Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
Explore how Storm-3068 turned a compromised identity into broader cloud access and the steps organizations can take to defend their identities, pipelines, and cloud infrastructure. The post Beyond source code: A path to the keys to the kingdom appeared first on Microsoft Security Blog.
First reported Sep 29, 2026 16:00 UTCCatalog metadata updated Oct 08, 2026 03:47 UTCOpen evidence recordRead highlights from the 2026 Microsoft Digital Defense Report, which reflects a security environment that continues to grow more interconnected. The post Insights from the 2026 Microsoft Digital Defense Report appeared first on Microsoft Security Blog.
First reported Oct 01, 2026 14:00 UTCCatalog metadata updated Oct 08, 2026 03:47 UTCOpen evidence recordThis year at Microsoft Ignite, we spotlight our AI-first, end-to-end security platform designed to protect identities, devices, data, applications, clouds, infrastructure, and the AI agents now working alongside your teams. The post Secure what’s next: Your guide to Microsoft Security at Microsoft Ignite 2026 appeared first on Microsoft Security Blog.
First reported Sep 30, 2026 19:31 UTCCatalog metadata updated Oct 08, 2026 03:47 UTCOpen evidence recordLearn how CISOs can mitigate cybersecurity risks and increase resilience in the age of AI-powered vulnerability management. The post CISO perspectives on managing vulnerability risks in the age of AI appeared first on Microsoft Security Blog.
First reported Oct 06, 2026 16:00 UTCCatalog metadata updated Oct 08, 2026 03:47 UTCOpen evidence recordSince January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique, tracked by Microsoft as “RedFlick”. The post Star Blizzard refines phishing and malware delivery with the RedFlick technique appeared first on Micr
First reported Sep 29, 2026 15:00 UTCCatalog metadata updated Oct 08, 2026 03:47 UTCOpen evidence recordRead how How Microsoft Security's FORGE Lab is scaling vulnerability research from Windows to the Linux kernel. The post 3 lessons from frontier AI vulnerability research appeared first on Microsoft Security Blog.
First reported Oct 07, 2026 16:00 UTCCatalog metadata updated Oct 08, 2026 03:47 UTCOpen evidence recordMicrosoft Threat Intelligence examines CVE-2026-73570 exploitation in Zimbra, including observed attack paths, detection opportunities, and mitigation guidance. The post Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 appeared first on Microsoft Security Blog.
First reported Sep 30, 2026 14:00 UTCCatalog metadata updated Oct 08, 2026 03:47 UTCOpen evidence recordAccording to this year’s Microsoft Digital Defense Report, government agencies and services were the sector most impacted by cyber threats in 2026, accounting for 27% of observed activity, up from 17% in 2025. The post Preparing governments for an era of interconnected cyber risk appeared first on Microsoft Security Blog.
First reported Oct 01, 2026 14:00 UTCCatalog metadata updated Oct 08, 2026 03:47 UTCOpen evidence recordMicrosoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions that combines custom loaders, encrypted archives, and extensible components to maintain long-term access and support follow-on operations. The post NeedyMantis: Unpacking a post-compromise malware family used in targeted operations appeared first on Microsoft Security Blog.
First reported Sep 28, 2026 15:00 UTCCatalog metadata updated Oct 08, 2026 03:47 UTCOpen evidence recordMicrosoft observed phishing campaigns that abused MSP360 RMM to deploy ScreenConnect, creating redundant remote-access channels for follow-on activity The post Phishing Abuses RMM Tools for Persistent Access appeared first on Microsoft Security Blog.
First reported Sep 29, 2026 21:39 UTCCatalog metadata updated Oct 08, 2026 03:47 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.