2026年8月，CrowdStrike 与 Zscaler 宣布合作，将连续身份验证能力与零信任访问架构深度集成。该合作旨在解决传统零信任模型下仅基于静态策略或单一登录验证的不足，通过持续评估用户身份、设备健康状态和行为风险，实现对每一次访问请求的动态授权。CrowdStrike 的 Falcon 平台（EDR/终端检测响应）提供实时的终端威胁情报和风险信号，Zscaler 通过其 Zero Trust Exchange 云平台执行基于身份的访问控制。两者结合后，安全团队可在用户访问应用或资源时，动态感知终端是否遭入侵、是否存在恶意进程，从而自动阻断或隔离高风险访问，并支持从端到端的身份到云访问的全面保护。该产品集成面向企业客户，尤其适用于远程办公、多云环境和零信任架构转型场景。文章未涉及具体攻击事件或漏洞，重点在于介绍两个安全厂商的技术协作。

根据 CrowdStrike 官方博客（2026-08-02 发布）的标题，该公司宣布推出“Continuous Identity for AI Agents”功能。该功能旨在为人工智能代理（AI Agents）提供持续的身份验证与访问控制能力，以应对 AI 代理在自动化工作流中带来的身份安全新挑战。由于原文摘要未提供，具体实现细节、技术架构、集成方式均无法确认。结合行业背景，AI 代理在调用 API、访问数据或执行任务时，传统静态身份认证难以覆盖动态会话场景，连续身份验证（Continuous Identity）通过持续评估上下文、风险和行为，实时调整访问权限，能有效降低身份劫持与横向移动的风险。此公告可能涉及 CrowdStrike Falcon 平台的功能升级，并利用 EDR 数据增强身份安全。但上述背景内容为基于标题的合理推断，并非原文明确提供的事实。该博客未提及任何 CVE、攻击组织、恶意软件家族或具体攻击技术，也未见 IOC。安全团队可关注该功能对 AI 代理身份治理和零信任架构的补充意义。

CrowdStrike Expands Identity Leadership with OpenID and IDPro

The Identity Problem Hiding in AI Agent Deployments

Next-Gen SIEM & Log Management

5 High-Impact Use Cases for Falcon Onum

Falcon Platform IOAs Arrive in Falcon Next-Gen SIEM to Identify New Threats

From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise

Next-Gen Identity Security

Endpoint Security & XDR

Engineering & Tech

EMBER2024: Advancing the Training of Cybersecurity ML Models Against Evasive Malware

Falcon Platform Prevents COOKIE SPIDER’s SHAMOS Delivery on macOS

CrowdStrike’s Approach to Better Machine Learning Evaluation Using Strategic Data Splitting

CrowdStrike Researchers Develop Custom XGBoost Objective to Improve ML Model Release Stability

Executive Viewpoint

Frontier AI Is Collapsing the Exploit Window. Here’s How Defenders Must Respond.

Frontier AI for Defenders: CrowdStrike and OpenAI TAC

Anthropic Claude Mythos Preview: The More Capable AI Becomes, the More Security It Needs

From The Front Lines

Introducing the CrowdStrike Shadow AI Visibility Service

CrowdStrike Flex for Services Expands Access to Elite Security Expertise

CrowdStrike Technical Risk Assessments Reveal Common Exposure Patterns

Now Live: The CrowdStrike 2026 Financial Services Threat Landscape Report

New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Forever

New Abuse of the ClickOnce Technology, Part 1: The Inner Workings of ClickOnce Application Deployment

Browser Security: Zero-Days Are Only Part of the Problem

Falcon Secure Access Sets the Standard for Zero Trust Browser Security

Beyond the Model: Harnessing Frontier AI for Stronger Cyber Defense

Cloud & Application Security

CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security

94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey

Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud

Falcon Cloud Security July 2026 Release: Helping Security Teams Move Faster in the Cloud

