Researchers have found a malicious driver signed by Microsoft used in the lead up to Hive and Cuba ransomware deployments.
Microsoft did not give further details about the exploitation efforts against the flaws disclosed on Tuesday.
Nation-state actors are targeting critical infrastructure, the IT supply chain and unpatched flaws in an effort to advance evolving strategic political objectives and to reach a wider set of targets.
Details have been disclosed on a remote code execution flaw in Azure Cosmos DB, which was previously fixed by Microsoft in October.
Microsoft is adding number matching and geographic and app context to Authenticator to defend against MFA fatigue attacks.