XOutlier
Download .zipAdd to Chrome

Microsoft Threat Intelligence

@MsftSecIntel198k followers

We are Microsoft's global network of security experts. Follow for security research and threat intelligence.

Open on X
Top outlier
24.2×
Best organic post
Peak views
672k
Single post
Bookmarks
7.5k
Across 98 organic posts
Last scan
Oct 17
Community cache
Posts 98 posts
#DatePost↓ OutlierViewsLikesRepostsBookmarks
1Jul 29, '24Microsoft has uncovered a vulnerability in ESXi hypervisors, identified as CVE-2024-37085, being exploited by threat actors to obtain full administrative permissions on domain-join24.2×672k1.2k443454
2Dec 13, '23Microsoft has taken steps to disrupt and mitigate a widespread campaign by the Russian nation-state threat actor Midnight Blizzard targeting TeamCity servers using the publicly ava15.8×438k2k574141
3Jun 5, '23Microsoft is attributing attacks exploiting the CVE-2023-34362 MOVEit Transfer 0-day vulnerability to Lace Tempest, known for ransomware operations & running the Clop extortion11.4×315k742362115
4Jul 14, '23We’re sharing more details from our investigation of the Storm-0558 campaign that targeted customer email, including our analysis of the threat actor’s techniques, tools, and infra9.7×267k421221115
5Nov 9, '23Microsoft has discovered exploitation of a 0-day vulnerability in the SysAid IT support software in limited attacks by Lace Tempest, a threat actor that distributes Clop ransomware9.2×255k76627698
6May 24, '23Volt Typhoon, a Chinese state-sponsored actor, uses living-off-the-land (LotL) and hands-on-keyboard TTPs to evade detection and persist in an espionage campaign targeting critical8.6×239k520270107
7Oct 29, '24Microsoft Threat Intelligence has observed Russian threat actor Midnight Blizzard sending a series of highly targeted spear-phishing emails to individuals in government, academia, 8.6×239k555226208
8Jan 16, '22Microsoft identified a unique destructive malware operated by an actor tracked as DEV-0586 targeting Ukrainian organizations. Observed activity, TTPs, and IOCs shared in this new M7.4×02k1.1k137
9Dec 16, '23Microsoft has identified new Qakbot phishing campaigns following the August 2023 law enforcement disruption operation. The campaign began on December 11, was low in volume, and tar7.4×205k55523088
10Oct 10, '23Microsoft has observed nation-state threat actor Storm-0062 exploiting CVE-2023-22515 in the wild since September 14, 2023. CVE-2023-22515 was disclosed on October 4, 2023. Storm-07.3×203k844328160
11Aug 9, '24The Microsoft Threat Analysis Center (MTAC) shares intelligence about Iranian actors laying the groundwork for influence operations aimed at US audiences and potentially seeking to7.1×198k912333164
12Aug 17, '23Microsoft has observed a new version of the BlackCat ransomware being used in recent campaigns. This version includes the open-source communication framework tool Impacket, which t6.8×190k50020295
13Nov 22, '23Microsoft has uncovered a supply chain attack by North Korean threat actor Diamond Sleet (ZINC) involving the modification of an installer file from software maker CyberLink. The p6.6×184k39320879
14Jun 21, '23Microsoft has detected increased credential attack activity by the threat actor Midnight Blizzard using residential proxy services to obfuscate the source of their attacks. These a6.4×178k706304106
15Aug 2, '23Microsoft has identified highly targeted social engineering attacks by the threat actor Midnight Blizzard (previously NOBELIUM) using credential theft phishing lures sent as Micros5.3×147k47222896
16Dec 1, '23Microsoft has detected Danabot (Storm-1044) infections leading to hands-on-keyboard activity by ransomware operator Storm-0216 (Twisted Spider, UNC2198), culminating in the deploym5.3×147k578195109
17Dec 28, '23Microsoft has observed threat actors, including financially motivated actors like Storm-0569, Storm-1113, Sangria Tempest, & Storm-1674, misusing the ms-appinstaller URI scheme5.2×143k34615876
18Dec 4, '23Microsoft has identified a Russian-based nation-state threat actor tracked as Forest Blizzard (STRONTIUM, APT28, FANCYBEAR) actively exploiting CVE-2023-23397 to provide secret, un5.2×143k625281125