Video Highlights the 4 Key Steps to Successful Incident ResponseDec 02, 2019

Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO]Feb 21, 2019

Analyzing Targeted Intrusions Through the ATT&CK Framework Lens [VIDEO]Jan 22, 2019

Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust [VIDEO]Aug 20, 2018

How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem

CrowdStrike Services and Agentic MDR Put the Agentic SOC in Reach

Threat Hunting & Intel

New Claude Integration Brings Audit Data into the Falcon Platform

Disrupting Glassworm: Inside CrowdStrike’s Takedown of a Developer-Targeting Botnet

CrowdStrike 2026 Technology Threat Landscape Report: China’s Ambitions Fuel Attacks

How AI-leading Security Teams Are Building the Agentic SOC

Inside Astaroth's New Spambot Component

Falcon AIDR Now Protects Copilot Studio Agents and Claude CodeJul 30, 2026

Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand

Google is a Leader in the IDC MarketScape: Worldwide Incident Response 2025 Vendor AssessmentRead the report

The UK’s largest homewares retailer, Dunelm talks about landing a one-two punch against cyber threats with Google SecOps and a Mandiant Retainer.See the video

CISOs from AT&T and Coinbase join Mandiant's CTO to share and discuss firsthand experiences and insights from the frontlines on responding to nation-state actors and complex insider risk.See the video

Lloyds Banking Group is confident in its ability to detect sophisticated attacks and can now focus on what matters most — staying ahead of the next generation of threats.See the video

Google is a Leader in the Forrester Wave™: Cybersecurity Incident Response Services, Q2 2024Read the report

Google is a Leader in the IDC MarketScape: Worldwide Cybersecurity Consulting Services 2024 Vendor AssessmentRead the report

Cyber Defense Summit 2026Crafted to equip elite security professionals with the strategies, tools, and insights needed to outmaneuver increasingly sophisticated, AI-enabled adversaries and build resilient cyber ecosystems.Register now

Security TalksJoin our security experts in this ongoing series as they explore the latest AI innovations across our security product portfolio, threat intelligence best practices, and more.Watch on-demand

cloud architecture assessment

ransomware and multifaceted extortion defense

Download the report

Download the ebook

practice AI-assisted incident response in a realistic, virtual cyber range with ThreatSpace™

offensive security services

Transform your core security processes and technologies.

Plan, optimize, and validate your Google SecOps deployment

executive cybersecurity services

transition from a reactive incident response methodology to a predictive, mission-focused cyber defense center

Operationalize and maximize your threat intelligence sources with Mandiant

customized cyber risk research and analysis

personalized reporting and part-time expertise

dedicated expert embedded with your team

Apply best practices for the consumption, analysis, and practical application of threat intelligence

a full range of CTI training, on-demand certifications, expert coaching, and immersive, real-world exercises

Understand how to augment your cyber defense capabilities and prepare for the future by leveraging the power of AI

Read the report

operational technology (OT) and industrial control systems (ICS)

The CIO of the University of California, Riverside describes how Mandiant delivers industry-leading expertise that combined with Google SecOps has transformed their security.See the video

Get help nowfor a security breach or possible incident.

incident response services

Mandiant Retainer

Mandiant crisis communication services

ompromise assessment

Secure your operations by proactively enhancing your security capabilities.

Pinpoint the cyber risks most relevant to your organization

tabletop exercises

cyber defense assessment

full environment recovery.

full range of learning formats

red team assessments

Cyber Defense Summit 2026Register today to reserve your spot

IDC business value studyTurn security into business growth

make smarter security investments and mitigate future risks

本输入提供的标题为“京公网安备 11000002002063号”，来源标注为“360CERT 安全报告”，但实际链接指向公安部备案信息页面，且未提供任何正文摘要。标签中包含“report”、“apt”、“360”、“malware”，暗示可能是一份APT相关恶意软件报告，但没有任何具体内容可供分析。因此无法确认攻击活动、战术、工具链、受害者或结论。信息严重不足，无法生成有效的威胁情报摘要。请提供完整报告内容以便进一步分析。

