Malware Archives | ThreatsHub Cybersecurity News

Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique, tracked by Microsoft as “RedFlick”.
The post Star Blizzard refines phishing and malware delivery with the RedFlick technique appeared first on Microsoft Security Blog. READ MORE HERE…

Microsoft Secure

September 28, 2026 TH Author

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions that combines custom loaders, encrypted archives, and extensible components to maintain long-term access and support follow-on operations.
The post NeedyMantis: Unpacking a post-compromise malware family used in targeted operations appeared first on Microsoft Security Blog. READ MORE HERE…

Microsoft Secure

September 1, 2026 TH Author

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives. Microsoft Defender Experts shares observed attack techniques, Defender XDR detections, indicators of compromise, and practical mitigations to help organizations identify, block, and respond to this threat.
The post Counterfeit installers to system compromise: Tracking a deceptive software download campaign appeared first on Microsoft Security Blog. READ MORE HERE…

Microsoft Secure

August 26, 2026 TH Author

When AI infrastructure becomes the target: Securing gateways and control points

Microsoft Threat Intelligence examines attacks on exposed AI workloads, including LiteLLM gateway exploitation, credential harvesting, persistence, and cryptomining activity.
The post When AI infrastructure becomes the target: Securing gateways and control points appeared first on Microsoft Security Blog. READ MORE HERE…

Microsoft Secure

July 31, 2026 TH Author

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals of hospitality-related organizations such as hotels since May 2026 in order to deliver malware to travelers and steal credentials in an operation we call CaptiveCrunch.
The post CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft appeared first on Microsoft Security Blog. READ MORE HERE…

Networkworld

March 14, 2023 TH Author

DNS data shows one in 10 organizations have malware traffic on their networks

Akamai report highlights how widespread malware threats remain, noting the dangers of threats specific to DNS infrastructure. READ MORE HERE…

Networkworld

March 10, 2023 TH Author

Attacks on SonicWall appliances linked to Chinese campaign: Mandiant

The technique used in the attack on SonicWall devices are consistent with earlier attacks from a Chinese campaign. READ MORE HERE…

Microsoft Secure

December 6, 2022 TH Author

DEV-0139 launches targeted attacks against the cryptocurrency industry

Microsoft security researchers investigate an attack where the threat actor, tracked DEV-0139, used chat groups to target specific cryptocurrency investment companies and run a backdoor within their network.
The post DEV-0139 launches targeted attacks against the cryptocurrency industry appeared first on Microsoft Security Blog. READ MORE HERE…

Microsoft Secure

July 26, 2022 TH Author

Malicious IIS extensions quietly open persistent backdoors into servers

Attackers are increasingly leveraging managed IIS extensions as covert backdoors into servers, providing a durable persistence mechanism for attacks.
The post Malicious IIS extensions quietly open persistent backdoors into servers appeared first on Microsoft Security Blog. READ MORE HERE…