automotive

Metaverse in transportation

Metaverse in travel and hospitality

Status—where are we now?

Web 3.0 and the metaverse

What’s next