19May 5, '23More actors are exploiting unpatched CVE-2023-27350 in print management software Papercut since we last reported on Lace Tempest. Microsoft has now observed Iranian state-sponsored5.0×139k41718055
20Sep 12, '23Beginning July 2023, Storm-0324, a financially motivated threat actor known to gain access to networks and then hand off access to other actors, was observed distributing payloads 4.8×133k364147114
21Feb 11, '25Microsoft Threat Intelligence has observed North Korean state actor Emerald Sleet (also known as Kimsuky and VELVET CHOLLIMA) using a new tactic: tricking targets into running Powe4.5×126k592184197
22May 27, '25Microsoft has discovered worldwide cloud abuse activity by new Russia-affiliated threat actor Void Blizzard (LAUNDRY BEAR), whose cyberespionage activity targets gov't, defense, tr4.5×125k351132138
23Mar 17, '25Microsoft Incident Response researchers uncovered a novel remote access trojan (RAT) that demonstrates sophisticated techniques to evade detection, persist in the target environmen4.3×120k362138125
24Mar 12, '21We have detected and are now blocking a new family of ransomware being used after an initial compromise of unpatched on-premises Exchange Servers. Microsoft protects against this t4.3×01.1k69645
25Apr 26, '23Microsoft is attributing the recently reported attacks exploiting the CVE-2023-27350 and CVE-2023-27351 vulnerabilities in print management software PaperCut to deliver Clop ransom4.2×117k33215168
26Dec 21, '23Microsoft has observed the Iranian nation-state actor Peach Sandstorm attempting to deliver a newly developed backdoor named FalseFont to individuals working for organizations in t4.1×112k40716354
27Aug 30, '24Microsoft identified a North Korean threat actor exploiting a zero-day vulnerability in Chromium (CVE-2024-7971) to gain remote code execution. Our assessment of ongoing analysis a3.7×103k572241143
28Apr 7, '23Microsoft detected a unique operation in which threat actors, tracked as MERCURY and DEV-1084, carried out destructive actions in both on-premises and cloud environments. Learn mor3.7×102k39322273
29Feb 14, '25Microsoft Threat Intelligence Center discovered an active and successful device code phishing campaign by a threat actor we track as Storm-2372. Storm-2372’s targets include govern3.6×101k483154208
30May 28, '21Microsoft Threat Intelligence Center (MSTIC) has uncovered a wide-scale malicious email campaign operated by NOBELIUM, the threat actor behind the attacks against SolarWinds, the S3.5×089855698
31Oct 1, '22Microsoft Security Threat Intelligence teams have published additional analysis on observed exploitation of Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082 with security3.1×0798471123
32Sep 24, '20Microsoft is actively tracking threat actor activity using exploits for the CVE-2020-1472 Netlogon EoP vulnerability, dubbed Zerologon. We have observed attacks where public exploi3.1×074950641
33Apr 22, '24Microsoft has identified longstanding activity by the Russian-based threat actor we track as Forest Blizzard using a custom tool we call GooseEgg to exploit CVE-2022-38028 in the W3.0×84k31714591
34Apr 5, '24Microsoft Threat Analysis Center’s latest report notes that China is using fake social media accounts to poll U.S. voters on what divides them most to sow division and possibly inf3.0×83k32214862
35Aug 8, '24Microsoft identified multiple vulnerabilities in the open-source platform OpenVPN, integrated into millions of devices worldwide, which could be exploited to create an attack chain3.0×83k371191125
36Mar 2, '21Microsoft has detected multiple 0-day exploits being used to attack on-premises versions of Microsoft Exchange Server in limited and targeted attacks. Microsoft Threat Intelligence2.9×064954432
37May 17, '22Microsoft recently observed a campaign targeting SQL servers that, like many attacks, uses brute force methods for initial compromise. What makes this campaign stand out is its use2.9×0919344115
38Dec 12, '21Microsoft is tracking threats taking advantage of the CVE-2021-44228 remote code execution (RCE) vulnerability in Apache Log4j 2 ("Log4Shell"). Get technical info and guidance for 2.8×0743408102