该输入为360CERT安全报告页面，但实际内容为网络备案信息（“网出证（京）字第281号”），并非真正的威胁情报文章。页面仅包含备案号，没有提供任何安全事件描述、技术细节、攻击指标或防御建议。标题和来源URL表明其属于360CERT网站的法律备案页面，而非技术报告。标签中虽包含“apt”、“malware”等威胁情报相关词汇，但正文未提供任何相关信息，无法提取攻击组织、恶意家族、受影响行业或地区、CVE编号或ATT&CK技术等有效情报。因此，本条目属于无效或无效输入，无法用于安全分析。建议忽略此记录，或通过其他可信渠道获取实际的360CERT安全报告。

输入数据仅包含一个ICP备案号“京网文〔2020〕6051-1195号”，来源标注为360CERT安全报告，但未提供任何摘要、正文或分析内容。标签中提及“report”“apt”“360”“malware”，但没有任何实际信息支撑这些标签。因此，本次报告无法提供任何威胁情报细节，也未提及具体漏洞、攻击组织、恶意软件、受影响行业或地区。建议安全团队忽略此篇内容，并核实来源真实性。

本次输入内容并非有效的威胁情报文章。标题为“京ICP证080047号[京备08010314号-6]”，来源标注为360CERT安全报告，但链接指向工信部备案查询页面，且未提供任何正文摘要、CVE编号、攻击者、恶意软件家族、行业、地区或ATT&CK技术信息。因此无法从中提取任何关于网络攻击活动、漏洞利用、恶意代码或防御建议的有效情报。该输入可能是错误抓取、占位内容或非安全事件记录。建议核实原始来源，或忽略此条目。

Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals of hospitality-related organizations such as hotels since May 2026 in order to deliver malware to travelers and steal credentials in an operation we call CaptiveCrunch. The post CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential t

Analysis of XCSSET v40 reveals a macOS malware targeting developers via Xcode. Unit 42 used advanced pattern matching and AI to decode its logic. The post The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version appeared first on Unit 42.

Falcon Next-Gen SIEM Supports Third-Party EDR Tools, Starting with Microsoft Defender

CrowdStrike Named a Leader in the First-Ever Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies

Falcon AIDR Detects Threats at the Prompt Layer in Kubernetes AI Applications

Denying the Worm: Detecting SANDWORM_MODE and the Emerging Class of AI Toolchain Supply Chain AttacksJul 21, 2026

CrowdStrike Joins the Open Secure AI Alliance to Advance AI Safety and SecurityJul 27, 2026

CrowdStrike Falcon Platform Helps Meet U.S. Government Mandates for CISA BOD-26-04Jul 22, 2026

Learn how better questions, trusted AI, and human judgment help security leaders make confident decisions and build resilient systems. The post ​​Better security starts with better questions appeared first on Microsoft Security Blog.

The physics of cybersecurity are changing. Introducing security's new cyber stack: Project Perception. The post Rethinking security for the age of AI appeared first on Microsoft Security Blog.

Microsoft's External Red Team Alliance (EXTRA) is a global AI security initiative designed to advance AI safety research and red teaming. By partnering with universities, researchers, and regional experts, EXTRA helps identify emerging AI risks, improve security testing, and strengthen the resilience of frontier AI systems. The post Enhancing AI security through global AI red teaming appeared firs

