Research reports

dd252791.aspx

No excerpt available.

ms14-068.aspx

No excerpt available.

assoc

Displays or modifies file name extension associations. If used without parameters, assoc displays a list of all the current file name extension associations. Note This command is only supported within cmd.exe and is not available from PowerShell. Though you…

The Gentlemen ransomware: Dissecting a self-propagating Go encryptor

Ransomware that combines robust encryption with rapid lateral movement significantly increases the risk and impact of an attack. The Gentlemen ransomware is a ransomware-as-a-service (RaaS) threat that is distinguished by its ability to pair its strong…

Ransomware

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

Microsoft Threat Intelligence has identified NeedyMantis, a modular post-compromise malware family observed in a limited number of targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental…

Malware

Star Blizzard refines phishing and malware delivery with the RedFlick technique

Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that…

State-sponsoredMalwarePhishing

Storm-3168: Agentic-driven cloud attacks using compromised service principals

Microsoft Security Research has identified malicious cloud activity associated with JADEPUFFER, a threat actor discovered by Sysdig in July 2026 and reported to be the first documented agentic ransomware operation. Our investigation found an extensive…

Unmasking EvilTokens: Getting to the root of device code phishing

By Microsoft Threat Intelligence, Microsoft Defender Experts, Microsoft Security Research Following its emergence in February 2026, EvilTokens quickly became one of the most widely used phishing-as-a-service (PhaaS) platforms, providing cybercriminals with AI…

Phishing

ACR Stealer: Two observed intrusion chains amid increased threat activity

From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive…

Infostealers

TerminalFix campaign deploys a reverse tunnel through multistage intrusion

By Microsoft Security Research, Sagar Patil, Suriyaraj Natarajan, Parasharan Raghavan Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. The campaign uses compromised…

Exposing Fox Tempest: A malware-signing service operation

Fox Tempest is a financially motivated threat actor that operates a malware-signing-as-a-service (MSaaS) used by other cybercriminals to more effectively distribute malicious code, including ransomware. The threat actor abuses Microsoft Artifact Signing to…

Malware

Disrupting Fox Tempest: A cybercrime service that turned “verified” software into a pathway for ransomware

Every day, we decide what software to trust in seconds guided by simple labels such as “verified,” “secure,” and “safe to install.” The problem is that those signs can be manipulated. Today, Microsoft unsealed a legal case in the US District Court for the…

RansomwareMalware

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

Since early May 2026, Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, conducting widespread but targeted traffic manipulation attacks involving hospitality sector networks served by captive portals worldwide. Despite…

State-sponsoredMalware

Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

By Microsoft Defender Security Research Team, Microsoft Defender Experts, Parth Jomadkar Microsoft Threat Intelligence has identified an active multi-stage intrusion campaign targeting organizations in the hospitality and hotel industry since April 2026.…

Malware

StilachiRAT analysis: From system reconnaissance to cryptocurrency theft

In November 2024, Microsoft Incident Response researchers uncovered a novel remote access trojan (RAT) we named StilachiRAT that demonstrates sophisticated techniques to evade detection, persist in the target environment, and exfiltrate sensitive data.…

Malware

How Storm-2949 turned a compromised identity into a cloud-wide breach

Microsoft Threat Intelligence recently uncovered a methodical, sophisticated, and multi-layered attack, where a threat actor we track as Storm-2949 launched a relentless campaign with a singular focus: to exfiltrate as much sensitive data from a target…

Kazuar: Anatomy of a nation-state botnet

Kazuar, a sophisticated malware family attributed to the Russian state actor Secret Blizzard, has been under constant development for years and continues to evolve in support of espionage-focused operations. Over time, Kazuar has expanded from a relatively…

State-sponsoredMalwareBotnets and DDoS

Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft

In mid-January 2026, Microsoft Defender Experts identified a credential theft campaign that uses fake virtual private network (VPN) clients distributed through search engine optimization (SEO) poisoning. The campaign redirects users searching for legitimate…

Advanced security audit policy settings - Windows 10

The audit events that these settings generate. The security audit policy settings under Security Settings\Advanced Audit Policy Configuration can help your organization audit compliance with important business-related and security-related rules by tracking…

Audit Policy - Windows 10

Microsoft Build 2026 June 2-3, 2026 Go deep on real code and real systems in San Francisco and online Learn more We're no longer updating this content regularly. Check the Microsoft Product Lifecycle for information about how this product, service, techn