Lightnews — Scholar-powered news

Microsoft Threat Intelligence @threatintel.microsoft.com · 20h

Medusa is a RaaS offering with affiliates like Storm-1175 carrying out double extortion. Storm-1175 was recently observed exploiting the CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability to deploy Medusa: msft.it/63323s0Z6Z

1

Microsoft Threat Intelligence @threatintel.microsoft.com · 20h

PipeMagic is attributed to the financially motivated actor Storm-2460. Because PipeMagic is modular, the threat actor can send module code over the network and the backdoor self-updates in memory. Read about PipeMagic and its internal architecture: msft.it/63328s0k74

1 1

Microsoft Threat Intelligence @threatintel.microsoft.com · 20h

The highly modular backdoor PipeMagic and the RaaS offering Medusa both exemplify how threats continuously evolve. The latest Microsoft Threat Intelligence Podcast episode features a threat landscape update with a deep dive on these threats: msft.it/63322s0k2o

Threat Landscape Update: Ransomware-as-a-Service and Advanced Modular Malware

In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠⁠Sherrod DeGrippo⁠ is joined by Tori Murphy, Anna Seitz, and Chuong Dong to break down two threats: the modular backdoor PipeMagic and Medusa ransomware. They discuss how PipeMagic disguises itself as a ChatGPT desktop app to deliver malware, its sophisticated modular design, and what defenders can do to detect it. The team also explores Medusa’s evolution into a ransomware-as-a-service model, its use of double extortion tactics, and the broader threat landscape shaped by ransomware groups, social engineering, and the abuse of legitimate tools.

msft.it

1 1 3

Microsoft Threat Intelligence @threatintel.microsoft.com · 1d

Threat actors seek to abuse Microsoft Teams features and capabilities at different points along the attack chain. Learn about countermeasures and controls across identity, endpoints, data apps, and network layers to help harden enterprise Teams environments. msft.it/63328sLUZs

Disrupting threats targeting Microsoft Teams | Microsoft Security Blog

Threat actors seek to abuse Microsoft Teams features and capabilities across the attack chain, underscoring the importance for defenders to proactively monitor, detect, and respond effectively. In this blog, we recommend countermeasures and optimal controls across identity, endpoints, data apps, and network layers to help strengthen protection for enterprise Teams users.

msft.it

1 1

Microsoft Threat Intelligence @threatintel.microsoft.com · 2d

Storm-1175, a financially motivated actor known for deploying Medusa ransomware & exploiting public-facing applications, was observed exploiting the CVE-2025-10035 vulnerability in GoAnywhere MFT's License Servlet. Read our analysis & get detection+hunting guidance: msft.it/63325sIfZZ

Investigating active exploitation of CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability | Microsoft Security Blog

Storm-1175, a financially motivated actor known for deploying Medusa ransomware and exploiting public-facing applications for initial access, was observed exploiting the deserialization vulnerability in GoAnywhere MFT's License Servlet, tracked as CVE-2025-10035. We are publishing this blog post to increase awareness of this threat and to share end-to-end protection coverage details across Microsoft Defender.

msft.it

5 6

Microsoft Threat Intelligence @threatintel.microsoft.com · 7d

Beyond immediate containment, Microsoft IR supports recovery, future planning, and building long-term resilience. According to Adrian Hill, lead investigator for Microsoft IR, “The customer needs to be successful. The only way to do that is to ensure that everyone is successful.”

1

Microsoft Threat Intelligence @threatintel.microsoft.com · 7d

By leading with empathy and collaboration, Microsoft IR unites vendors and internal teams to stabilize crises and uncover hidden threats, ensuring unified action. This approach means that every engagement restores the customer and simultaneously strengthens the broader security ecosystem.

1 1

Microsoft Threat Intelligence @threatintel.microsoft.com · 7d

The nature of incident response is its chaos, and the second chapter of our four-part Inside Microsoft Threat Intelligence miniseries displays how Microsoft’s IR team thrives amid disorder, stepping in when environments are compromised and confidence is shaken: msft.it/63322svfky

1 2 5

Microsoft Threat Intelligence @threatintel.microsoft.com · 8d

In addition, the Security Copilot agent ecosystem continues to expand with new Microsoft and partner solutions, available in the new Microsoft Security Store, to address additional security and IT scenarios. msft.it/63328svuxy

Microsoft Threat Intelligence @threatintel.microsoft.com · 8d

Users looking to create, publish, and test agents in Security Copilot using natural language, agent builder forms, YAMLs, and MCP can get more info and guidance from the Microsoft Security Copilot developer content: msft.it/63326svuay.

1

Microsoft Threat Intelligence @threatintel.microsoft.com · 8d

You can now build your own Security Copilot agents. The Security Copilot portal features a no-code agent builder that lets you describe what you need in natural language and create, optimize, and publish agents tailored to your workflows in minutes. msft.it/63325svuQL

Agentic security your way: Build your own Security Copilot agents | Microsoft Community Hub

Microsoft Security Copilot is redefining how security and IT teams operate. Today at Microsoft Secure, we’re unveiling powerful updates that put genAI and...

msft.it

1 1 2

Microsoft Threat Intelligence @threatintel.microsoft.com · 8d

Microsoft Sentinel is evolving into both the SIEM and the platform for agentic defense with the general availability of Sentinel data lake, and the public preview of Sentinel graph and Sentinel Model Context Protocol (MCP) server: msft.it/63327svJHJ

Microsoft Sentinel: The security platform for the agentic era | Microsoft Security Blog

Microsoft unveils a new wave of security innovation-delivering an agentic platform to protect organizations at scale. Learn more.

msft.it

2 2

Microsoft Threat Intelligence @threatintel.microsoft.com · 13d

We shared these findings with Apple and collaborated with GitHub to take down affected repositories. This work reflects our commitment to disrupting attacks & dismantling attacker operations. Alongside our findings, we're sharing detections & recommendations to help orgs defend against this threat.

