Clik here to view.
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across...
In this article Who is Storm-2570?Storm-2570 attack chain: From initial foothold to impactWhat Storm-2570 activity means for defendersMitigation and protection guidanceMicrosoft Defender...
View ArticleClik here to view.
Unmasking EvilTokens: Getting to the root of device code phishing
In this article What is device code phishing?EvilTokens platform and operationsEvilTokens phishing emailsMitigation and protection guidanceMicrosoft Defender XDR detectionsHunting queries Following...
View ArticleClik here to view.
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware...
In this article The CaptiveCrunch campaignStorm-2945 and Midnight BlizzardCaptiveCrunch tradecraft and toolingHow to protect against CaptiveCrunch activityMicrosoft Defender detections and hunting...
View ArticleClik here to view.
Kazuar: Anatomy of a nation-state botnet
In this article DeliveryModule typesBotnet operationsWho is Secret Blizzard?Mitigation and protection guidanceMicrosoft Defender detections Kazuar, a sophisticated malware family attributed to the...
View ArticleClik here to view.
Kazuar: Anatomy of a nation-state botnet
In this article DeliveryModule typesBotnet operationsWho is Secret Blizzard?Mitigation and protection guidanceMicrosoft Defender detections Kazuar, a sophisticated malware family attributed to the...
View ArticleClik here to view.
SOHO router compromise leads to DNS hijacking and adversary-in-the-middle...
In this article DNS hijacking attack chain: From compromised devices to AiTM and other follow-on activityMitigation and protection guidanceMicrosoft Defender detection and hunting guidance Executive...
View ArticleClik here to view.
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware...
In this article The CaptiveCrunch campaignStorm-2945 and Midnight BlizzardCaptiveCrunch tradecraft and toolingHow to protect against CaptiveCrunch activityMicrosoft Defender detections and hunting...
View ArticleClik here to view.
Kazuar: Anatomy of a nation-state botnet
In this article DeliveryModule typesBotnet operationsWho is Secret Blizzard?Mitigation and protection guidanceMicrosoft Defender detections Kazuar, a sophisticated malware family attributed to the...
View ArticleClik here to view.
SOHO router compromise leads to DNS hijacking and adversary-in-the-middle...
In this article DNS hijacking attack chain: From compromised devices to AiTM and other follow-on activityMitigation and protection guidanceMicrosoft Defender detection and hunting guidance Executive...
View ArticleClik here to view.
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware...
In this article The CaptiveCrunch campaignStorm-2945 and Midnight BlizzardCaptiveCrunch tradecraft and toolingHow to protect against CaptiveCrunch activityMicrosoft Defender detections and hunting...
View ArticleClik here to view.
SOHO router compromise leads to DNS hijacking and adversary-in-the-middle...
In this article DNS hijacking attack chain: From compromised devices to AiTM and other follow-on activityMitigation and protection guidanceMicrosoft Defender detection and hunting guidance Executive...
View ArticleClik here to view.
Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential...
In this article From search to stolen credentials: Storm-2561 attack chainDefending against credential theft campaignsMicrosoft Defender detection and hunting guidanceIndicators of compromise In...
View ArticleClik here to view.
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware...
In this article The CaptiveCrunch campaignStorm-2945 and Midnight BlizzardCaptiveCrunch tradecraft and toolingHow to protect against CaptiveCrunch activityMicrosoft Defender detections and hunting...
View ArticleClik here to view.
Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential...
In this article From search to stolen credentials: Storm-2561 attack chainDefending against credential theft campaignsMicrosoft Defender detection and hunting guidanceIndicators of compromise In...
View ArticleClik here to view.
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware...
In this article The CaptiveCrunch campaignStorm-2945 and Midnight BlizzardCaptiveCrunch tradecraft and toolingHow to protect against CaptiveCrunch activityMicrosoft Defender detections and hunting...
View ArticleClik here to view.
Kazuar: Anatomy of a nation-state botnet
In this article DeliveryModule typesBotnet operationsWho is Secret Blizzard?Mitigation and protection guidanceMicrosoft Defender detections Kazuar, a sophisticated malware family attributed to the...
View ArticleClik here to view.
SOHO router compromise leads to DNS hijacking and adversary-in-the-middle...
In this article DNS hijacking attack chain: From compromised devices to AiTM and other follow-on activityMitigation and protection guidanceMicrosoft Defender detection and hunting guidance Executive...
View ArticleClik here to view.
Kazuar: Anatomy of a nation-state botnet
In this article DeliveryModule typesBotnet operationsWho is Secret Blizzard?Mitigation and protection guidanceMicrosoft Defender detections Kazuar, a sophisticated malware family attributed to the...
View ArticleClik here to view.
SOHO router compromise leads to DNS hijacking and adversary-in-the-middle...
In this article DNS hijacking attack chain: From compromised devices to AiTM and other follow-on activityMitigation and protection guidanceMicrosoft Defender detection and hunting guidance Executive...
View ArticleClik here to view.
Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential...
In this article From search to stolen credentials: Storm-2561 attack chainDefending against credential theft campaignsMicrosoft Defender detection and hunting guidanceIndicators of compromise In...
View Article
