blizzard – PossibleThreat Articles

Frequent freeloader part II: Russian actor Secret Blizzard using tools of other groups to attack Ukraine

December 12, 2024 0 Comments blizzard, credential theft, storm

Credit to Author: Microsoft Threat Intelligence| Date: Wed, 11 Dec 2024 17:00:00 +0000

Since January 2024, Microsoft has observed Secret Blizzard using the tools or infrastructure of other threat groups to attack targets in Ukraine and download its custom backdoors Tavdig and KazuarV2.

The post Frequent freeloader part II: Russian actor Secret Blizzard using tools of other groups to attack Ukraine appeared first on Microsoft Security Blog.

Microsoft Security

Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage

December 5, 2024 0 Comments adversary-in-the-middle (aitm), blizzard, storm

Credit to Author: Microsoft Threat Intelligence| Date: Wed, 04 Dec 2024 17:00:00 +0000

Microsoft has observed Secret Blizzard compromising the infrastructure and backdoors of the Pakistan-based threat actor we track as Storm-0156 for espionage against the Afghanistan government and Indian Army targets.

The post Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage appeared first on Microsoft Security Blog.

Microsoft Security

Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials

April 22, 2024 0 Comments blizzard, elevation of privilege, forest blizzard (strontium), Government, non-governmental organizations (ngos), Windows

Credit to Author: Microsoft Threat Intelligence| Date: Mon, 22 Apr 2024 16:00:00 +0000

Since 2019, Forest Blizzard has used a custom post-compromise tool to exploit a vulnerability in the Windows Print Spooler service that allows elevated permissions. Microsoft has issued a security update addressing this vulnerability as CVE-2022-38028.

The post Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials appeared first on Microsoft Security Blog.

Microsoft Security

Staying ahead of threat actors in the age of AI

February 15, 2024 0 Comments blizzard, forest blizzard (strontium), Government, mitre att&ck, non-governmental organizations (ngos), sandstorm, sleet, typhoon

Credit to Author: Microsoft Threat Intelligence| Date: Wed, 14 Feb 2024 12:00:00 +0000

Microsoft, in collaboration with OpenAI, is publishing research on emerging threats in the age of AI, focusing on identified activity associated with known threat actors Forest Blizzard, Emerald Sleet, Crimson Sandstorm, and others. The observed activity includes prompt-injections, attempted misuse of large language models (LLM), and fraud.

The post Staying ahead of threat actors in the age of AI appeared first on Microsoft Security Blog.

Microsoft Security

Star Blizzard increases sophistication and evasion in ongoing attacks

December 10, 2023 0 Comments blizzard, credential theft, star blizzard (seaborgium), state-sponsored threat actor

Credit to Author: Microsoft Threat Intelligence| Date: Thu, 07 Dec 2023 12:01:00 +0000

Microsoft Threat Intelligence continues to track and disrupt malicious activity attributed to a Russian state-sponsored actor we track as Star Blizzard, who has improved their detection evasion capabilities since 2022 while remaining focused on email credential theft against targets.

The post Star Blizzard increases sophistication and evasion in ongoing attacks appeared first on Microsoft Security Blog.

Microsoft Security

Microsoft shares threat intelligence at CYBERWARCON 2023

November 15, 2023 0 Comments blizzard, sandstorm, tsunami, typhoon

Credit to Author: Microsoft Threat Intelligence| Date: Thu, 09 Nov 2023 12:00:00 +0000

At the CYBERWARCON 2023 conference, Microsoft and LinkedIn analysts are presenting several sessions detailing analysis across multiple sets of threat actors and related activity, demonstrating Microsoft Threat Intelligence’s ongoing efforts to track threat actors, protect customers, and share information with the wider security community.

The post Microsoft shares threat intelligence at CYBERWARCON 2023 appeared first on Microsoft Security Blog.