/
Navigation
C
Chronicles
Browse all articles
C
E
Explore
Semantic exploration
E
R
Research
Entity momentum
R
N
Nexus
Correlations & relationships
N
~
Story Arc
Topic evolution
S
Drift Map
Semantic trajectory animation
D
P
Posts
Analysis & commentary
P
Browse
@
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Handles
Browse by social media handle
Detection
?
Concept Search
Semantic similarity search
!
High Impact Stories
Top coverage by position
+
Sentiment Analysis
Positive/negative coverage
*
Anomaly Detection
Unusual coverage patterns
Analysis
vs
Rivalry Report
Compare two entities head-to-head
/\
Semantic Pivots
Narrative discontinuities
!!
Crisis Response
Event recovery patterns
Connected
Nav: C E R N
Search: /
Command: ⌘K
Embeddings: large
VOICE ARCHIVE

@msftsecintel

@msftsecintel
69 posts
2026-03-05
In collaboration with Europol and industry partners, Microsoft's Digital Crimes Unit (DCU) facilitated a disruption of Tycoon2FA's infrastructure and operations. https://blogs.microsoft.com/ ...
2026-03-05 View on X
BleepingComputer

A Europol-coordinated law enforcement operation disrupts Tycoon2FA, a phishing-as-a-service platform linked to tens of millions of phishing messages each month

An international law enforcement operation coordinated by Europol has disrupted Tycoon2FA, a major phishing-as-a-service (PhaaS) …

The phishing-as-a-service platform Tycoon2FA enabled campaigns responsible for millions of phishing messages reaching >500K orgs monthly. Developed and advertised by Storm-1747, Tycoon2FA allowed threat actors to conduct account compromise at scale. https://www.microsoft.com/...
2026-03-05 View on X
BleepingComputer

A Europol-coordinated law enforcement operation disrupts Tycoon2FA, a phishing-as-a-service platform linked to tens of millions of phishing messages each month

An international law enforcement operation coordinated by Europol has disrupted Tycoon2FA, a major phishing-as-a-service (PhaaS) …

2025-07-23
Microsoft is sharing details from ongoing investigations of threat actors exploiting vulnerabilities targeting on-premises SharePoint servers. Linen Typhoon, Violet Typhoon, and Storm-2603 have been observed exploiting the vulnerabilities: https://www.microsoft.com/...
2025-07-23 View on X
BleepingComputer

Microsoft says it “has observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon exploiting” the SharePoint zero-day vulnerabilities

He said not as vulnerable as on-prem SharePoint right now.  —  #nerdromancewithpits @wylienewmark : back in the day, attribution of widespread exploitation of a vulnerability in a ...

Microsoft is sharing details from ongoing investigations of threat actors exploiting vulnerabilities targeting on-premises SharePoint servers. Linen Typhoon, Violet Typhoon, and Storm-2603 have been observed exploiting the vulnerabilities: https://www.microsoft.com/...
2025-07-23 View on X
Bloomberg

Source: the US National Nuclear Security Administration was among those breached by a hack of SharePoint; no sensitive information is known to be compromised

The US agency responsible for maintaining and designing the nation's cache of nuclear weapons was among those breached by a hack …

2025-06-03
Microsoft and CrowdStrike are teaming up to create alignment across our threat actor taxonomies, mapping where knowledge of these actors align to enable security professionals to connect insights faster and make decisions with greater confidence. https://www.microsoft.com/...
2025-06-03 View on X
Reuters

Microsoft, Google, CrowdStrike, and Palo Alto Networks plan to create a public glossary of state-sponsored hacking groups to ease unofficial alias confusion

Microsoft, CrowdStrike, Palo Alto (PANW.O) and Alphabet's (GOOGL.O) Google on Monday said they would create a public glossary …

2025-04-02
By leveraging Microsoft Security Copilot to expedite the discovery process, Microsoft Threat Intelligence uncovered vulnerabilities in multiple open-source bootloaders, impacting all operating systems relying on UEFI Secure Boot as well as IoT devices. https://www.microsoft.com/...
2025-04-02 View on X
BleepingComputer

Microsoft says it used its AI-powered Security Copilot to discover 20 previously unknown vulnerabilities in open-source bootloaders GRUB2, U-Boot, and Barebox

Great to see our BootHole  —  research generated an entire area of security research. …

2024-12-12
After co-opting the tools and infrastructure of another nation-state threat actor to facilitate espionage activities, Russian nation-state actor Secret Blizzard used those resources to compromise targets in Ukraine. https://www.microsoft.com/...
2024-12-12 View on X
TechCrunch

Microsoft says Russia-backed hacking group Secret Blizzard targeted Ukraine's military using other cybercriminals' tools, “to make attribution more difficult”

A Russian-government backed hacking group targeted Ukraine's military using tools and infrastructure developed by cybercriminals, according to new research.

2024-12-05
Based on our findings and those reported by governments and other security vendors, Microsoft Threat Intelligence assesses the Russian nation-state actor we track as Secret Blizzard has used the tools and infrastructure of at least 6 other threat actors during the past 7 years.
2024-12-05 View on X
BleepingComputer

Microsoft and Lumen's Black Lotus Labs find Russia-linked Turla hackers hijacked Pakistan-based hackers' servers to launch their own attacks since December 2022

The notorious Russian cyber-espionage group Turla is hacking other hackers, hijacking the Pakistani threat actor Storm-0156's infrastructure …

2024-10-24
Russian threat actors were observed integrating generative AI into their US election influence efforts, while Chinese influence operations have recently taken a new turn shifting focus to several down-ballot candidates and members of Congress. https://blogs.microsoft.com/ ...
2024-10-24 View on X
Wired

Microsoft: Russia, China, and Iran are stepping up cyber-influence efforts on the US election; China has focused on down-ballot candidates and Congress members

Russia, Iran, and China are targeting the US election with an evolving array of influence operations in the last days of campaign season.

