December 12, 2024

Frequent freeloader part II: Russian actor Secret Blizzard using tools of other groups to attack Ukraine

After co-opting the tools and infrastructure of another nation-state threat actor to facilitate espionage activities, as detailed in our last blog, Russian nation-state actor Secret Blizzard […]
December 5, 2024

Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage

Based on both Microsoft Threat Intelligence’s findings and those reported by governments and other security vendors, we assess that the Russian nation-state actor tracked as Secret […]
November 23, 2024

Microsoft shares latest intelligence on North Korean and Chinese threat actors at CYBERWARCON

This year at CYBERWARCON, Microsoft Threat Intelligence analysts are sharing research and insights representing years of threat actor tracking, infrastructure monitoring and disruption, and attacker tooling. […]
November 1, 2024

Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network

Since August 2023, Microsoft has observed intrusion activity targeting and successfully stealing credentials from multiple Microsoft customers that is enabled by highly evasive password spray attacks. […]
September 27, 2024

Storm-0501: Ransomware attacks expanding to hybrid cloud environments

Microsoft has observed the threat actor tracked as Storm-0501 launching a multi-staged attack where they compromised hybrid cloud environments and performed lateral movement from on-premises to […]
July 30, 2024

Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption

Microsoft researchers have uncovered a vulnerability in ESXi hypervisors being exploited by several ransomware operators to obtain full administrative permissions on domain-joined ESXi hypervisors. ESXi is […]