企业网络持续面临高级持续性威胁（APT）的攻击，攻击者利用软件漏洞逐步渗透关键资产。随着披露的漏洞数量增长，资源受限的组织必须优先修补哪些漏洞。现有的漏洞优先级标准（如CVSS）对每个漏洞独立评分，无法评估修补策略在对抗随时间在网络中推进的攻击者时的实际效果。先前的模拟工具采用强化学习（RL）模拟攻击活动，但要么忽略了漏洞管理（即攻击者不受防御阻碍），要么依赖与真实威胁数据脱节的合成网络，因此无法评估策略对抗真实攻击者的表现。为填补这一空白，本文提出了VulnGym，一个用于评估漏洞管理策略的仿真工具。VulnGym模拟一个由RL训练的攻击者，其行为基于真实的APT配置文件（如攻击模式、速度、目标选择），同时防御者执行可配置的修补策略（如基于CVSS分数、资产重要性等）。两者在一个共享且持续演化的网络表示上行动，攻击者的进展直接受防御者修补活动的影响，从而能够对给定策略进行压力测试。实验基于真实世界的漏洞数据（如CVE）和两个APT案例（例如APT29、APT41等，摘要未明确但提及两个APT），结果显示漏洞管理必须根据组织环境、对手行为、网络拓扑和资产关键性进行定制化调整。该工具可帮助安全团队在部署前比较不同修补策略的效果，优化资源分配。

Falcon Next-Gen SIEM Simplifies Onboarding with Sensor-Native Log Collection

AIDR: How CrowdStrike Is Defining the Next Era of CybersecurityJul 15, 2026

CrowdStrike Falcon Platform Helps Meet U.S. Government Mandates for CISA BOD-26-04Jul 22, 2026

In the second quarter of 2026, the continuing effects of Microsoft’s disruption of the Tycoon2FA phishing platform contributed to sustained declines in several major phishing techniques, while threat actors expanded into Teams-based social engineering and employed increasingly automated and multi-stage attack chains. The post Email threat landscape: Q2 2026 trends and insights appeared first on Mi

Unit 42 details a Russian cyberespionage campaign targeting Zimbra webmail servers using JavaScript injection to steal credentials. The post Russian Global Webmail Espionage appeared first on Unit 42.

July 2026 Patch Tuesday: Microsoft Patches 622 Vulnerabilities Including Two Exploited Zero-DaysJul 14, 2026

本论文提出了一种名为 CAPTAIN（Context-Augmented Perplexity-based Threat Activity log detectIoN）的 APT 检测方法。研究背景是高级持续性威胁（APT）检测的难点在于大规模日志中仅有极小部分事件是恶意的，传统方法依赖大量人工标注和复杂的预处理管道，工程成本高。CAPTAIN 利用预训练的语言模型，通过最小化领域无关的预处理，基于困惑度（perplexity）对日志条目进行评分。该方法的核心创新在于引入上下文增强机制：使用编码器模型和 Q-Former 风格的桥接结构对近期历史日志进行编码，生成紧凑的上下文令牌，注入到解码器输入中，使困惑度评分能够反映时间上下文信息。此外，CAPTAIN 还通过平滑滤波器对困惑度时间序列进行稳定化处理。在多个 APT 基准测试上，CAPTAIN 与强基线方法性能相当，且对非精细化预处理输入具有鲁棒性，从而显著降低了日志预处理的发展与运维成本。该工作表明，无需复杂的数据清洗即可实现有效的 APT 检测，为安全运营团队提供了一种轻量级、可扩展的解决方案。

Our collaboration with AXA XL brings Microsoft Incident Response services directly to cyber insurance policyholders, helping organizations coordinate technical, business, and insurance decisions. The post Real world incident response: Microsoft and AXA XL strengthen cyber resilience appeared first on Microsoft Security Blog.

The Architecture of Agentic Defense: Inside the Falcon Platform

Why AI Governance Without Guardrails Is TheaterJul 09, 2026

本文首次从工业界视角系统评估了基于溯源的端点检测与响应（P-EDR）系统的有效性与局限性。研究通过一对一的专家访谈、在线问卷调查、相关文献调研以及系统性的测量实验四部分展开。结果显示，所有工业界专家均认为P-EDR系统比传统EDR更有效，但普遍担忧其运营成本。研究进一步揭示了学术界与工业界之间的三大鸿沟：（1）忽视客户端开销；（2）告警分类成本与解释成本不平衡；（3）服务端内存消耗过高。论文提供了P-EDR系统有效性的客观数据，并指出了工业界部署所需的关键改进方向。适合安全运维团队、EDR产品开发者和APT防御研究人员阅读。

Join Microsoft Security at Black Hat USA 2026 for supply chain research, hands-on security experiences, expert conversations, and our reception. The post Microsoft at Black Hat USA 2026: Defending trust in the age of AI and supply chain attacks appeared first on Microsoft Security Blog.

