sp @SP_Intel

Joined May 2015

Tweets

26
Followers

11
Following

142
Likes

15

Microsoft Threat Intelligence @MsftSecIntel

4 years ago

We’ve been tracking a phishing campaign that has been using open redirects for months, and it continues to evolve and persist. As recently as last week, we detected a spam run that abused a different web app but utilized the same TTPs and infrastructure.

9 217 477 0 40

Download Image

Microsoft Threat Intelligence @MsftSecIntel

4 years ago

A phishing campaign tries to evade detection by dividing its attachment into code segments and encoding them using various mechanisms. It’s like a jigsaw puzzle that only reveals its malicious intent once all pieces are combined and decoded. Details: msft.it/6019nLKsX

0 90 196 0 28

Download Image

Microsoft Threat Intelligence @MsftSecIntel

4 years ago

Our work to deliver comprehensive protection involves detecting anomalies as well as identifying threats hiding in plain sight. A sudden spike in the use of JNLP file attachments exposed an email campaign that was observed distributing a new credential-stealing malware.

2 31 47 0 7

Download Image

Microsoft Threat Intelligence @MsftSecIntel

4 years ago

An active phishing campaign is using a crafty combination of legitimate-looking original sender email addresses, spoofed display sender addresses that contain the target usernames and domains, and display names that mimic legitimate services to try and slip through email filters.

8 176 320 0 34

Jeremy Dallman @jdallman

4 years ago

Extending yesterday's blog, #MSTIC breaks down #NOBELIUM malware used in the latest campaigns and releases related IOCs.

Microsoft Threat Intelligence @MsftSecIntel

4 years ago

Extending yesterday's blog, #MSTIC breaks down #NOBELIUM malware used in the latest campaigns and releases related IOCs.

3 103 192 0 16

0 4 10 0 2

Microsoft Threat Intelligence @MsftSecIntel

4 years ago

In the past few months, Microsoft has been tracking a dynamic campaign targeting the aerospace and travel sectors with spear-phishing emails that distribute an actively developed loader, which then delivers RevengeRAT or AsyncRAT.

5 121 206 0 13

Download Image

Microsoft Threat Intelligence @MsftSecIntel

4 years ago

The recent surge of IcedID campaigns indicate that this malware family is likely being used to fill in some of the void left by recent malware infrastructure disruptions. We are tracking multiple active IcedID campaigns of various sizes, delivery methods, and targets.

4 180 344 0 21

Download Image

Microsoft Threat Intelligence @MsftSecIntel

5 years ago

Phishers continue to find success in using compromised accounts on email marketing services to send malicious emails from legitimate IP ranges and domains. They take advantage of configuration settings that ensure delivery of emails even when the email solution detects phishing.

5 102 236 0 17

Microsoft Threat Intelligence @MsftSecIntel

5 years ago

We're seeing numerous extensive hands-on-keyboard attacks emanating from the Gootkit malware, which is distributed via drive-by downloads as a JavaScript within a ZIP file. The JavaScript is launched via WScript and establishes C2, enabling attackers to take control of devices.

5 219 461 0 43

Microsoft Threat Intelligence @MsftSecIntel

5 years ago

WATCH: This webinar covers insights and details from our investigation into a sprawling email delivery infrastructure that was used to send more than a million emails per month through multiple campaigns from March to December 2020 youtube.com/watch?v=scrs5Z…

0 9 20 0 6

Microsoft Threat Intelligence @MsftSecIntel

5 years ago

We’re tracking a rampant phishing attack that uses DGA domains, free email services, and even compromised email accounts to send massive numbers of phishing emails. These emails are linked by open redirector URLs that begin with a distinct pattern: hxxps://t[.]domain[.]tld/r/?

3 212 369 0 38

Download Image

ARCHIVED - NASA's Perseverance Mars Rover @NASAPersevere

5 years ago

Your front-row seat to my Mars landing is here. Watch how we did it. #CountdownToMars

4K 55K 180K 0 5K

Download Video

Microsoft Threat Intelligence @MsftSecIntel

5 years ago

Microsoft 365 Defender data shows that the disruption of Emotet infrastructure immediately resulted in the drop in new campaigns. Given Emotet’s reach and role in the deployment of payloads like ransomware, however, customers should ensure continued monitoring and protection.

3 49 143 0 4

Microsoft Threat Intelligence @MsftSecIntel

5 years ago

We detected a recent spike in busines email compromise (BEC) attacks soliciting gift cards primarily targeting K-12 schoolteachers. Attackers impersonate colleagues or school officials to ask recipients to purchase various gift cards.

7 145 237 0 8

Download Image

sp @SP_Intel

5 years ago

The increased abuse of legitimate cloud hosting services in malware campaigns.

Microsoft Threat Intelligence @MsftSecIntel

5 years ago

The increased abuse of legitimate cloud hosting services in malware campaigns.

6 74 203 0 17

0 0 0 0 0

Microsoft Threat Intelligence @MsftSecIntel

5 years ago

We’re tracking an active credential phishing attack targeting enterprises that uses multiple sophisticated methods for defense evasion and social engineering. The campaign uses timely lures relevant to remote work, like password updates, conferencing info, helpdesk tickets, etc.

9 182 342 0 29

Download Image

sp @SP_Intel

5 years ago

Trickbot disrupted

Microsoft Threat Intelligence @MsftSecIntel

5 years ago

Trickbot disrupted

9 262 408 0 43

0 0 0 0 0

Microsoft Threat Intelligence @MsftSecIntel

5 years ago

Our researchers are tracking a phishing infrastructure that’s being used to launch phishing attacks targeting enterprises. The campaign is notable for its use of HTML attachments that pose as Excel files and contain encoded information about targets, indicating prior recon.

10 196 417 0 34

sp @SP_Intel

5 years ago

#malcro

Microsoft Threat Intelligence @MsftSecIntel

5 years ago

#malcro

8 156 255 0 21

Download Image

0 0 0 0 0

Microsoft Threat Intelligence @MsftSecIntel

5 years ago

Earlier this week we started seeing a spike in the use of password-protected documents in multiple malware campaigns, including Trickbot. These documents are attached to emails that use varying social engineering lures like the typical "order", "invoice", "documents".