The Microsoft Digital Defense Report 2025 shows how threats are evolving faster than ever, fueled by AI. msft.it/63322sf3y4 Key insights from report include: - More than 50% of cyberattacks with known motives had financial objectives such as extortion or ransom.

In early October 2025, Microsoft disrupted a Vanilla Tempest campaign by revoking over 200 certificates that the threat actor had fraudulently signed and used in fake Teams setup files to deliver the Oyster backdoor and ultimately deploy Rhysida ransomware.

The October 2025 security updates are available: msft.it/6018SZEg0. #PatchTuesday #SecurityUpdateGuide

“Security begins and ends with people.” Learn how Microsoft has made security culture a company-wide imperative, reinforcing vigilance, embedding secure habits into everyday work, and achieving what technology alone cannot, via @ajohnsocyber.bsky.social: msft.it/63325sNpfJ

Microsoft Threat Intelligence has observed a financially motivated threat actor, Storm-2657, compromising employee accounts to gain unauthorized access to profiles and divert salary payments to attacker-controlled accounts. msft.it/63320sFB5j

The highly modular backdoor PipeMagic and the RaaS offering Medusa both exemplify how threats continuously evolve. The latest Microsoft Threat Intelligence Podcast episode features a threat landscape update with a deep dive on these threats: msft.it/63322s0k2o

Threat actors seek to abuse Microsoft Teams features and capabilities at different points along the attack chain. Learn about countermeasures and controls across identity, endpoints, data apps, and network layers to help harden enterprise Teams environments. msft.it/63328sLUZs

Storm-1175, a financially motivated actor known for deploying Medusa ransomware & exploiting public-facing applications, was observed exploiting the CVE-2025-10035 vulnerability in GoAnywhere MFT's License Servlet. Read our analysis & get detection+hunting guidance: msft.it/63325sIfZZ

The nature of incident response is its chaos, and the second chapter of our four-part Inside Microsoft Threat Intelligence miniseries displays how Microsoft’s IR team thrives amid disorder, stepping in when environments are compromised and confidence is shaken: msft.it/63322svfky

You can now build your own Security Copilot agents. The Security Copilot portal features a no-code agent builder that lets you describe what you need in natural language and create, optimize, and publish agents tailored to your workflows in minutes. msft.it/63325svuQL

Microsoft Sentinel is evolving into both the SIEM and the platform for agentic defense with the general availability of Sentinel data lake, and the public preview of Sentinel graph and Sentinel Model Context Protocol (MCP) server: msft.it/63327svJHJ

Microsoft Threat Intelligence has uncovered a new variant of the XCSSET malware, which is designed to infect Xcode projects, typically used by software developers building Apple or macOS-related applications. msft.it/63320sS0R0

Attackers are leveraging AI and bots to create phishing campaigns that are more tailored than ever. Using these tools for domain impersonation, typosquatting, and other tactics, attackers can tailor a phishing attack directly to one individual – and do that at scale. msft.it/63320sSdmM

Microsoft Threat Intelligence recently detected and blocked a credential phishing campaign that likely leveraged AI-generated code to obfuscate its payload and evade traditional defenses. msft.it/63323sSBWN

GitHub is strengthening npm security with stricter authentication, granular tokens, and enhanced trusted publication. This is in response to the surge of account takeovers on package registries like npm. msft.it/63325sqQ71

"Microsoft Threat Intelligence is fully focused on disrupting threat actor activity." The first of a four-part Inside Microsoft Threat Intelligence miniseries gives behind-the-scenes look at how Microsoft's Digital Crimes Unit disrupted Storm-1152: msft.it/63327sWnGF

Microsoft’s Digital Crimes Unit (DCU) has disrupted the phishing-as-a-service (PhaaS) platform RaccoonO365, seizing 338 related websites, disabling infrastructure, and disrupting communications between the criminal network and victims. msft.it/63324smYC2

The threat landscape is evolving, with longer, more complex attack chains and persistent adaptation by cybercriminals. msft.it/63327scEub

The September 2025 security updates are available: msft.it/6018SZEg0

Threat actors like Storm-0501 target Azure Storage accounts to exfiltrate data from compromised environments to external infrastructure under their control. During security breaches, Azure Storage logs provide invaluable insights for digital forensics: msft.it/63320s5Ig4

Microsoft's Quantum Safe Program (QSP) is a significant step in preparing for the quantum computing era with a security-first mindset. Learn about Microsoft QSP from @markrussinovich.bsky.social and Michal Braverman-Blumenstyk: msft.it/63323seseN

Recorded live at Black Hat 2025, this Microsoft Threat Intelligence Podcast dives into ransomware and the threat actor ecosystem, responsible vulnerability disclosure, bug bounties, and Zero Day Quest, and social engineering and AI. msft.it/63329swWwV

The financially motivated threat actor Storm-0501 has continuously evolved to achieve sharpened focus on cloud-based TTPs as their primary objective shifted from deploying on-premises endpoint ransomware to using cloud-based ransomware tactics. msft.it/63326sZC6E

The ClickFix social engineering technique has grown in popularity. This technique exploits users’ tendency to resolve technical issues by tricking them into running malicious commands that deliver payloads ultimately leading to information theft and exfiltration. msft.it/63321snbwF

