Microsoft Security

Security Insider

Threat landscape Emerging trends Risk management Leadership perspectives Operations Sign up for CISO Digest

Register for the May 6 SANS Cyber Solutions Fest – Cloud & Detection and Response Tracks. Register

BG image

Threat landscape

Take action and get the latest guidance derived from Microsoft Threat Intelligence’s global telemetry on the cybercrime ecosystem, nation state attacks, and emerging threats.

Three people wearing saftey hats and looking at a tablet.

Mar 31, 2026 • 9 min read

The threat to critical infrastructure has changed. Has your readiness?

Critical infrastructure faces new risks as threat actors focus on establishing persistent access. Learn about the shift and steps to increase resilience.

Upcoming event • May 6, 2026

SANS session - Payroll Pirates and Untested Defenses: Exploring Modern Intrusions

Apr 10, 2026 • 2 min watch

RSAC 2026 recap: Securing the frontier

Feb 25, 2026 • 20 min watch

Modern threats demand modern discipline

Jan 27, 2026 • 16 min watch

The 10 security decisions that matter most in 2026

Understand them to defend against them

Get insights on active nation-state threat actors and cybercriminal organizations with analysis and updates from Microsoft Threat Intelligence.

Plaid Rain

Plaid Rain primarily targets critical manufacturing, IT, and defense organizations in Israel.

Volt Typhoon

Based out of China, Volt Typhoon targets critical infrastructure in the United States.

Mint Sandstorm

Mint Sandstorm goes after activists, journalists, and think tanks inside and outside Iran.

Silk Typhoon

Silk Typhoon focuses on reconnaissance campaigns in the United States, Australia, Japan, and Vietnam.

Forest Blizzard

Forest Blizzard is a Russian nation-state actor that uses malware to compromise cloud and on-premises environments.

Aqua Blizzard

Located in Russia, Aqua Blizzard targets governmental and non-governmental organizations in Ukraine.

Crimson Sandstorm

Using phishing and fictitious social media accounts, Crimson Sandstorm delivers malware to exfiltrate data.

Gray Sandstorm

Nation-state actor, Gray Sandstorm, used password spray to target accounts in an organization.

Periwinkle Tempest

Periwinkle Tempest is responsible for developing, distributing, and managing several ransomware payloads.

Caramel Tsunami

Caramel Tsunami sells hacking-as-a-service packages that include malware or zero-day exploits.

Cadet Blizzard

Cadet Blizzard is a Russian-sponsored group that conducts operations against Ukraine and Europe.

Smoke Sandstorm

Based in Iran, Smoke Sandstorm compromises email accounts at organizations in the Middle East.

Hazel Sandstrom

Linked to Iran, Hazel Sandstorm disrupted government websites and public services in Albania in 2022.

Nylon Typhoon

Nylon Typhoon creates and deploys custom malware that allows them to compromise remote access.

Pistachio Tempest

Pistachio Tempest uses ransomware-as-a-service offerings to gain access, exfiltrate data, and extort victims.

Manatee Tempest

Manatee Tempest is part of the ransomware-as-a-service economy and provides custom Cobalt Strike loaders.

Storm-0530

A group of actors originating from North Korea, Storm-0530 targets small businesses with ransomware.

Diamond Sleet

Based in North Korea, Diamond Sleet uses custom malware for espionage, data theft, and network destruction.

Wine Tempest

Wine Tempest typically infiltrates a machine in a network and deploys human-operated ransomware.

Inside Microsoft Threat Intelligence video series

Microsoft disrupted Storm-1152’s 750 million fake accounts. See how threat intelligence becomes action, disruption, and protection.

Watch episode one
When threat actors strike, Microsoft’s Incident Response team steps into the chaos to bring calm and structure to the equation.

Watch episode two
Follow Senior Security Researcher Thomas Ball in the latest episode of Inside Microsoft Threat Intelligence as he discusses modern threat hunting in the age of AI.

Watch episode three
Explore the foundation that fuels it all–security research–through the lens of Principal Security Researcher Jonathan Bar Or (JBO).

