Search cyberveille.decio.ch

Star Blizzard increases sophistication and evasion in ongoing attacks

Microsoft Threat Intelligence continues to track and disrupt malicious activity attributed to a Russian state-sponsored actor we track as Star Blizzard, who has improved their detection evasion capabilities since 2022 while remaining focused on email credential theft against targets.

#microsoft #EN #2023 #Threat #Intelligence #Star-Blizzard #attacks #analysis

·microsoft.com·Dec 8, 2023

Star Blizzard increases sophistication and evasion in ongoing attacks

Threat groups are using Windows LNK files to gain access

Microsoft's move last year to block macros by default in Office applications is forcing miscreants to find other tools with which to launch cyberattacks, including the software vendor's LNK files – the shortcuts Windows uses to point to other files.

#theregister #EN #2023 #LNK #macros #Microsoft #Windows #threat

·theregister.com·Jan 24, 2023

Threat groups are using Windows LNK files to gain access

DEV-0537 criminal actor targeting organizations for data exfiltration and destruction

The activity we have observed has been attributed to a threat group that Microsoft tracks as DEV-0537, also known as LAPSUS$. DEV-0537 is known for using a pure extortion and destruction model without deploying ransomware payloads.

#microsoft #EN #2022 #LAPSUS$#DEV-0537 #extortion #research #activity #threat #group

·microsoft.com·Mar 23, 2022

DEV-0537 criminal actor targeting organizations for data exfiltration and destruction

Threat groups are using Windows LNK files to gain access

Microsoft's move last year to block macros by default in Office applications is forcing miscreants to find other tools with which to launch cyberattacks, including the software vendor's LNK files – the shortcuts Windows uses to point to other files.

#theregister #EN #2023 #LNK #macros #Microsoft #Windows #threat

·theregister.com·Jan 24, 2023

Threat groups are using Windows LNK files to gain access

DEV-0537 criminal actor targeting organizations for data exfiltration and destruction

The activity we have observed has been attributed to a threat group that Microsoft tracks as DEV-0537, also known as LAPSUS$. DEV-0537 is known for using a pure extortion and destruction model without deploying ransomware payloads.

#microsoft #EN #2022 #LAPSUS$#DEV-0537 #extortion #research #activity #threat #group

·microsoft.com·Mar 23, 2022

DEV-0537 criminal actor targeting organizations for data exfiltration and destruction

The activity we have observed has been attributed to a threat group that Microsoft tracks as DEV-0537, also known as LAPSUS$. DEV-0537 is known for using a pure extortion and destruction model without deploying ransomware payloads.

#microsoft #EN #2022 #LAPSUS$#DEV-0537 #extortion #research #activity #threat #group

·microsoft.com·Mar 23, 2022

DEV-0537 criminal actor targeting organizations for data exfiltration and destruction