39Mar 15, '21Microsoft has released a new, one-click mitigation tool, the Microsoft Exchange On-Premises Mitigation Tool, to help customers who do not have dedicated security or IT teams to app2.6×067141754
40Dec 28, '21We just rolled out a new consolidated #Log4j dashboard for threat and vulnerability management in the Microsoft 365 Defender portal to help customers identify and remediate files, 2.5×076034893
41Dec 14, '23Microsoft has observed a significant surge in activity associated with the threat actor Storm-0539, known to target retail organizations for gift card fraud and theft using highly 2.5×69k36413143
42Dec 18, '20Here's our analysis of the compromised DLL that led to the Solorigate attack. While the extent of the compromise is being investigated, we want to continue providing the defender c2.4×067635280
43Nov 7, '19While we currently see only coin miners being dropped, we agree w/ the research community that CVE-2019-0708 (BlueKeep) exploitation can be big. Locate and patch exposed RDP servic2.4×064439840
44Aug 13, '19The 404 Not Found page tells you that you’ve hit a broken or dead link – except when it doesn’t. Phishers are using malicious custom 404 pages to serve phishing sites. A phishing c2.4×082832617
45Sep 7, '23We’re releasing a second version of our threat matrix for storage services, a structured tool that can help identify and analyze potential security threats on data stored in cloud 2.3×64k374170144
46Oct 6, '20We’re seeing more activity leveraging the CVE-2020-1472 exploit (ZeroLogon). A new campaign shrewdly poses as software updates that connect to known CHIMBORAZO (TA505) C2 infrastru2.3×063837643
47Oct 11, '23A large-scale remote encryption attempt from an Akira ransomware operator tracked by Microsoft as Storm-1567 was disrupted when Microsoft Defender for Endpoint identified and conta2.3×63k3299569
48Mar 13, '20Cybercriminals continue to take advantage of the coronavirus pandemic in multiple malware campaigns, including the new ransomware in the news this week. We uncovered a HawkEye camp2.3×048644517
49Jan 11, '22We have observed a China-based ransomware operator that we’re tracking as DEV-0401 exploiting the CVE-2021-44228 vulnerability in Log4j 2 (aka #log4shell) targeting internet-facing2.3×062135455
50Sep 16, '21New blog post: Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability2.2×065931777
51Jul 21, '25Update: Microsoft has released security updates that fully protect customers using all supported versions of SharePoint affected by CVE-2025-53770 and CVE-2025-53771.2.2×60k40217870
52Jul 6, '23Microsoft Incident Response's investigation of a BlackByte 2.0 ransomware attack that progressed in less than five days highlights the importance of disrupting common attack patter2.0×56k368159102
53Apr 28, '20Multiple ransomware groups that have been accumulating access and maintaining persistence on target networks for several months activated dozens of ransomware deployments in the fi2.0×059728854
54Jul 27, '22Microsoft discovered and patched a 0-day exploit (CVE-2022-22047) that #KNOTWEED, an Austria-based private sector offensive actor, used to deploy #Subzero malware. Analysis of camp2.0×051229155
55Aug 24, '22Microsoft has discovered a post-compromise capability we’re calling MagicWeb, which the threat actor tracked as NOBELIUM is using to maintain persistent access to environments they1.9×049729880
56Nov 11, '21There has been a spike in email campaigns using HTML smuggling to deploy banking Trojans, RATs, and ransomware. Attackers use this technique to build malware on a device via the br1.9×050826686
57Oct 28, '21Microsoft found a vulnerability (CVE-2021-30892) that could allow an attacker to bypass System Integrity Protection (SIP) in macOS. We shared our findings with Apple via coordinate1.8×055525234
58Sep 27, '21New blog: In-depth analysis of newly detected NOBELIUM malware: a post-exploitation backdoor that Microsoft refers to as FoggyWeb. NOBELIUM uses FoggyWeb to remotely exfiltrate dat1.8×048528051
