Microsoft Threat Intelligence, Author at Microsoft Security Blog

Research
May 27, 2022
13 min read

Android apps with millions of downloads exposed to high-severity vulnerabilities

Microsoft uncovered high-severity vulnerabilities in a mobile framework used by multiple large mobile service providers in pre-installed Android System apps that potentially exposed users to remote or local attacks.

Male office worker seated at high desk in modern office, using Toshiba laptop (screen not visible). Rows of office workstations are in the background, each with desktop computers (some screens partially visible open to Windows 10 log in page).

Research
May 25, 2022
8 min read

Detecting and preventing privilege escalation attacks leveraging Kerberos relaying (KrbRelayUp)

The privilege escalation hacking tool KrbRelayUp is a wrapper that can streamline the use of some features in Rubeus, KrbRelay, SCMUACBypass, PowerMad/ SharpMad, Whisker, and ADCSPwn tools in attacks.

Research
May 23, 2022
10 min read

Beneath the surface: Uncovering the shift in web skimming

Web skimming campaigns now employ various obfuscation techniques to deliver and hide the skimming scripts.

Research
May 19, 2022
27 min read

Rise in XorDdos: A deeper look at the stealthy DDoS malware targeting Linux devices

Observing a 254% increase in activity over the last six months from a versatile Linux trojan called XorDdos, the Microsoft 365 Defender research team provides in-depth analysis into this stealthy malware’s capabilities and key infection signs.

Two people in the subway looking at a mobile device.

Research
May 17, 2022
14 min read

In hot pursuit of ‘cryware’: Defending hot wallets from attacks

The rise in cryptocurrency market capitalization paved the way to the emergence of threats Microsoft security researchers are referring to as “cryware”—information stealers focused on gathering and exfiltrating data from non-custodial cryptocurrency wallets.

Camera focused on laptop screen showing security dashboard while security decision makers present to the board of executives on security topics.

Research
May 11, 2022
5 min read

Center for Threat-Informed Defense, Microsoft, and industry partners streamline MITRE ATT&CK® matrix evaluation for defenders

The Center for Threat-Informed Defense, along with Microsoft and industry partners, collaborated on a repeatable methodology and a web-based calculator, aiming to streamline MITRE ATT&CK® use for defenders.

Research
May 9, 2022
37 min read

Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself

Microsoft coined the term “human-operated ransomware” to clearly define a class of attack driven by expert human intelligence at every step of the attack chain and culminate in intentional business disruption and extortion.

Research
April 26, 2022
9 min read

Microsoft finds new elevation of privilege Linux vulnerability, Nimbuspwn

Microsoft has discovered several vulnerabilities, collectively referred to as Nimbuspwn, that could be chained together, allowing an attacker to elevate privileges to root on many Linux desktop endpoints.

Research
April 13, 2022
17 min read

Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware

Microsoft took action against the ZLoader trojan by working with telecommunications providers around the world to disrupt key ZLoader infrastructure.

Security practitioner in front of two computer screens, working on their laptop to investigate threats.

Research
April 12, 2022
7 min read

Tarrask malware uses scheduled tasks for defense evasion

Microsoft Detection and Response Team (DART) researchers have uncovered malware that creates “hidden” scheduled tasks as a defense evasion technique.

IT professional looking at computer screens that display lines of code.

Research
April 4, 2022
12 min read

SpringShell RCE vulnerability: Guidance for protecting against and detecting CVE-2022-22965

Microsoft provides guidance for customers looking for protection against exploitation and ways to detect vulnerable installations on their network of the critical vulnerability CVE-2022-22965, also known as SpringShell or Spring4Shell.

Microsoft Cyber Defense Operations Center

Research
March 22, 2022
18 min read

DEV-0537 criminal actor targeting organizations for data exfiltration and destruction

The activity we have observed has been attributed to a threat group that Microsoft tracks as DEV-0537, also known as LAPSUS$.

Microsoft Threat Intelligence posts