Month: October 2025

Credit to Author: Microsoft Security Team| Date: Thu, 09 Oct 2025 16:00:00 +0000

​Security is a core focus at Microsoft Ignite 2025, reflected in dedicated sessions and hands-on experiences designed for security professionals and leaders. Take a look at the session catalog.

The post Securing agentic AI: Your guide to the Microsoft Ignite sessions catalog appeared first on Microsoft Security Blog.

Credit to Author: Microsoft Threat Intelligence| Date: Thu, 09 Oct 2025 15:00:00 +0000

Microsoft Threat Intelligence has identified a financially motivated threat actor that we track as Storm-2657 compromising employee accounts to gain unauthorized access to employee profiles and divert salary payments to attacker-controlled accounts, attacks that have been dubbed “payroll pirate”.

The post Investigating targeted “payroll pirate” attacks affecting US universities appeared first on Microsoft Security Blog.

Credit to Author: Microsoft Threat Intelligence| Date: Tue, 07 Oct 2025 17:00:00 +0000

Threat actors seek to abuse Microsoft Teams features and capabilities across the attack chain, underscoring the importance for defenders to proactively monitor, detect, and respond effectively. In this blog, we recommend countermeasures and optimal controls across identity, endpoints, data apps, and network layers to help strengthen protection for enterprise Teams users.

The post Disrupting threats targeting Microsoft Teams appeared first on Microsoft Security Blog.

Credit to Author: Hammad Rajjoub| Date: Tue, 07 Oct 2025 16:00:00 +0000

Microsoft Secure Future Initiative (SFI) patterns and practices are practical, actionable, insights from practitioners for practitioners based on Microsoft’s implementation of Zero Trust through the Microsoft Secure Future Initiatives. By adopting these patterns, organizations can accelerate their security maturity, reduce implementation friction, and build systems that are more secure by design, default, and in operation.  ​

The post New Microsoft Secure Future Initiative (SFI) patterns and practices: Practical guides to strengthen security appeared first on Microsoft Security Blog.

Credit to Author: Elliot Volkman| Date: Mon, 06 Oct 2025 21:00:00 +0000

Incident response is never orderly. Threat actors don’t wait. Environments are compromised. Data is missing. Confidence is shaken. But for Microsoft’s Incident Response (IR) team, that chaos is exactly where the work begins.

The post Inside Microsoft Threat Intelligence: Calm in the chaos appeared first on Microsoft Security Blog.

Credit to Author: Microsoft Threat Intelligence| Date: Mon, 06 Oct 2025 17:00:00 +0000

Storm-1175, a financially motivated actor known for deploying Medusa ransomware and exploiting public-facing applications for initial access, was observed exploiting the deserialization vulnerability in GoAnywhere MFT’s License Servlet, tracked as CVE-2025-10035. We are publishing this blog post to increase awareness of this threat and to share end-to-end protection coverage details across Microsoft Defender.

The post Investigating active exploitation of CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability appeared first on Microsoft Security Blog.