PipeMagic is a sophisticated malware framework with a modular, stealthy, and highly extensible architecture, giving threat actors granular control over code execution and making detection and analysis challenging. msft.it/63321spbNh

The August 2025 security updates are available: msft.it/6018SZEg0

Real-time collaboration between incident response and threat intelligence teams is critical for mounting an effective defense against today’s cyber threats. The process relies on actionable intel to guide every step, from initial investigation to containment. msft.it/63322sOR1I

Project Ire, an autonomous AI agent, automates what’s considered the gold standard in malware classification: fully reverse engineering a software file without any clues about its origin or purpose: msft.it/63325sMSoc

A new Microsoft report finds that the long-running threat group has gained positions on state-aligned ISPs and Russian telecoms, while tricking foreign embassy staff to download custom malware. via @mattkapko.com cyberscoop.com/russia-secre...

Microsoft Threat Intelligence has uncovered a cyberespionage campaign by the Russian state actor we track as Secret Blizzard targeting embassies in Moscow using an adversary-in-the-middle (AiTM) position to deploy their custom ApolloShadow malware. msft.it/63320sJmHK

Here are the ways you can interact with Microsoft at #BHUSA 2025: On the main stage, Microsoft Threat Intelligence experts share behind-the-scenes insights in “Unmasking Cyber Villains: How Microsoft Stays Ahead of the World's Most Dangerous Hackers”: msft.it/63322syXVM

Microsoft Threat Intelligence uncovered a macOS vulnerability that could allow attackers to steal private data of files normally protected by TCC, such as caches used by Apple Intelligence. msft.it/63327sHUSJ

Microsoft Defender Threat Intelligence (MDTI) is converging directly into Defender XDR and Microsoft Sentinel, providing real-time TI within a unified SecOps experience and granting customers access to Microsoft’s extensive repository of raw & finished threat intelligence: msft.it/6045sGrP9

Microsoft’s Digital Crimes Unit (DCU) shares the insider story of the successful global takedown of Lumma Stealer—a stealthy, customizable malware that quietly infected nearly 400,000 Windows devices worldwide, stealing passwords and sensitive data. msft.it/63325sGHE7

We updated our blog with expanded analysis and threat intelligence from newly observed activity by Storm-2603 leading to the deployment of Warlock ransomware. msft.it/63320s134O

Microsoft is sharing details from ongoing investigations of threat actors exploiting vulnerabilities targeting on-premises SharePoint servers. Linen Typhoon, Violet Typhoon, and Storm-2603 have been observed exploiting the vulnerabilities: msft.it/6044sE1ua

Update: Microsoft has released security updates that fully protect customers using all supported versions of SharePoint affected by CVE-2025-53770 and CVE-2025-53771. Customers should apply these updates immediately. Full guidance and detection details: msft.it/6010sDzSE.

Update on CVE-2025-53770: Microsoft has released a security update for SharePoint Subscription Edition to mitigate active attacks targeting on-premises servers. SharePoint Online is not affected. Customers should apply the update immediately. Full guidance and detection details: msft.it/6041sDzS1

Microsoft is aware of active attacks targeting on-premises SharePoint Server customers, exploiting a variant of CVE-2025-49706. This vulnerability has been assigned CVE-2025-53770. We have outlined mitigations and detections in our blog: msrc.microsoft.com/blog/2025/07...

Black Hat NOC lead @grifter801.bsky.social & Hacker Jeopardy host @lintile.lol join Sherrod DeGrippo to share behind-the-scenes insights on managing one of the world’s most hostile networks, advice for first-time attendees, & tips on exploring the hacker community. https://msft.it/63328SAW9G

The July 2025 security updates are available: https://msft.it/63328SA8ri #PatchTuesday

Since 2024, Microsoft has observed remote IT workers deployed by North Korea leveraging AI to improve the scale and sophistication of operations, steal data, and generate revenue for the North Korean government. Learn more and get protection and hunting guidance: https://msft.it/63322SFjwA

Today, Microsoft Threat Intelligence Center is proud to announce the release of RIFT, an open-source tool designed to assist malware analysts automate the identification of attacker-written code within Rust binaries. https://msft.it/63324SLarg

Key points of intersection between red teaming & threat intel include the narrative basis on how threat actors conduct their attacks, use of threat data to measure effectiveness, & continuous exploration of emerging threats and ways to test & beat new technology. https://msft.it/63320SIdYw

Microsoft has continuously observed hybrid attacks leading to espionage, business interruption, and ransomware deployment that involve threat actors moving from on-premises environments to the cloud.

While Golden SAML (Security Assertion Markup Language) attacks are less frequently observed than others, their impact can be huge. Whereas an adversary-in-the-middle (AiTM) attack only affects the account that got phished, a successful Golden SAML attack could compromise every account in an org.

The latest episode of Microsoft Threat Intelligence Podcast, recorded live at RSAC 2025, Sherrod DeGrippo, Jeremy Dallman, & Steven Masada discuss focusing on techniques and the cybercrime supply chain to disrupt multiple actors, such as Star Blizzard's operations. https://msft.it/63323SqocV

In this episode of Afternoon Cyber Tea with Ann Johnson, Yonatan Zunger, CVP and Deputy CISO for AI at Microsoft, talks about the developments in AI that most reshaped cybersecurity and the risk landscape. https://msft.it/63325SWAG9