A technical analysis of three chained zero-day vulnerabilities in Siemens ROX II OT switches that allow privilege escalation and persistent root access. The post Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy appeared first on Unit 42.

From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive documents from enterprise environments. The post ACR Stealer: Two observed intrusion chains amid increased threat activity appeared first on Mi

Explore Unit 42's perspectives on AI's impact on cybersecurity, including key updates since the 2026 Incident Response Report. The post AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report appeared first on Unit 42.

As AI agents become more autonomous, strong identity, access, and auditing controls are critical to keeping them secure. The post Least privilege for AI agents: Identity, access, and tool binding appeared first on Microsoft Security Blog.

CrowdStrike Uncovers New Prompt Injection TechniquesJul 07, 2026

Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This analysis breaks down the attack chain, payload delivery, and recommended defenses. The post Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery appeared first on Microsoft Security Blog.

Palo Alto Networks Unit 42 团队发布了关于 npm 生态系统威胁态势的更新分析报告。报告指出，自 Shai Hulud 事件后，npm 供应链攻击持续演进，出现了可蠕虫化的恶意软件、CI/CD 持久化机制以及多阶段攻击等新型威胁。攻击者利用 npm 包的广泛分发特性，通过恶意包注入、依赖混淆、typosquatting 等手段渗透开发环境，进而横向移动至生产系统。报告重点分析了 CI/CD 管道中的持久化技术，攻击者可在构建过程中植入后门，导致每次部署都携带恶意代码。此外，蠕虫化恶意软件能够自动感染相关联的包，引发连锁反应。尽管报告未给出具体的攻击组织、恶意软件家族或 CVE 编号，但提供了详细的攻击面分析和缓解措施，帮助安全团队理解当前 npm 威胁格局并制定防御策略。目前尚未发现大规模在野利用的证据，但攻击手法日益复杂，开发者和安全团队需保持警惕。

Security teams have never had more visibility, yet rarely have they felt more uncertain. Signal pours in from endpoints, identities, cloud workloads, and a sprawling mix of third-party tools. The post Turning threat intelligence into decisive action with Defender Experts appeared first on Microsoft Security Blog.

TuxBot v3 Evolution, an IoT botnet framework built with LLMs. Read our analysis of its cross-compiled binaries, C2 architecture and bugs. The post TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development appeared first on Unit 42.

Microsoft Threat Intelligence identified threat actor activity with overlapping tradecraft commonly associated with ShinyHunters, including voice phishing (vishing), supply-chain compromise, and misconfigured guest access targeting SaaS-based applications. The post Defending SaaS-based applications against ShinyHunters OAuth abuse appeared first on Microsoft Security Blog.

Microsoft Entra ID makes passkeys the default sign-in experience and introduces a new model for SMS and voice authentication. Read about how to prepare. The post Microsoft Entra ID security updates: Passkeys are the default authentication method in Entra ID appeared first on Microsoft Security Blog.

Unit 42 explores The Gentlemen ransomware operations, revealing the affiliate model driving its rapid growth. Learn more here. The post No Manners Here: The Ruthless Rise of The Gentlemen Ransomware appeared first on Unit 42.

Microsoft’s latest Secure Future Initiative report outlines progress on secure foundations, AI-powered defense, and future-ready cybersecurity. The post Securing our future: July 2026 progress report on Microsoft’s Secure Future Initiative appeared first on Microsoft Security Blog.

