Threat landscape

Strengthen your defenses with actionable insights and industry reports from Microsoft Threat Intelligence experts.

Three people wearing saftey hats and looking at a tablet.

Mar 31, 2026 • 9 min read

The threat to critical infrastructure has changed. Has your readiness?

Critical infrastructure faces new risks as threat actors focus on establishing persistent access. Learn about the shift and steps to increase resilience.

Apr 10, 2026 • 2 min watch

RSAC 2026 recap: Securing the frontier

Feb 25, 2026 • 20 min watch

Modern threats demand modern discipline

Jan 27, 2026 • 16 min watch

The 10 security decisions that matter most in 2026

Jan 27, 2026 • 35 min watch

Secure by design in practice

Understand them to defend against them

Get insights on active nation-state threat actors and cybercriminal organizations with analysis and updates from Microsoft Threat Intelligence.

Plaid Rain

Plaid Rain primarily targets critical manufacturing, IT, and defense organizations in Israel.

Learn more

Volt Typhoon

Based out of China, Volt Typhoon targets critical infrastructure in the United States.

Learn more

Mint Sandstorm

Mint Sandstorm goes after activists, journalists, and think tanks inside and outside Iran.

Learn more

Silk Typhoon

Silk Typhoon focuses on reconnaissance campaigns in the United States, Australia, Japan, and Vietnam.

Learn more

Forest Blizzard

Forest Blizzard is a Russian nation-state actor that uses malware to compromise cloud and on-premises environments.

Learn more

Aqua Blizzard

Located in Russia, Aqua Blizzard targets governmental and non-governmental organizations in Ukraine.

Learn more

Crimson Sandstorm

Using phishing and fictitious social media accounts, Crimson Sandstorm delivers malware to exfiltrate data.

Learn more

Gray Sandstorm

Nation-state actor, Gray Sandstorm, used password spray to target accounts in an organization.

Learn more

Periwinkle Tempest

Periwinkle Tempest is responsible for developing, distributing, and managing several ransomware payloads.

Learn more

Caramel Tsunami

Caramel Tsunami sells hacking-as-a-service packages that include malware or zero-day exploits.

Learn more

Cadet Blizzard

Cadet Blizzard is a Russian-sponsored group that conducts operations against Ukraine and Europe.

Learn more

Smoke Sandstorm

Based in Iran, Smoke Sandstorm compromises email accounts at organizations in the Middle East.

Learn more

Hazel Sandstrom

Linked to Iran, Hazel Sandstorm disrupted government websites and public services in Albania in 2022.

Learn more

Nylon Typhoon

Nylon Typhoon creates and deploys custom malware that allows them to compromise remote access.

Learn more

Pistachio Tempest

Pistachio Tempest uses ransomware-as-a-service offerings to gain access, exfiltrate data, and extort victims.

Learn more

Manatee Tempest

Manatee Tempest is part of the ransomware-as-a-service economy and provides custom Cobalt Strike loaders.

Learn more

Storm-0530

A group of actors originating from North Korea, Storm-0530 targets small businesses with ransomware.

Learn more

Diamond Sleet

Based in North Korea, Diamond Sleet uses custom malware for espionage, data theft, and network destruction.

Learn more

Wine Tempest

Wine Tempest typically infiltrates a machine in a network and deploys human-operated ransomware.

Learn more

Inside Microsoft Threat Intelligence video series

Microsoft disrupted Storm-1152’s 750 million fake accounts. See how threat intelligence becomes action, disruption, and protection.

Watch episode one
When threat actors strike, Microsoft’s Incident Response team steps into the chaos to bring calm and structure to the equation.

Watch episode two
Follow Senior Security Researcher Thomas Ball in the latest episode of Inside Microsoft Threat Intelligence as he discusses modern threat hunting in the age of AI.

Watch episode three
Explore the foundation that fuels it all–security research–through the lens of Principal Security Researcher Jonathan Bar Or (JBO).

Watch episode four