Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2026-07-31 ⋅ Microsoft Threat Intelligence
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
ChocoShell CornFlake Storm-2945
2026-05-19 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Exposing Fox Tempest: A malware-signing service operation (Podcast)
Akira Rhysida Akira BlackByte BlueSky Broomstick Lumma Stealer Rhysida Spyder Vidar Fox Tempest
2026-05-14 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Kazuar: Anatomy of a nation-state botnet
Kazuar
2026-04-07 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks
2026-03-12 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft
Storm-2561
2026-03-06 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
AI as tradecraft: How threat actors operationalize AI
OtterCookie
2026-01-14 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Inside RedVDS: How a single virtual desktop provider fueled worldwide cybercriminal operations
2025-12-01 ⋅ LinkedIn (Microsoft) ⋅ Microsoft Threat Intelligence
Post about Phishing Campaign pushing XWorm
XWorm TA584
2025-10-09 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Investigating targeted “payroll pirate” attacks affecting US universities
Storm-2657
2025-10-06 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Investigating active exploitation of CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability
Medusa Storm-1175
2025-07-31 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats
ApolloShadow
2025-07-22 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Disrupting active exploitation of on-premises SharePoint vulnerabilities
Storm-2603
2025-06-30 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Jasper Sleet: North Korean remote IT workers’ evolving tactics to infiltrate organizations
2025-05-27 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
New Russia-affiliated actor Void Blizzard targets critical sectors for espionage
Void Blizzard
2025-04-23 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Understanding the threat landscape for Kubernetes and containerized assets
Storm-1977
2025-04-08 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Exploitation of CLFS zero-day leads to ransomware activity
RansomEXX Storm-2460
2025-04-03 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Threat actors leverage tax season to deploy tax-themed phishing campaigns
Brute Ratel C4 CloudEyE Latrodectus Remcos Storm-0249
2025-03-06 ⋅ Twitter (@MsftSecIntel) ⋅ Microsoft Threat Intelligence
Tweet about Moonstone Sleet dropping Qilin ransomware
Qilin
2025-03-05 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Silk Typhoon targeting IT supply chain
2025-02-13 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Storm-2372 conducts device code phishing campaign
Storm-2372