GigaWiper is a destructive backdoor that combines multiple wiping and ransomware-like capabilities into a single operational platform. This blog analyzes how the malware incorporates code from several previously separate malware families and provides guidance to help defenders detect and defend against similar threats. The post GigaWiper: Anatomy of a destructive backdoor assembled from multiple m

How to Stop AI-Driven Data Loss

微软于2026年7月8日发布博文，介绍其安全未来计划（Secure Future Initiative, SFI）如何利用AI速度主动加固云服务。SFI将威胁知识、运营框架与安全需求相结合，定义了完善云服务的防御标准。文章强调，满足这些标准需要持续以AI速度对在线服务进行评估。该计划旨在提前发现和缓解潜在威胁，而非事后响应。博文未提及具体攻击活动或漏洞，重点在于微软自身的安全架构和实践。

A cybercrime campaign combined a loader-as-a-service framework and DLL sideloading via a Go-compiled fake MpClient.dll, a novel evasion layer combination. The post Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation appeared first on Unit 42.

4 Ways Businesses Use CrowdStrike Charlotte AI to Transform Security Operations

该文章基于Frost & Sullivan发布的2025年云安全态势管理（CSPM）Frost Radar™报告，提炼了五项关键洞察。报告指出，CSPM正从传统的“时间点合规”工具向“持续风险管理”平台演进。核心变化包括：1）CSPM不再仅检查配置错误，而是集成实时威胁情报，主动发现攻击路径；2）机器学习模型用于异常行为检测，减少误报；3）跨云环境（AWS、Azure、GCP）的统一视图成为标配；4）自动化修复能力（如自动回滚、策略实施）显著提升；5）与DevOps流程的深度集成，支持“安全即代码”。文章强调，现代CSPM需要同时处理基础设施即代码（IaC）的静态分析和运行时动态风险。虽然文章未披露具体漏洞或攻击事件，但这为安全团队选择或优化云安全工具提供了战略方向。附录中的Frost Radar排名显示微软、Palo Alto Networks、Check Point等厂商处于领导者象限。整体内容属于行业趋势分析，不涉及恶意活动。

A look inside the reverse-engineering journey of building the first RDP client outside of Windows to support WebAuthn redirection. The post How We Added WebAuthn to a Browser-Based RDP Client appeared first on Unit 42.

Frost & Sullivan names Microsoft a leader as cloud and application security converge into unified, runtime risk reduction. The post Microsoft named a leader in the Frost Radar for cloud and application runtime security appeared first on Microsoft Security Blog.

CrowdStrike Named a Leader in 2026 Gartner® Magic Quadrant™ for Endpoint Protection for Seventh Consecutive Time

Attackers can exploit LLM domain hallucinations through phantom squatting to target supply chains. Read the analysis to learn more. The post Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector appeared first on Unit 42.

We’re accelerating quantum-safe readiness—and sharing what organizations can do now to transition earlier and with confidence. The post Accelerating the quantum-safe timeline appeared first on Microsoft Security Blog.

This month’s updates help security and IT teams strengthen identity and multicloud foundations, protect data wherever it lives, and secure the developer workflows powering AI innovation. The post ​​What’s new in Microsoft Security: June 2026 appeared first on Microsoft Security Blog.

MCP tool poisoning turns trusted AI agents into a control plane for data loss. Learn how threat actors manipulate tool descriptions to trigger unauthorized actions, and how to detect, contain, and prevent it. The post Securing AI agents: When AI tools move from reading to acting appeared first on Microsoft Security Blog.

CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms

A malicious Chromium-based extension that spoofs the AI-powered answer engine Perplexity AI redirects browser search traffic using MV3 APIs and intermediary infrastructure. The post Chromium extension uses AI‑related branding to redirect browser search appeared first on Microsoft Security Blog.

