Microsoft Threat Intelligence – Experimental News Clipping Site

Microsoft Security Blog: Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats

Jul 31, 2025

—

by

Source URL: https://www.microsoft.com/en-us/security/blog/2025/07/31/frozen-in-transit-secret-blizzards-aitm-campaign-against-diplomats/ Source: Microsoft Security Blog Title: Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats Feedly Summary: Microsoft Threat Intelligence has uncovered a cyberespionage campaign by the Russian state actor we track as Secret Blizzard that has been ongoing since at least 2024, targeting embassies in Moscow using an adversary-in-the-middle (AiTM) position to…

Microsoft Security Blog: Sploitlight: Analyzing a Spotlight-based macOS TCC vulnerability

Jul 28, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.microsoft.com/en-us/security/blog/2025/07/28/sploitlight-analyzing-a-spotlight-based-macos-tcc-vulnerability/ Source: Microsoft Security Blog Title: Sploitlight: Analyzing a Spotlight-based macOS TCC vulnerability Feedly Summary: Microsoft Threat Intelligence has discovered a macOS vulnerability, tracked as CVE-2025-31199, that could allow attackers to steal private data of files normally protected by Transparency, Consent, and Control (TCC), including the ability to extract and leak sensitive information…

Microsoft Security Blog: Jasper Sleet: North Korean remote IT workers’ evolving tactics to infiltrate organizations

Jun 30, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.microsoft.com/en-us/security/blog/2025/06/30/jasper-sleet-north-korean-remote-it-workers-evolving-tactics-to-infiltrate-organizations/ Source: Microsoft Security Blog Title: Jasper Sleet: North Korean remote IT workers’ evolving tactics to infiltrate organizations Feedly Summary: Since 2024, Microsoft Threat Intelligence has observed remote IT workers deployed by North Korea leveraging AI to improve the scale and sophistication of their operations, steal data, and generate revenue for the North…

Microsoft Security Blog: Unveiling RIFT: Enhancing Rust malware analysis through pattern matching

Jun 27, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.microsoft.com/en-us/security/blog/2025/06/27/unveiling-rift-enhancing-rust-malware-analysis-through-pattern-matching/ Source: Microsoft Security Blog Title: Unveiling RIFT: Enhancing Rust malware analysis through pattern matching Feedly Summary: Threat actors are adopting Rust for malware development. RIFT, an open-source tool, helps reverse engineers analyze Rust malware, solving challenges in the security industry. The post Unveiling RIFT: Enhancing Rust malware analysis through pattern matching appeared…

Microsoft Security Blog: New Russia-affiliated actor Void Blizzard targets critical sectors for espionage

May 27, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/ Source: Microsoft Security Blog Title: New Russia-affiliated actor Void Blizzard targets critical sectors for espionage Feedly Summary: Microsoft Threat Intelligence has discovered a cluster of worldwide cloud abuse activity conducted by a threat actor we track as Void Blizzard, who we assess with high confidence is Russia-affiliated and has been active since…

Microsoft Security Blog: Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer

May 21, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/ Source: Microsoft Security Blog Title: Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer Feedly Summary: Over the past year, Microsoft Threat Intelligence observed the persistent growth and operational sophistication of Lumma Stealer, an info-stealing malware used by multiple financially motivated threat actors to target various industries. Microsoft,…

Microsoft Security Blog: Marbled Dust leverages zero-day in Output Messenger for regional espionage

May 12, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.microsoft.com/en-us/security/blog/2025/05/12/marbled-dust-leverages-zero-day-in-output-messenger-for-regional-espionage/ Source: Microsoft Security Blog Title: Marbled Dust leverages zero-day in Output Messenger for regional espionage Feedly Summary: Since April 2024, the threat actor that Microsoft Threat Intelligence tracks as Marbled Dust has been observed exploiting user accounts that have not applied fixes to a zero-day vulnerability (CVE-2025-27920) in the messaging app Output…

Microsoft Security Blog: Understanding the threat landscape for Kubernetes and containerized assets

Apr 23, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.microsoft.com/en-us/security/blog/2025/04/23/understanding-the-threat-landscape-for-kubernetes-and-containerized-assets/ Source: Microsoft Security Blog Title: Understanding the threat landscape for Kubernetes and containerized assets Feedly Summary: The dynamic nature of containers can make it challenging for security teams to detect runtime anomalies or pinpoint the source of a security incident, presenting an opportunity for attackers to stay undetected. Microsoft Threat Intelligence has…

Microsoft Security Blog: Exploitation of CLFS zero-day leads to ransomware activity

Apr 8, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.microsoft.com/en-us/security/blog/2025/04/08/exploitation-of-clfs-zero-day-leads-to-ransomware-activity/ Source: Microsoft Security Blog Title: Exploitation of CLFS zero-day leads to ransomware activity Feedly Summary: Microsoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC) have discovered post-compromise exploitation of a newly discovered zero-day vulnerability in the Windows Common Log File System (CLFS) against a small number of targets. Microsoft released…

Microsoft Security Blog: Phishing campaign impersonates Booking .com, delivers a suite of credential-stealing malware

Mar 13, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.microsoft.com/en-us/security/blog/2025/03/13/phishing-campaign-impersonates-booking-com-delivers-a-suite-of-credential-stealing-malware/ Source: Microsoft Security Blog Title: Phishing campaign impersonates Booking .com, delivers a suite of credential-stealing malware Feedly Summary: Starting in December 2024, leading up to some of the busiest travel days, Microsoft Threat Intelligence identified a phishing campaign that impersonates online travel agency Booking.com and targets organizations in the hospitality industry. The…

Tag: Microsoft Threat Intelligence