59Feb 7, '24The latest biannual report on Iran from the Microsoft Threat Analysis Center (MTAC) presents details on the series of cyberattacks and influence operations launched by Iranian gove1.8×50k34415779
60Dec 4, '24Based on our findings and those reported by governments and other security vendors, Microsoft Threat Intelligence assesses the Russian nation-state actor we track as Secret Blizzar1.8×49k402118107
61Mar 6, '25Since late February 2025, Microsoft has observed Moonstone Sleet, a North Korean state actor, deploying Qilin ransomware at a limited number of orgs. Qilin is a ransomware as a ser1.8×49k400112110
62Jun 14, '21New blog: Attackers used a large cloud-based infrastructure to compromise mailboxes via phishing then add forwarding rules that allowed them to get access to emails. Learn how cros1.7×049122676
63Jan 20, '21Our continued investigation into the Solorigate attack has uncovered new details about the handover from the Solorigate DLL backdoor (SUNBURST) to the Cobalt Strike loader (TEARDRO1.7×045427346
64Jun 2, '25Microsoft and CrowdStrike are teaming up to create alignment across our threat actor taxonomies, mapping where knowledge of these actors align to enable security professionals to c1.7×46k3578289
66Dec 15, '21As we continue to monitor threats taking advantage of the CVE-2021-44228 Log4j 2 vulnerability, we’re seeing activity ranging from experimentation to exploitation from multiple gro1.7×042525148
67Jan 28, '21We're sharing additional details related to the attacks by the threat actor that Microsoft tracks as ZINC targeting security researchers. Read our analysis, and get IoCs, detection1.6×041526736
68Jul 6, '21Microsoft has released security updates to address CVE-2021-34527 (Windows Print Spooler Remote Code Execution Vulnerability)1.6×043627216
69Oct 12, '20Microsoft took action against the Trickbot botnet, disrupting one of the world’s most persistent malware operations. In this blog, we detail the evolution of Trickbot, associated t1.6×038925542
70Aug 30, '21We’ve been tracking a phishing campaign that has been using open redirects for months, and it continues to evolve and persist. As recently as last week, we detected a spam run that1.5×046121140
71Mar 2, '21We're seeing numerous extensive hands-on-keyboard attacks emanating from the Gootkit malware, which is distributed via drive-by downloads as a JavaScript within a ZIP file. The Jav1.5×044621141
72Oct 11, '24Since the beginning of September 2024, Microsoft Threat Intelligence has observed a phishing campaign using emails with “eFax” themed lures containing links or QR codes within PDF 1.5×41k3269095
73Jul 13, '21The threat of malicious Excel 4.0 macros continues to evolve, with attackers finding new ways to evade detection. One technique that attackers have started to use recently involves1.5×043220548
74Oct 5, '20MSTIC has observed activity by the nation-state actor MERCURY using the CVE-2020-1472 exploit (ZeroLogon) in active campaigns over the last 2 weeks. We strongly recommend patching.1.4×034724425
75Apr 28, '20With lockdown still in place in many parts of the world, attackers are paying attention to the increase in use of pirate streaming services and torrent downloads. We saw an active 1.4×050017018
76Oct 2, '20Ransomware campaigns are often described in terms of payload. In reality, however, a ransomware incident is a breach involving human adversaries attacking a network. Learn what thi1.4×040119562
77Aug 24, '19We are very proud to share that Microsoft was named a Leader in the 2019 Gartner Magic Quadrant for Endpoint Protection Platforms and positioned highest in execution1.4×06041299
78Jul 13, '21Microsoft has detected a 0-day remote code execution exploit being used to attack SolarWinds Serv-U FTP software in limited and targeted attacks. The vulnerability being exploited 1.4×037221520
79Apr 16, '21Learn how the protection stack in Microsoft Defender for Office 365 works. This article details the four phases of filtering – edge protection, sender intelligence, content filteri1.3×040613979
80Feb 24, '21We’re tracking a rampant phishing attack that uses DGA domains, free email services, and even compromised email accounts to send massive numbers of phishing emails. These emails ar1.3×035720738