Meanwhile, Iranian threat actors tasked with targeting the US elections may make an effort—as they have in the past—to run influence operations both shortly before and soon after the election by leveraging cyber intrusions from weeks to months prior.
2024-10-24 View on X
Wired

Microsoft: Russia, China, and Iran are stepping up cyber-influence efforts on the US election; China has focused on down-ballot candidates and Congress members

Russia, Iran, and China are targeting the US election with an evolving array of influence operations in the last days of campaign season.

2024-10-04
The US District Court for the District of Columbia unsealed a civil action brought by Microsoft's DCU, including its order authorizing Microsoft to seize 66 unique domains used by Star Blizzard in cyberattacks targeting Microsoft customers globally, including throughout the US.
2024-10-04 View on X
Bloomberg

The US and Microsoft seize 107 websites used by Russian intelligence agents and their proxies in the US operating under Star Blizzard, a group active since 2016

Today, the United States District Court for the District of Columbia unsealed a civil action brought … Ben Johnson : 👏 I'm very proud that today, it was unveiled that the NGO-ISAC,...

Star Blizzard has continuously refined their detection evasion capabilities while remaining focused on email credential theft against the same targets. This blog provides updated technical information about Star Blizzard TTPs: https://www.microsoft.com/...
2024-10-04 View on X
Bloomberg

The US and Microsoft seize 107 websites used by Russian intelligence agents and their proxies in the US operating under Star Blizzard, a group active since 2016

Today, the United States District Court for the District of Columbia unsealed a civil action brought … Ben Johnson : 👏 I'm very proud that today, it was unveiled that the NGO-ISAC,...

Microsoft's Digital Crimes Unit (DCU) is disrupting the technical infrastructure used by a persistent Russian nation-state threat actor that Microsoft tracks as Star Blizzard. https://blogs.microsoft.com/ ...
2024-10-04 View on X
Bloomberg

The US and Microsoft seize 107 websites used by Russian intelligence agents and their proxies in the US operating under Star Blizzard, a group active since 2016

Today, the United States District Court for the District of Columbia unsealed a civil action brought … Ben Johnson : 👏 I'm very proud that today, it was unveiled that the NGO-ISAC,...

2024-08-12
The Microsoft Threat Analysis Center (MTAC) shares intelligence about Iranian actors laying the groundwork for influence operations aimed at US audiences and potentially seeking to impact the 2024 US presidential election: https://blogs.microsoft.com/ ...
2024-08-12 View on X
Wall Street Journal

How Iran has emerged as the most aggressive foreign threat to the US election; Microsoft published a report detailing a litany of efforts to target the election

Hack of Trump campaign has led some to accuse Tehran just weeks after U.S. officials believed Russia posed bigger threat

2024-08-11
The Microsoft Threat Analysis Center (MTAC) shares intelligence about Iranian actors laying the groundwork for influence operations aimed at US audiences and potentially seeking to impact the 2024 US presidential election: https://blogs.microsoft.com/ ...
2024-08-11 View on X
Politico

Trump campaign says some of its internal communications were hacked, citing a Microsoft report that Iranian hackers “sent a spear phishing email” to a campaign

The campaign suggested Iran was to blame.  POLITICO has not independently verified the identity of the hacker or their motivation.

2024-07-27
Microsoft Threat Intelligence collaborated with the United States Federal Bureau of Investigation (FBI) in tracking activity associated with Onyx Sleet. Our latest blog shares information about Onyx Sleet activity, and guidance to improve defenses: https://www.microsoft.com/...
2024-07-27 View on X
Associated Press

The US DOJ indicts a North Korean hacker, still at large, for his alleged role in the Andariel group's cyberattacks on US hospitals, NASA, and military bases

Associated Press :

2024-04-06
China has also increased its use of AI-generated content to further its goals around the world, according to the report, published today by MTAC.
2024-04-06 View on X
The Guardian

Microsoft warns that China plans to disrupt US, South Korean, and Indian elections in 2024 with AI-generated content, after using Taiwan's election as a dry run

Dan Milmo / The Guardian :

The report also cites that North Korea has increased its cryptocurrency heists and supply chain attacks to fund and further its military goals and intelligence collection and that it has also begun to use AI to make its operations more effective and efficient.
2024-04-06 View on X
The Guardian

Microsoft warns that China plans to disrupt US, South Korean, and Indian elections in 2024 with AI-generated content, after using Taiwan's election as a dry run

Dan Milmo / The Guardian :

Microsoft Threat Analysis Center's latest report notes that China is using fake social media accounts to poll U.S. voters on what divides them most to sow division and possibly influence the outcome of the U.S. presidential election in its favor. https://blogs.microsoft.com/ ...
2024-04-06 View on X
The Guardian

Microsoft warns that China plans to disrupt US, South Korean, and Indian elections in 2024 with AI-generated content, after using Taiwan's election as a dry run

Dan Milmo / The Guardian :

2024-02-14
Microsoft, in collaboration with OpenAI, is publishing research on emerging threats in the age of AI, focusing on identified activity associated with known threat actors Forest Blizzard, Emerald Sleet, Crimson Sandstorm, and others. Learn more: https://www.microsoft.com/...
2024-02-14 View on X
The Verge

Microsoft and OpenAI say hackers, including Russian, North Korean, Iranian, and Chinese-backed groups, are already using LLMs to refine and improve cyberattacks

Microsoft and OpenAI are revealing today that hackers are already using large language models like ChatGPT to refine and improve their existing cyberattacks.