Threat landscape

Take action and get the latest guidance derived from Microsoft Threat Intelligence’s global telemetry on the cybercrime ecosystem, nation state attacks, and emerging threats.

A map of a treasure island with labeled areas and markings.

May 19, 2026 • 8 min read

Hot Cybercrime Summer: Understanding the Modern Cybercrime Operating Model

Hear from Microsoft leaders on the real structure behind modern attacks, the role AI is playing, and the practical takeaways for security leaders.

Mar 25, 2026 • 50 min listen

Scam Detectors hosted by Jane Wakefield: Tech support scam

Apr 30, 2026 • 20 min watch

Social engineering is scaling faster than ever

Mar 31, 2026 • 9 min read

The threat to critical infrastructure has changed. Has your readiness?

Apr 10, 2026 • 2 min watch

RSAC 2026 recap: Securing the frontier

Understand them to defend against them

Get insights on active nation-state threat actors and cybercriminal organizations with analysis and updates from Microsoft Threat Intelligence.

Plaid Rain

Plaid Rain primarily targets critical manufacturing, IT, and defense organizations in Israel.

Learn more

Volt Typhoon

Based out of China, Volt Typhoon targets critical infrastructure in the United States.

Learn more

Mint Sandstorm

Mint Sandstorm goes after activists, journalists, and think tanks inside and outside Iran.

Learn more

Silk Typhoon

Silk Typhoon focuses on reconnaissance campaigns in the United States, Australia, Japan, and Vietnam.

Learn more

Forest Blizzard

Forest Blizzard is a Russian nation-state actor that uses malware to compromise cloud and on-premises environments.

Learn more

Aqua Blizzard

Located in Russia, Aqua Blizzard targets governmental and non-governmental organizations in Ukraine.

Learn more

Crimson Sandstorm

Using phishing and fictitious social media accounts, Crimson Sandstorm delivers malware to exfiltrate data.

Learn more

Gray Sandstorm

Nation-state actor, Gray Sandstorm, used password spray to target accounts in an organization.

Learn more

Periwinkle Tempest

Periwinkle Tempest is responsible for developing, distributing, and managing several ransomware payloads.

Learn more

Caramel Tsunami

Caramel Tsunami sells hacking-as-a-service packages that include malware or zero-day exploits.

Learn more

Cadet Blizzard

Cadet Blizzard is a Russian-sponsored group that conducts operations against Ukraine and Europe.

Learn more

Smoke Sandstorm

Based in Iran, Smoke Sandstorm compromises email accounts at organizations in the Middle East.

Learn more

Hazel Sandstrom

Linked to Iran, Hazel Sandstorm disrupted government websites and public services in Albania in 2022.

Learn more

Nylon Typhoon

Nylon Typhoon creates and deploys custom malware that allows them to compromise remote access.

Learn more

Pistachio Tempest

Pistachio Tempest uses ransomware-as-a-service offerings to gain access, exfiltrate data, and extort victims.

Learn more

Manatee Tempest

Manatee Tempest is part of the ransomware-as-a-service economy and provides custom Cobalt Strike loaders.

Learn more

Storm-0530

A group of actors originating from North Korea, Storm-0530 targets small businesses with ransomware.

Learn more

Wine Tempest

Wine Tempest typically infiltrates a machine in a network and deploys human-operated ransomware.

Learn more

Inside Microsoft Threat Intelligence video series

Microsoft disrupted Storm-1152’s 750 million fake accounts. See how threat intelligence becomes action, disruption, and protection.

Watch episode one
When threat actors strike, Microsoft’s Incident Response team steps into the chaos to bring calm and structure to the equation.

Watch episode two
Follow Senior Security Researcher Thomas Ball in the latest episode of Inside Microsoft Threat Intelligence as he discusses modern threat hunting in the age of AI.

Watch episode three
Explore the foundation that fuels it all–security research–through the lens of Principal Security Researcher Jonathan Bar Or (JBO).

Watch episode four