Research reports

dd252791.aspx

No excerpt available.

ms14-068.aspx

No excerpt available.

assoc

Displays or modifies file name extension associations. If used without parameters, assoc displays a list of all the current file name extension associations. Note This command is only supported within cmd.exe and is not available from PowerShell. Though you…

The Gentlemen ransomware: Dissecting a self-propagating Go encryptor

Ransomware that combines robust encryption with rapid lateral movement significantly increases the risk and impact of an attack. The Gentlemen ransomware is a ransomware-as-a-service (RaaS) threat that is distinguished by its ability to pair its strong…

Ransomware

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

Microsoft Threat Intelligence has identified NeedyMantis, a modular post-compromise malware family observed in a limited number of targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental…

Malware

Star Blizzard refines phishing and malware delivery with the RedFlick technique

Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that…

State-sponsoredMalwarePhishing

Storm-3168: Agentic-driven cloud attacks using compromised service principals

Microsoft Security Research has identified malicious cloud activity associated with JADEPUFFER, a threat actor discovered by Sysdig in July 2026 and reported to be the first documented agentic ransomware operation. Our investigation found an extensive…

Unmasking EvilTokens: Getting to the root of device code phishing

By Microsoft Threat Intelligence, Microsoft Defender Experts, Microsoft Security Research Following its emergence in February 2026, EvilTokens quickly became one of the most widely used phishing-as-a-service (PhaaS) platforms, providing cybercriminals with AI…

Phishing