Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

In this article 1. Who is Storm-2570? 2. Storm-2570 attack chain: From initial foothold to impact 3. What Storm-2570 activity means for defenders 4. Mitigation and protection guidance 5. Microsoft Defender detections 6. Hunting queries Activity associated with Storm-2570, a ransomware affiliate...

New IDC research highlights a major cloud security shift

Cloud security is at a tipping point. While moving to the cloud powers both growth and speed for organizations, it can also bring new risks. According to IDC’s latest research, organizations experienced an average of nine cloud security incidents in 2024, with 89% reporting a year-over-year...

Insights from the 2026 Microsoft Digital Defense Report

Every year, the Microsoft Digital Defense Report gives us an opportunity to step back from individual threats and look broadly at what Microsoft’s security and threat intelligence teams are seeing. Today, we released the 2026 Report, which reflects a security environment that continues to grow mo...

Phishing Abuses RMM Tools for Persistent Access

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Learn More In July 2026, Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries that distributed a masqueraded MSP360 Remote Monitoring and Management RMM installer...

Inside a malicious Claude Code-branded extension and its persistent SSH backdoor

In this article 1. Attack chain overview 1. Attack chain 2. Host reconnaissance collection 3. SSH authorization and tunnel identities 4. Protocol Tunneling T1572: reverse SSH forwarding 5. Platform-specific startup persistence 2. Mitigation and protection guidance 1. Immediate actions 2...

Preparing governments for an era of interconnected cyber risk

According to this year’s Microsoft Digital Defense Report, government agencies and services were the sector most impacted by cyber threats in 2026, accounting for 27% of observed activity, up from 17% in 2025. Governments are also the most frequently targeted sectors for nation-state activity. Th...

Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. References 4. Learn More Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570 , an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notificatio...

Tracking AI adoption in North Korean threat actor tradecraft

In this article 1. Stages of AI adoption by North Korean threat actors 2. AI use across North Korean threat operations 1. AI-assisted targeting and reconnaissance 2. AI-assisted social engineering and identity deception 3. AI-assisted software and tooling development 4. AI-assisted operational...

CISO perspectives on managing vulnerability risks in the age of AI

Most of what has been written about AI and vulnerability management focuses on speed: how much faster frontier AI models can scan code, find weaknesses, design patches, and build exploits than any human team. That part is true, and it matters to how we remediate vulnerabilities. The more...

Protecting organizations from AI-assisted executive impersonation and invoice fraud

In this article 1. Attack chain overview 1. Email Delivery 2. Domain registration 3. Generative AI usage 2. Mitigation and protection guidance 1. Microsoft Defender detections 2. Microsoft Security Copilot 3. Threat intelligence reports 4. MITRE ATT&CK Techniques observed 5. Indicators of...

AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise

In this article 1. What’s happening 2. What is ARTEX? 3. Mitigation and protection guidance 4. References 5. Learn more As early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of...

IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor Assessment

Today, we're proud to share thatMicrosoft has been named a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises Doc US54123526, September 2026. The IDC Marketscape calls out three strengths that we believe matter most in endpoint security today: Autonomous...

The CISO’s evolving role: Protecting and defending in the agentic era

October is Cybersecurity Awareness Month, and it's a good time to think about how much the world has changed for chief information security officers CISOs in the last 12 months. A year ago, we thought we were already in the thick of AI and starting to understand it. Since then, agents have spread...

From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

In this article 1. Activity overview 2. Attack chain overview 3. Portable runtime staging and execution variants 4. Host discovery and AD CS assessment 5. Case 1: ESC1 abuse and the cost of an identity exclusion 6. Case 2: PetitPotam and ESC8 turn a workstation into a domain-controller identity 7...

What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks

In this article 1. Classifying the vulnerability landscape 2. Vulnerabilities exploited in the wild 3. Where defenders should focus 1. Patching is slow, while exploitation is fast 2. Impact, exposure and where to focus 3. Next in line 4. How Microsoft Security helps defenders act 5. References 6...

Fake-download campaign uses trojanized installers to deliver monetization payloads

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Learn More Microsoft Threat Intelligence has identified an evolving fake-download campaign targeting users searching for cracked commercial software, free games, activators, plugins, and unofficial utilities. The...

Microsoft named a Leader in the 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms

Microsoft has been named a Leader in the inaugural 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms. We believe this recognition reflects Microsoft’s approach to helping organizations manage, secure, and scale their AI investments through Microsoft Agent 365. Figure 1: Gartner, Mag...