Lightnews — Scholar-powered news

Microsoft Threat Intelligence @threatintel.microsoft.com · 7h

At @microsoft.com, we’re taking action by disrupting cybercriminal ecosystems, sharing threat intelligence, and investing in proactive defenses to protect people, data, and critical systems. Read the Microsoft Digital Defense Report 2025 for more insights and defense guidance.

1 3

Microsoft Threat Intelligence @threatintel.microsoft.com · 7h

- Identity-based attacks rose by 32%. More than 97% of identity attacks are password spray or brute force attacks.

- There has been an 87% increase in campaigns aimed at disrupting customer cloud environments through ransomware, mass deletion, or other destructive actions.

1 1 2

Microsoft Threat Intelligence @threatintel.microsoft.com · 7h

The Microsoft Digital Defense Report 2025 shows how threats are evolving faster than ever, fueled by AI. msft.it/63322sf3y4

Key insights from report include:

- More than 50% of cyberattacks with known motives had financial objectives such as extortion or ransom.

Extortion and ransomware drive over half of cyberattacks

Microsoft launches its sixth annual Digital Defense Report, highlighting trends from July 2024 to June 2025, including that over half of cyberattacks with known motives were driven by extortion or ransomware. The report stresses that legacy security is insufficient—modern AI-driven defenses and cross-industry collaboration are essential. For individuals, strong tools like phishing-resistant MFA can block over 99% of identity-based attacks.

msft.it

2 10 16

Microsoft Threat Intelligence @threatintel.microsoft.com · 23h

Sample IoCs:
Fake Teams setup (SHA-256): 32b0f69e2d046cb835060751fcda28b633cbbd964e6e54dbbc1482fff4d51b57
Oyster backdoor payload (SHA-256): e8d5019707065a8c894faf2c08ae2595d6b12381f1a850bfe9c9d693a5a6a8df

1

Microsoft Threat Intelligence @threatintel.microsoft.com · 23h

While these protections help secure our customers, we’re sharing this intelligence broadly to help strengthen defenses and improve resilience across the entire cybersecurity community.

1 1

Microsoft Threat Intelligence @threatintel.microsoft.com · 23h

Fully enabled Microsoft Defender Antivirus blocks this threat. In addition to detections, Microsoft Defender for Endpoint has additional guidance for mitigating and investigating this attack.

1

Microsoft Threat Intelligence @threatintel.microsoft.com · 23h

To fraudulently sign the fake installers and post-compromise tools, Vanilla Tempest was observed using Trusted Signing, as well as SSL[.]com, DigiCert, and GlobalSign. We’re sharing this info broadly to help improve protections across the industry.

1

Microsoft Threat Intelligence @threatintel.microsoft.com · 23h

Running the fake Microsoft Teams setups delivered a loader, which in turn delivered a fraudulently signed Oyster backdoor. Vanilla Tempest has incorporated Oyster into their attacks as early as June 2025, but they started fraudulently signing these backdoors in early September 2025.

1

Microsoft Threat Intelligence @threatintel.microsoft.com · 23h

In this campaign, Vanilla Tempest used fake MSTeamsSetup.exe files hosted on malicious domains mimicking Microsoft Teams, for example, teams-download[.]buzz, teams-install[.]run, or teams-download[.]top. Users are likely directed to malicious download sites using SEO poisoning.

1 1

Microsoft Threat Intelligence @threatintel.microsoft.com · 23h

Vanilla Tempest, also tracked as VICE SPIDER and Vice Society, is a financially motivated that focuses on deploying ransomware & exfiltrating data for extortion. The threat actor has used ransomware like BlackCat, Quantum Locker, & Zeppelin, but more recently has been primarily deploying Rhysida.

1

Microsoft Threat Intelligence @threatintel.microsoft.com · 23h

In addition to revoking certificates, Microsoft Defender Antivirus detects the fake setup files, Oyster backdoor, and Rhysida ransomware, and Microsoft Defender for Endpoint detects Vanilla Tempest TTPs.

1

Microsoft Threat Intelligence @threatintel.microsoft.com · 23h

We identified this Vanilla Tempest campaign in late September 2025, following several months of the threat actor using fraudulently signed binaries in attacks.

1

Microsoft Threat Intelligence @threatintel.microsoft.com · 23h

In early October 2025, Microsoft disrupted a Vanilla Tempest campaign by revoking over 200 certificates that the threat actor had fraudulently signed and used in fake Teams setup files to deliver the Oyster backdoor and ultimately deploy Rhysida ransomware.

The text "Vanilla Tempest" and the icon for financially motivated threat actors in white against a blue background.

1 4 8

Microsoft Threat Intelligence @threatintel.microsoft.com · 2d

The October 2025 security updates are available: msft.it/6018SZEg0.

#PatchTuesday #SecurityUpdateGuide

Image with "October 2025 Patch Tuesday" in white text on a blue background.

