Research reports
1,224 reports from 387 publishers45 added in the past week
Added Tue 13 Oct
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
Microsoft Threat Intelligence has identified NeedyMantis, a modular post-compromise malware family observed in a limited number of targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental…
Malware
Added Sat 10 Oct
Star Blizzard refines phishing and malware delivery with the RedFlick technique
Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that…
State-sponsoredMalwarePhishing
Added Wed 5 Aug
Exposing Fox Tempest: A malware-signing service operation
Fox Tempest is a financially motivated threat actor that operates a malware-signing-as-a-service (MSaaS) used by other cybercriminals to more effectively distribute malicious code, including ransomware. The threat actor abuses Microsoft Artifact Signing to…
Malware
Disrupting Fox Tempest: A cybercrime service that turned “verified” software into a pathway for ransomware
Every day, we decide what software to trust in seconds guided by simple labels such as “verified,” “secure,” and “safe to install.” The problem is that those signs can be manipulated. Today, Microsoft unsealed a legal case in the US District Court for the…
RansomwareMalware
Added Tue 4 Aug
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
Since early May 2026, Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, conducting widespread but targeted traffic manipulation attacks involving hospitality sector networks served by captive portals worldwide. Despite…
State-sponsoredMalware
Added Fri 17 Jul
Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access
By Microsoft Defender Security Research Team, Microsoft Defender Experts, Parth Jomadkar Microsoft Threat Intelligence has identified an active multi-stage intrusion campaign targeting organizations in the hospitality and hotel industry since April 2026.…
Malware
Added Thu 11 Jun
StilachiRAT analysis: From system reconnaissance to cryptocurrency theft
In November 2024, Microsoft Incident Response researchers uncovered a novel remote access trojan (RAT) we named StilachiRAT that demonstrates sophisticated techniques to evade detection, persist in the target environment, and exfiltrate sensitive data.…
Malware
Added Tue 19 May
Kazuar: Anatomy of a nation-state botnet
Kazuar, a sophisticated malware family attributed to the Russian state actor Secret Blizzard, has been under constant development for years and continues to evolve in support of espionage-focused operations. Over time, Kazuar has expanded from a relatively…
State-sponsoredMalwareBotnets and DDoS
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.