Your inbox is an identity system all of its own: whoever owns it may own a lot more

本文通过半结构化访谈15名不同角色和专业背景的安全从业者，探讨了高级持续性威胁（APT）分析、归因及面临的挑战。研究发现，从业者在APT归因中采用三层方法，每层有各自目标和挑战。他们通常更关注理解对手的战术、技术和程序（TTP）及动机，而非确定具体攻击实体。现有工具和流程的主要问题包括无法处理多样复杂的数据，以及内部和外部协作的困难。基于这些发现，作者提出了四项改进归因方法的建议，并讨论了这些改进如何应对已识别的挑战。该研究填补了对安全从业者实际感知和挑战理解的空白，为未来APT分析工具和流程设计提供了重要参考。

该论文聚焦于从系统活动图中检索已知高级持续性威胁（APT）活动的任务。在现实运维环境中，系统活动图（节点代表MITRE ATT&CK技术，边表示时间或资源级别的关联）常因检测不完整、技术误分类以及良性行为引入的结构伪影而包含噪声。传统基于精确图匹配的方法在噪声环境下鲁棒性差。为此，论文将问题形式化为已知APT查询图与含噪声、部分观测的技术图之间的近似子图匹配。作者提出了一种基于嵌入的初步检索方法，通过将图结构转换为低维向量表示，在向量空间中进行相似度搜索，以容忍噪声和缺失边。该方法旨在为实际环境中已知APT活动的检索提供鲁棒且实用的框架。实验部分（摘要未详述）应验证该方法在合成噪声数据上的有效性。该工作适合安全分析师、威胁情报研究员及图分析在网络安全应用中的开发者阅读。

We provide guidance for preparing for and mitigating large-scale credential attacks, focusing on recent campaigns targeting security vendors' devices. The post Threat Brief: Mitigating Large-Scale Credential Attacks appeared first on Unit 42.

Your business may be small, but its attack surface is anything but. Readiness is the first step to resilience.

Microsoft Threat Intelligence identified an active multi-stage intrusion campaign targeting hospitality organizations in Europe and Asia. The campaign uses photo-themed ZIP archives and fake image shortcut files to deliver a persistent Node.js implant and evade detection. The post Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access appeared first on Mic

Government entities and critical infrastructure were targeted for espionage in SE Asia by attackers using a hybrid toolkit, including custom TinyRCT backdoor. The post CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure appeared first on Unit 42.

Microsoft named a Leader in the Forrester Wave™: Endpoint Management Platforms, Q2 2026, with the highest scores in the current offering and strategy categories. The post Microsoft a Leader in The Forrester Wave™ for Endpoint Management Platforms appeared first on Microsoft Security Blog.

ESET Research analyzes Gamaredon’s new toolset and the group’s growing reliance on legitimate online services to hide its C&C infrastructure and exfiltrate stolen data

Learn how CNAPP platforms are helping organizations prioritize exploitable risks, reduce exposure, and operationalize security across the application lifecycle. The post CNAPP evolution: How Microsoft aligns with leading cloud risk management platforms appeared first on Microsoft Security Blog.

ESET researchers assisted in the global disruption of the Amadey botnet and Stealc infostealer, providing technical analysis, infrastructure tracking, and affiliate-level insights

On June 24, 2026, Microsoft’s Digital Crimes Unit (DCU) facilitated the takedown, suspension, and blocking of domains that formed the backbone of the StealC and Amadey infrastructure. This blog is a technical breakdown of StealC and Amadey. The post StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them appeared first on Microsoft Security Blog.

Unit 42's analysis of ClawHub revealed evasive malicious skills bypassing automated scanners to deploy infostealers and execute agentic financial fraud. The post OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat appeared first on Unit 42.

CrowdStrike Named a Leader in Identity Threat Detection and Response

CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud

Falcon Exposure Management Now Available for Third-Party EnvironmentsJun 16, 2026

After Executive Order 14409: Next Steps for Securing AIJun 17, 2026

Unit 42 research details how attackers could exploit global name uniqueness in bucket hijacking to redirect cloud data streams across major CSPs. The post The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration appeared first on Unit 42.