Watch episode four

A woman and two men sitting in chairs.

Jan 27, 2026 • 35 min watch

Secure by Design in Practice

Two people speaking into microphones at a table during a recorded discussion.

Jan 13, 2026 • 9 min watch

How a sophisticated scam actually plays out

A woman in a grey sweater sitting at a table looking at her phone.

Dec 9, 2025 • 10 min read

Staying secure online during the holidays

A yellow folder with the text Microsoft Security The Microsoft Threat Intelligence Podcast placed against a blue background.

Sep 15, 2025 • 5 min listen

Live from Black Hat: Ransomware, Responsible Disclosure, and the Rise of AI

A yellow folder with the text Microsoft Security The Microsoft Threat Intelligence Podcast placed against a blue background.

Mar 19, 2025 • 40 min listen

Get a pulse check on the state of ransomware

A person holding a tablet in a room.

Mar 31, 2025 • 13 min read

Finding bootloader vulnerabilities faster with AI

A yellow folder with the text Microsoft Security The Microsoft Threat Intelligence Podcast placed against a blue background.

Jan 8, 2025 • 28 min listen

How threat actors exploit remote monitoring and management

A store display with various signs including numerical text and phrases about brands, sales, and cyber-related topics.

Apr 16, 2025 • 12 min read

AI-powered deception: Emerging fraud threats and countermeasures

Two people talking to each other

Mar 5, 2025 • 13 min read

How Silk Typhoon compromises supply chains

A night view of a glass building.

Feb 12, 2025 • 23 min read

The tactics, techniques, and procedures of a Seashell Blizzard subgroup

A man wearing headphones on his neck looking at a computer screen.

Mar 6, 2025 • 32 min read

Understand and mitigate a large-scale malvertising campaign

A person sitting at a desk typing on a laptop.

Apr 3, 2025 • 13 min read

Threat actors use tax-themed phishing during tax season

A man and two woman sitting on chairs and addressing media.

Nov 27, 2024 • 2 min read

How threat actors are using AI now—and what’s next

BG image

A book cover displaying the text Microsoft Digital Defense Report 2025 with a blue spiral-shaped object against a neutral background.

Oct 16, 2025 • Over an hour read

Microsoft Digital Defense Report 2025

A pink and white swirl on a purple background with white dots.

Dec 20, 2024 • 7 min read

10 essential insights from the Microsoft Digital Defense Report

A group of medical professionals looking at a clipboard.

Nov 27, 2024 • 6 min read

Tackling healthcare-targeted ransomware. Together.

A person shadow on mobile screen.

Jan 9, 2024 • 10 min read

Manipulating trust: Why social engineering fraud works

A book cover displaying the text Microsoft Digital Defense Report 2024 with a design of a planet and particles.

Oct 15, 2024 • Over an hour read

Microsoft Digital Defense Report 2024

A book cover featuring a city skyline with text that reads Microsoft Digital Defense Report CISO Executive Summary.

Oct 6, 2023 • 20 min read

Microsoft Digital Defense Report 2023: CISO Executive Summary

A blue and white cover with the text Microsoft Digital Defense Report on a white background.

Oct 6, 2023 • Over an hour read

Microsoft Digital Defense Report 2023

A close-up of a book with text that reads Microsoft Digital Defence Report 2022.

Oct 6, 2022 • Over an hour read

Microsoft Digital Defense Report 2022

A book cover with the title Microsoft Digital Defense Report featuring blue and white lines on a black background.

Oct 6, 2021 • Over an hour read

Microsoft Digital Defense Report 2021

A close-up of a book cover with the title Microsoft Digital Defense Report.

Sep 1, 2020 • Over an hour read

Microsoft Digital Defense Report 2020

bg image

Connect with us

Get the CISO Digest

Stay ahead with expert insights, industry trends, and security research in this bimonthly email series.

A person holding a tablet while wearing a beige suit.

Why Microsoft Security

Discover why Microsoft Security is the top choice for comprehensive security in the era of AI.

Follow Microsoft Security

Your Privacy Choices