Movatterモバイル変換

Skip to main content

Microsoft Security

Microsoft Security

Threat actors

Microsoft actively discovers and tracks threat actors across observed state-sponsored, ransomware, and criminal activities. Get insights from the 60 nation-state actors, 50 ransomware groups, and hundreds of other attackers we’ve tracked.

Filtered by

threat-actors

Refine results

Sort By

Content Type

Industry trends(0)

Best practices(0)

Topic

Threat intelligence(116)

Incident response(8)

Identity and access management(3)

Endpoint security(3)

AI and agents(3)

Internet of Things (IoT) security(2)

Threat trends(1)

Security management(1)

Office of the CISO(1)

Multifactor authentication(1)

Email security(1)

Data security(1)

Data protection(1)

Analyst reports(1)

Small and medium business(0)

SIEM and XDR(0)

Security operations(0)

Secure remote work(0)

Risk management(0)

Network security(0)

Microsoft Secure Future Initiative(0)

Information protection and governance(0)

Device management(0)

Cloud security(0)

Built-in security(0)

Products and services

Microsoft Defender(66)

Microsoft Defender for Endpoint(44)

Microsoft Defender XDR(35)

Microsoft Defender Threat Intelligence(16)

Microsoft Defender for Cloud Apps(12)

Microsoft Defender for Identity(11)

Microsoft Defender for Office 365(10)

Microsoft Defender Vulnerability Management(7)

Microsoft Defender for Cloud(4)

Microsoft Defender for IoT(3)

Microsoft Defender External Attack Surface Management(3)

Microsoft Defender for Business(0)

Microsoft Sentinel(24)

Microsoft Entra(8)

Microsoft Entra ID(5)

Microsoft Entra ID Protection(4)

Microsoft Entra Workload ID(0)

Microsoft Entra Verified ID(0)

Microsoft Entra Private Access(0)

Microsoft Entra Internet Access(0)

Microsoft Entra ID Governance(0)

Microsoft Entra External ID(0)

Microsoft Security Experts(5)

Microsoft Defender Experts for Hunting(3)

Microsoft Incident Response(2)

Microsoft Defender Experts for XDR(1)

Microsoft Security Services for Enterprise(0)

Microsoft Security Copilot(2)

Microsoft Purview(0)

Microsoft Purview Insider Risk Management(0)

Microsoft Purview Information Protection(0)

Microsoft Purview eDiscovery(0)

Microsoft Purview Data Loss Prevention(0)

Microsoft Purview Data Lifecycle Management(0)

Microsoft Purview Compliance Manager(0)

Microsoft Purview Communication Compliance(0)

Microsoft Purview Audit(0)

Microsoft Priva(0)

Microsoft Priva Subject Rights Requests(0)

Microsoft Priva Risk Management(0)

Microsoft Intune(0)

Microsoft Entra Agent ID(0)

Publish date

Start Date

End Date

Apply

October 6
8 min read
Investigating active exploitation of CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability
Storm-1175, a financially motivated actor known for deploying Medusa ransomware and exploiting public-facing applications for initial access, was observed exploiting the deserialization vulnerability in GoAnywhere MFT’s License Servlet, tracked as CVE-2025-10035.
July 31
13 min read
Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats
Microsoft Threat Intelligence has uncovered a cyberespionage campaign by the Russian state actor we track as Secret Blizzard that has been ongoing since at least 2024, targeting embassies in Moscow using an adversary-in-the-middle (AiTM) position to deploy their custom ApolloShadow malware.
July 22
20 min read
Disrupting active exploitation of on-premises SharePoint vulnerabilities
Microsoft has observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon, exploiting vulnerabilities targeting internet-facing SharePoint servers.
July 16
7 min read
Protecting customers from Octo Tempest attacks across multiple industries
To help protect and inform customers, Microsoft highlights protection coverage across the Microsoft Defender security ecosystem to protect against threat actors like Octo Tempest.
Retain Microsoft Security Experts
Microsoft Security Experts are now available to strengthen your team with managed security services. Learn how to defend against threats with security experts.
Get started
June 30
18 min read
Jasper Sleet: North Korean remote IT workers’ evolving tactics to infiltrate organizations
Since 2024, Microsoft Threat Intelligence has observed remote IT workers deployed by North Korea leveraging AI to improve the scale and sophistication of their operations, steal data, and generate revenue for the North Korean government.
May 29
12 min read
Defending against evolving identity attack techniques
Threat actors continue to develop and leverage various techniques that aim to compromise cloud identities.
May 27
16 min read
New Russia-affiliated actor Void Blizzard targets critical sectors for espionage
Microsoft Threat Intelligence has discovered a cluster of worldwide cloud abuse activity conducted by a threat actor we track as Void Blizzard, who we assess with high confidence is Russia-affiliated and has been active since at least April 2024.
May 12
10 min read
Marbled Dust leverages zero-day in Output Messenger for regional espionage
Since April 2024, the threat actor that Microsoft Threat Intelligence tracks as Marbled Dust has been observed exploiting user accounts that have not applied fixes to a zero-day vulnerability (CVE-2025-27920) in the messaging app Output Messenger, a multiplatform chat software.
Modernize your Security Operations Center with Microsoft Sentinel
Microsoft Sentinel is a cloud-native SIEM solution powered by AI and automation that delivers intelligent security analytics across your entire enterprise.
Learn more
April 8
7 min read
Exploitation of CLFS zero-day leads to ransomware activity
Microsoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC) have discovered post-compromise exploitation of a newly discovered zero-day vulnerability in the Windows Common Log File System (CLFS) against a small number of targets.
March 13
10 min read
Phishing campaign impersonates Booking.com, delivers a suite of credential-stealing malware
Microsoft Threat Intelligence identified a phishing campaign that impersonates online travel agency Booking.
March 5
13 min read
Silk Typhoon targeting IT supply chain
Silk Typhoon is a Chinese state actor focused on espionage campaigns targeting a wide range of industries in the US and throughout the world.
February 13
10 min read
Storm-2372 conducts device code phishing campaign
Microsoft Threat Intelligence Center discovered an active and successful device code phishing campaign by a threat actor we track as Storm-2372.

Get started with Microsoft Security

Protect your people, data, and infrastructure with AI-powered, end-to-end security from Microsoft.

Connect with us on social

[8]ページ先頭

©2009-2025 Movatter.jp