1 3

Microsoft Threat Intelligence @threatintel.microsoft.com · 13d

This new XCSSET variant improves browser targeting, clipboard hijacking, and persistence mechanisms. It employs sophisticated encryption and obfuscation techniques, uses run-only compiled AppleScripts for stealth, and expands data exfiltration capabilities.

1 1 3

Microsoft Threat Intelligence @threatintel.microsoft.com · 13d

Microsoft Threat Intelligence has uncovered a new variant of the XCSSET malware, which is designed to infect Xcode projects, typically used by software developers building Apple or macOS-related applications. msft.it/63320sS0R0

XCSSET evolves again: Analyzing the latest updates to XCSSET’s inventory | Microsoft Security Blog

Microsoft Threat Intelligence has uncovered a new variant of the XCSSET malware, which is designed to infect Xcode projects, typically used by software developers building Apple or macOS-related applications.

msft.it

1 2 6

Microsoft Threat Intelligence @threatintel.microsoft.com · 14d

Learn more in this episode of the Microsoft Threat Intelligence Podcast, where Sherrod De Grippo and Kelly Bissel discuss the scale of domain impersonation and typosquatting problem and how Microsoft works to defend against them.

4

Microsoft Threat Intelligence @threatintel.microsoft.com · 14d

AI is also empowering defenders to counter these AI-aided threats. At Microsoft, we have adopted Siamese neural networks to determine subtle patterns in real time and spot domain impersonation at creation and at scale.

1 3

Microsoft Threat Intelligence @threatintel.microsoft.com · 14d

Attackers are leveraging AI and bots to create phishing campaigns that are more tailored than ever. Using these tools for domain impersonation, typosquatting, and other tactics, attackers can tailor a phishing attack directly to one individual – and do that at scale. msft.it/63320sSdmM

Stopping Domain Impersonation with AI

In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠⁠Sherrod DeGrippo⁠ is joined by Kelly Bissell, Corporate Vice President at Microsoft, to explore how domain impersonation and typosquatting are changing in the age of AI. They discuss how attackers are increasingly using AI and bots to scale online deception, why this tactic is so effective, and how Microsoft is countering cutting-edge defenses like Siamese neural networks to detect fraudulent domains in real time. Kelly shares insights on the massive scale of these threats, the shift toward defender advantage, and the broader implications for securing organizations worldwide.

msft.it

1 1 5

Microsoft Threat Intelligence @threatintel.microsoft.com · 15d

The case highlights how defenders must understand and anticipate AI-driven threats, as AI-generated obfuscation often introduces new artifacts that can be leveraged for detection. Learn how to recognize similar tactics and strengthen defenses in this Microsoft Threat Intelligence blog post.

2

Microsoft Threat Intelligence @threatintel.microsoft.com · 15d

Microsoft Security Copilot assessed that the code was “not something a human would typically write from scratch,” while Microsoft Defender for Office 365’s AI-powered protection systems stopped the threat by analyzing signals that remain effective against AI-enhanced attacks.

1 2

Microsoft Threat Intelligence @threatintel.microsoft.com · 15d

The campaign, though limited in scope, demonstrates how attackers are experimenting with AI to enhance the effectiveness and stealth of their operations. Analysis revealed the malicious code was disguised within an SVG file using business terminology and synthetic structures.

1 2

Microsoft Threat Intelligence @threatintel.microsoft.com · 15d

Microsoft Threat Intelligence recently detected and blocked a credential phishing campaign that likely leveraged AI-generated code to obfuscate its payload and evade traditional defenses. msft.it/63323sSBWN

AI vs. AI: Detecting an AI-obfuscated phishing campaign | Microsoft Security Blog

Microsoft Threat Intelligence recently detected and blocked a credential phishing campaign that likely used AI-generated code to obfuscate its payload and evade traditional defenses, demonstrating a broader trend of attackers leveraging AI to increase the effectiveness of their operations and underscoring the need for defenders to understand and anticipate AI-driven threats.

msft.it

1 4 5

Microsoft Threat Intelligence @threatintel.microsoft.com · 15d

The worm replicated by injecting malicious post-install scripts into popular JavaScript packages and was capable of stealing sensitive info, including npm tokens. In addition to remediating the Shai-Hulud attack in a timely manner, GitHub has laid out a roadmap for hardening npm package publication.

2

Microsoft Threat Intelligence @threatintel.microsoft.com · 15d

In these attacks, threat actors gain unauthorized access to maintainer accounts and distribute malicious code through trusted packages. A recent example of such an attack is the Shai-Hulud attack, a self-replicating worm that infiltrated the npm ecosystem via compromised maintainer accounts.

1 2

Microsoft Threat Intelligence @threatintel.microsoft.com · 15d

GitHub is strengthening npm security with stricter authentication, granular tokens, and enhanced trusted publication. This is in response to the surge of account takeovers on package registries like npm. msft.it/63325sqQ71

Our plan for a more secure npm supply chain

GitHub is strengthening npm's security with stricter authentication, granular tokens, and enhanced trusted publishing.

msft.it

1 1 8