2

Microsoft Threat Intelligence @threatintel.microsoft.com · 3d

“Security begins and ends with people.” Learn how Microsoft has made security culture a company-wide imperative, reinforcing vigilance, embedding secure habits into everyday work, and achieving what technology alone cannot, via @ajohnsocyber.bsky.social: msft.it/63325sNpfJ

How Microsoft is creating a security-first culture that lasts | Microsoft Security Blog

Discover how Microsoft empowers employees to lead with security through training, tools, and a company-wide mindset shift. Learn more.

msft.it

1 7

Microsoft Threat Intelligence @threatintel.microsoft.com · 7d

Learn more about Storm-2657’s campaign and the TTPs employed, and get comprehensive detection, hunting queries, and guidance for investigation and remediation to defend against this threat in this Microsoft Threat Intelligence blog.

1 4

Microsoft Threat Intelligence @threatintel.microsoft.com · 7d

Storm-2657 is actively targeting a range of US-based organizations, particularly employees in sectors like higher education, with such "payroll pirate" attacks to gain access to third-party human resources (HR) software as a service (SaaS) platforms like Workday.

1 1 4

Microsoft Threat Intelligence @threatintel.microsoft.com · 7d

Microsoft Threat Intelligence has observed a financially motivated threat actor, Storm-2657, compromising employee accounts to gain unauthorized access to profiles and divert salary payments to attacker-controlled accounts. msft.it/63320sFB5j

Investigating targeted "payroll pirate" attacks affecting US universities | Microsoft Security Blog

Microsoft Threat Intelligence has identified a financially motivated threat actor that we track as Storm-2657 compromising employee accounts to gain unauthorized access to employee profiles and divert salary payments to attacker-controlled accounts, attacks that have been dubbed "payroll pirate".

msft.it

1 1 6

Microsoft Threat Intelligence @threatintel.microsoft.com · 8d

Medusa is a RaaS offering with affiliates like Storm-1175 carrying out double extortion. Storm-1175 was recently observed exploiting the CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability to deploy Medusa: msft.it/63323s0Z6Z

2

Microsoft Threat Intelligence @threatintel.microsoft.com · 8d

PipeMagic is attributed to the financially motivated actor Storm-2460. Because PipeMagic is modular, the threat actor can send module code over the network and the backdoor self-updates in memory. Read about PipeMagic and its internal architecture: msft.it/63328s0k74

1 2

Microsoft Threat Intelligence @threatintel.microsoft.com · 8d

The highly modular backdoor PipeMagic and the RaaS offering Medusa both exemplify how threats continuously evolve. The latest Microsoft Threat Intelligence Podcast episode features a threat landscape update with a deep dive on these threats: msft.it/63322s0k2o

Threat Landscape Update: Ransomware-as-a-Service and Advanced Modular Malware

In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠⁠Sherrod DeGrippo⁠ is joined by Tori Murphy, Anna Seitz, and Chuong Dong to break down two threats: the modular backdoor PipeMagic and Medusa ransomware. They discuss how PipeMagic disguises itself as a ChatGPT desktop app to deliver malware, its sophisticated modular design, and what defenders can do to detect it. The team also explores Medusa’s evolution into a ransomware-as-a-service model, its use of double extortion tactics, and the broader threat landscape shaped by ransomware groups, social engineering, and the abuse of legitimate tools.

msft.it

2 1 4

Microsoft Threat Intelligence @threatintel.microsoft.com · 9d

Threat actors seek to abuse Microsoft Teams features and capabilities at different points along the attack chain. Learn about countermeasures and controls across identity, endpoints, data apps, and network layers to help harden enterprise Teams environments. msft.it/63328sLUZs

Disrupting threats targeting Microsoft Teams | Microsoft Security Blog

Threat actors seek to abuse Microsoft Teams features and capabilities across the attack chain, underscoring the importance for defenders to proactively monitor, detect, and respond effectively. In this blog, we recommend countermeasures and optimal controls across identity, endpoints, data apps, and network layers to help strengthen protection for enterprise Teams users.

msft.it

1 1 1

Microsoft Threat Intelligence @threatintel.microsoft.com · 10d

Storm-1175, a financially motivated actor known for deploying Medusa ransomware & exploiting public-facing applications, was observed exploiting the CVE-2025-10035 vulnerability in GoAnywhere MFT's License Servlet. Read our analysis & get detection+hunting guidance: msft.it/63325sIfZZ

Investigating active exploitation of CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability | Microsoft Security Blog

Storm-1175, a financially motivated actor known for deploying Medusa ransomware and exploiting public-facing applications for initial access, was observed exploiting the deserialization vulnerability in GoAnywhere MFT's License Servlet, tracked as CVE-2025-10035. We are publishing this blog post to increase awareness of this threat and to share end-to-end protection coverage details across Microsoft Defender.

msft.it

1 5 6

Microsoft Threat Intelligence @threatintel.microsoft.com · 15d

Beyond immediate containment, Microsoft IR supports recovery, future planning, and building long-term resilience. According to Adrian Hill, lead investigator for Microsoft IR, “The customer needs to be successful. The only way to do that is to ensure that everyone is successful.”

1

Microsoft Threat Intelligence @threatintel.microsoft.com · 15d

By leading with empathy and collaboration, Microsoft IR unites vendors and internal teams to stabilize crises and uncover hidden threats, ensuring unified action. This approach means that every engagement restores the customer and simultaneously strengthens the broader security ecosystem.

1 1