81Sep 28, '20Our researchers are tracking a phishing infrastructure that’s being used to launch phishing attacks targeting enterprises. The campaign is notable for its use of HTML attachments t1.3×040318634
82Sep 16, '22Microsoft researchers are tracking an ongoing wide-ranging click fraud campaign where attackers monetize clicks generated by a browser node-webkit or malicious browser extension se1.3×036217647
83Jan 30, '20Dudear (aka TA505/SectorJ04/Evil Corp), used in some of the biggest malware campaigns today, is back in operations this month after a short hiatus. While we saw some changes in tac1.3×049714113
84Sep 2, '21New blog: We're sharing technical information about CVE-2021-35211 that we shared with SolarWinds via coordinated vulnerability disclosure. Learn how we found the issue and how we 1.3×034419744
85Oct 27, '22Microsoft has discovered Raspberry Robin activity establishing its role in a complex, interconnected malware ecosystem that facilitates human-operated ransomware. Our latest blog d1.3×033418150
86Mar 4, '21Microsoft Threat Intelligence Center (MSTIC) is naming the actor behind the attacks against SolarWinds, the SUNBURST backdoor, TEARDROP malware, & related components as NOBELIU1.3×030820535
87May 9, '22Human-operated ransomware, a class of attacks driven by expert human intelligence and culminate in intentional business disruption and extortion, have become even more impactful in1.2×031217762
88Nov 16, '20We’re tracking an active credential phishing attack targeting enterprises that uses multiple sophisticated methods for defense evasion and social engineering. The campaign uses tim1.2×033317629
89Jun 22, '21We're tracking an active BazaCall malware campaign leading to human-operated attacks and ransomware deployment. BazaCall campaigns use emails that lure recipients to call a number 1.2×033319521
90Apr 13, '21The recent surge of IcedID campaigns indicate that this malware family is likely being used to fill in some of the void left by recent malware infrastructure disruptions. We are tr1.1×033517221
91Jun 17, '20Microsoft Defender ATP is extending its protection capabilities to the firmware level with a new UEFI scanner1.1×036315524
92May 4, '21We’ve been building detailed and comprehensive investigation playbooks for analysts of different skill levels. This guide for new analysts describes steps for taking full advantage1.1×034911769
93Sep 8, '22Microsoft Detection and Response Team (DART) was engaged to lead the investigation on destructive cyberattacks launched against the Albanian government in mid-July. We assess that 1.1×031915031
94Mar 3, '21We have expanded the integration of Antimalware Scan Interface (AMSI) with Office 365 to include the runtime scanning of Excel 4.0 (XLM) macros to help antivirus solutions tackle t1.1×033715621
95Oct 21, '21We recently discovered the latest variant of a Mac malware tracked as UpdateAgent (aka WizardUpdate) with new persistence and evasion tactics, the latest in a series of upgrades ov1.0×031613635
96Dec 12, '19New blog post: In-depth analysis of PowerShell-based downloader Trojan #sLoad, which uses the Background Intelligent Transfer Service (BITS) almost exclusively as alternative proto0.9×032911815
97Dec 18, '19New blog post: Microsoft Defender ATP data scientists developed a probabilistic time series model for detecting RDP brute force attacks and collaborated with threat hunters to prot0.9×0404869
98Dec 11, '19Phishing has been quietly evolving. In 2019, we saw phishing attacks reach new levels of creativity and sophistication. Here are the most notable phishing techniques that Office 360.9×031512112
99Mar 28, '19An ongoing malvertising campaign is targeting gamers by using code-signed malware with file names like "pubg.exe", "minecraft.exe", "fortnite.exe", "chrome.exe", "apex.exe", "flash0.9×0339949

Scan another creator

@
@karpathy@levelsio@paulg@naval@marclou@illyism

Run this on any account.

XOutlier builds this table for every public profile you open on x.com, with live data and every post, not just the top 50.

Add to Chrome Download .zip