Dive into the heart of threat intelligence as Principal Security Researcher Jonathan Bar Or reveals how proactive security research powers Microsoft’s defenses. msft.it/63325tJxpx

Microsoft’s threat hunters are transforming cyber defense by seeking out emerging threats before they strike. Instead of waiting for alerts, these experts combine human intuition with AI-powered analysis to uncover malicious activity that others miss. msft.it/63321tBQRR

In early October 2025, Microsoft disrupted a Vanilla Tempest campaign by revoking over 200 certificates that the threat actor had fraudulently signed and used in fake Teams setup files to deliver the Oyster backdoor and ultimately deploy Rhysida ransomware.

The October 2025 security updates are available: msft.it/6018SZEg0.

#PatchTuesday #SecurityUpdateGuide

The nature of incident response is its chaos, and the second chapter of our four-part Inside Microsoft Threat Intelligence miniseries displays how Microsoft’s IR team thrives amid disorder, stepping in when environments are compromised and confidence is shaken: msft.it/63322svfky

"Microsoft Threat Intelligence is fully focused on disrupting threat actor activity."

The first of a four-part Inside Microsoft Threat Intelligence miniseries gives behind-the-scenes look at how Microsoft's Digital Crimes Unit disrupted Storm-1152: msft.it/63327sWnGF

The September 2025 security updates are available: msft.it/6018SZEg0

The August 2025 security updates are available: msft.it/6018SZEg0

Microsoft has continuously observed hybrid attacks leading to espionage, business interruption, and ransomware deployment that involve threat actors moving from on-premises environments to the cloud.

While Golden SAML (Security Assertion Markup Language) attacks are less frequently observed than others, their impact can be huge. Whereas an adversary-in-the-middle (AiTM) attack only affects the account that got phished, a successful Golden SAML attack could compromise every account in an org.