Threat landscape

Take action and get the latest guidance derived from Microsoft Threat Intelligence’s global telemetry on the cybercrime ecosystem, nation state attacks, and emerging threats.

Magnifying glass overlaying abstract overlapping shapes on a purple gradient background

Jun 3, 2026 • 16 min read

The Conversation CISOs need to have with their board about ransomware

Boards don’t misunderstand ransomware; they lack structural insight into its ecosystem. Closing that deficit is essential.

Jun 9, 2026 • 23 min watch

Cybercrime gets headlines; Nation States shape the battlefield

May 19, 2026 • 8 min read

Hot Cybercrime Summer: Understanding the Modern Cybercrime Operating Model

Mar 25, 2026 • 50 min listen

Scam Detectors hosted by Jane Wakefield: Tech support scam

Apr 30, 2026 • 20 min watch

Social engineering is scaling faster than ever

Understand them to defend against them

Get insights on active nation-state threat actors and cybercriminal organizations with analysis and updates from Microsoft Threat Intelligence.

Plaid Rain

Plaid Rain primarily targets critical manufacturing, IT, and defense organizations in Israel.

Learn more

Volt Typhoon

Based out of China, Volt Typhoon targets critical infrastructure in the United States.

Learn more

Mint Sandstorm

Mint Sandstorm goes after activists, journalists, and think tanks inside and outside Iran.

Learn more

Silk Typhoon

Silk Typhoon focuses on reconnaissance campaigns in the United States, Australia, Japan, and Vietnam.

Learn more

Forest Blizzard

Forest Blizzard is a Russian nation-state actor that uses malware to compromise cloud and on-premises environments.

Learn more

Aqua Blizzard

Located in Russia, Aqua Blizzard targets governmental and non-governmental organizations in Ukraine.

Learn more

Crimson Sandstorm

Using phishing and fictitious social media accounts, Crimson Sandstorm delivers malware to exfiltrate data.

Learn more

Gray Sandstorm

Nation-state actor, Gray Sandstorm, used password spray to target accounts in an organization.

Learn more

Periwinkle Tempest

Periwinkle Tempest is responsible for developing, distributing, and managing several ransomware payloads.

Learn more

Caramel Tsunami

Caramel Tsunami sells hacking-as-a-service packages that include malware or zero-day exploits.

Learn more

Cadet Blizzard

Cadet Blizzard is a Russian-sponsored group that conducts operations against Ukraine and Europe.

Learn more

Smoke Sandstorm

Based in Iran, Smoke Sandstorm compromises email accounts at organizations in the Middle East.

Learn more

Hazel Sandstrom

Linked to Iran, Hazel Sandstorm disrupted government websites and public services in Albania in 2022.

Learn more

Nylon Typhoon

Nylon Typhoon creates and deploys custom malware that allows them to compromise remote access.

Learn more

Pistachio Tempest

Pistachio Tempest uses ransomware-as-a-service offerings to gain access, exfiltrate data, and extort victims.

Learn more

Manatee Tempest

Manatee Tempest is part of the ransomware-as-a-service economy and provides custom Cobalt Strike loaders.

Learn more

Storm-0530

A group of actors originating from North Korea, Storm-0530 targets small businesses with ransomware.

Learn more

Wine Tempest

Wine Tempest typically infiltrates a machine in a network and deploys human-operated ransomware.

Learn more

Inside Microsoft Threat Intelligence video series

Microsoft disrupted Storm-1152’s 750 million fake accounts. See how threat intelligence becomes action, disruption, and protection.

Watch episode one
When threat actors strike, Microsoft’s Incident Response team steps into the chaos to bring calm and structure to the equation.

Watch episode two
Follow Senior Security Researcher Thomas Ball in the latest episode of Inside Microsoft Threat Intelligence as he discusses modern threat hunting in the age of AI.

Watch episode three
Explore the foundation that fuels it all–security research–through the lens of Principal Security Researcher Jonathan Bar Or (JBO).

Watch episode four