Credential theft News and Insights | Microsoft Security Blog

Modernize your Security Operations Center with Microsoft Sentinel

Microsoft Sentinel is a cloud-native SIEM solution powered by AI and automation that delivers intelligent security analytics across your entire enterprise.

Learn more
July 22, 2021 8 min read

When coin miners evolve, Part 1: Exposing LemonDuck and LemonCat, modern mining malware infrastructure

LemonDuck, an actively updated and robust malware that’s primarily known for its botnet and cryptocurrency mining objectives, adopted more sophisticated behavior and escalated its operations.
May 26, 2021 9 min read

Becoming resilient by understanding cybersecurity risks: Part 4—navigating current threats

Learn how your infrastructure and security operations can make you vulnerable to insider threats, ransomware, weaponized AI, and more.
April 19, 2021 5 min read

Surface expands its Secured-core portfolio with the new Surface Laptop 4 powered by AMD Ryzen™ Mobile Processors

Microsoft is proud to announce our latest Secured-core offering, the all-new Surface Laptop 4 powered by AMD Ryzen™ Mobile Processors.
April 1, 2021 11 min read

Automating threat actor tracking: Understanding attacker behavior for intelligence and contextual alerting

A probabilistic graphical modeling framework used by Microsoft 365 Defender research and intelligence teams for threat actor tracking enables us to quickly predict the likely threat group responsible for an attack, as well as the likely next attack stages.
Tailored AI insights from Microsoft Security Copilot

Empower your defenders to detect hidden patterns, harden defenses, and respond to incidents faster with generative AI.

Learn more
March 25, 2021 21 min read

Analyzing attacks taking advantage of the Exchange Server vulnerabilities

Microsoft continues to monitor and investigate attacks exploiting the recent on-premises Exchange Server vulnerabilities.
February 25, 2021 6 min read

Microsoft open sources CodeQL queries used to hunt for Solorigate activity

We are sharing the CodeQL queries that we used to analyze our source code at scale and rule out the presence of the code-level indicators of compromise (IoCs) and coding patterns associated with Solorigate so that other organizations may perform a similar analysis.
February 1, 2021 18 min read

What tracking an attacker email infrastructure tells us about persistent cybercriminal operations

Sweeping research into massive attacker infrastructures, as well as our real-time monitoring of malware campaigns and attacker activity, directly inform Microsoft security solutions, allowing us to build or improve protections that block malware campaigns and other email threats, both current and future, as well as provide enterprises with the tools for investigating and responding to email campaigns in real-time.
January 28, 2021 5 min read

Why operational resilience will be key in 2021, and how this impacts cybersecurity

The lessons we have learned during the past 12 months have demonstrated that the ability to respond to, and bounce back from adversity in general, can impact the short-and long-term success of any organization.
Go beyond data protection with Microsoft Purview

Govern, protect, and manage all of your data with Microsoft Purview, comprehensive solutions to help give you better visibility and control.

Learn more
January 20, 2021 23 min read

Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop

Our continued investigation into the Solorigate attack has uncovered new details about the handover from the Solorigate DLL backdoor (SUNBURST) to the Cobalt Strike loader (TEARDROP, Raindrop, and others).
January 14, 2021 11 min read

Increasing resilience against Solorigate and other sophisticated attacks with Microsoft Defender

This blog is a guide for security administrators using Microsoft 365 Defender and Azure Defender to identify and implement security configuration and posture improvements that harden enterprise environments against Solorigate’s attack patterns.
December 28, 2020 21 min read

Using Microsoft 365 Defender to protect against Solorigate

This blog is a comprehensive guide for security operations and incident response teams using Microsoft 365 Defender to identify, investigate, and respond to the Solorigate attack if it’s found in your environment.
December 18, 2020 17 min read

Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers

We, along with the security industry and our partners, continue to investigate the extent of the Solorigate attack.

Credential theft

Filtered by

Refine results

When coin miners evolve, Part 1: Exposing LemonDuck and LemonCat, modern mining malware infrastructure

Becoming resilient by understanding cybersecurity risks: Part 4—navigating current threats

Surface expands its Secured-core portfolio with the new Surface Laptop 4 powered by AMD Ryzen™ Mobile Processors

Automating threat actor tracking: Understanding attacker behavior for intelligence and contextual alerting

Analyzing attacks taking advantage of the Exchange Server vulnerabilities

Microsoft open sources CodeQL queries used to hunt for Solorigate activity

What tracking an attacker email infrastructure tells us about persistent cybercriminal operations

Why operational resilience will be key in 2021, and how this impacts cybersecurity

Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop

Increasing resilience against Solorigate and other sophisticated attacks with Microsoft Defender

Using Microsoft 365 Defender to protect against Solorigate

Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers

Get started with Microsoft Security

Credential theft

Filtered by

Refine results

Modernize your Security Operations Center with Microsoft Sentinel

Tailored AI insights from Microsoft Security Copilot

Go beyond data protection with Microsoft Purview

Get started with Microsoft Security