What happens when threat actors target what AI remembers? Microsoft breaks down the risks and the defenses. The post Guarding AI memory appeared first on Microsoft Security Blog.

Ransomware case reveals two parallel threat actors, blending tactics and evasion—showing why isolated signals can often miss modern, overlapping cyberattacks. The post One intrusion, two cyberattackers: Uncovering parallel threat activity appeared first on Microsoft Security Blog.

AutoJack is a novel exploit chain showing how a single malicious webpage can turn an AI browsing agent into a remote code execution vector on the host machine. By abusing trust in localhost, missing authentication, and unsafe parameter handling, attackers can trigger arbitrary process execution through AutoGen Studio’s MCP WebSocket. The research highlights a broader pattern - when agents can brow

New Forrester Total Economic Impact™ study shows Microsoft Security consolidation delivers ROI, lowers risk, and prepares organizations to secure AI. The post New Forrester study shows customers who unified with Microsoft Security benefited from 124% ROI appeared first on Microsoft Security Blog.

ESET Research shares the results of a months-long investigation into the suite of EDR killers maintained by the RaaS gang Gentlemen

CrowdStrike Falcon Platform Achieves 441% ROI in Three Years

Inside CrowdStrike Automated Leads: A Transformative Approach to Threat Detections

Why AI Projects Stall and How CIOs Can RespondJun 12, 2026

Cybersecurity Forecast 2026Forward-looking insights to plan for the year ahead.Read the report

A poisoned npm package infected 140+ projects with a hidden payload. This report highlights how to detect, hunt, and defend against supply chain attacks using Microsoft Defender and actionable threat intelligence. The post From package to postinstall payload: Inside the Mastra npm supply chain compromise appeared first on Microsoft Security Blog.

Microsoft Threat Intelligence analyzed a cryptocurrency clipper campaign that combines clipboard theft, wallet replacement, Tor-based communications, and worm-like propagation. Beyond stealing cryptocurrency transactions, the malware establishes persistent access and enables follow-on activity through a lightweight backdoor capability. The post Crypto Clipper uses Tor and worm-like propagation for

Read how Microsoft Security has advanced its agentic vulnerability detection system, codename MDASH, integrating into real-world workflows across Windows, Azure, and identity systems. The post Beyond the benchmark: Advancing security at AI speed  appeared first on Microsoft Security Blog.

Microsoft has been named a Leader in The Forrester Wave™: Extended Detection and Response Platforms, Q2 2026. The post ​​Forrester names Microsoft a Leader in the 2026 Extended Detection and Response Platforms Wave™ report appeared first on Microsoft Security Blog.

See how Microsoft unifies identity and security signals to help teams prevent, detect, and respond to AI-accelerated attacks faster. The post AI is accelerating cyberattacks—here’s how to stay ahead appeared first on Microsoft Security Blog.

Many manufacturing plants depend on OT systems that stay in service for many years. That long run can hide significant cybersecurity risks.

本文针对企业环境中多个高级持续性威胁（APT）活动同时发生、导致审计日志中来自不同攻击者的技术序列随时间交织的问题，形式化了一个未知K交织序列分离（UKISD）问题：从交织的技术序列中恢复多个潜在攻击活动，同时推断其数量和每个活动的技术分配。现有方法（如统计模式挖掘、基于溯源的分析）通常假设单一活动或依赖刚性启发式规则，在活动重叠、技术共享、执行长度变化的现实条件下效果有限。为此，作者提出了主题引导一致性建模（TGCM）框架，这是一种生成式解耦方法，利用一致性模型（Consistency Models）学习从交织的多活动观测到结构化单活动序列的直接逆映射，仅需单次推理步骤。为了有利于语义连贯的攻击链，TGCM引入了一个基于MITRE ATT&CK叙述的主题引导先验，在分解过程中提供高层战术约束。在合成数据集、已有混合数据集以及DARPA TC-E3和TC-E5的 incident traces 上，与15个基线方法（涵盖模式挖掘、深度学习、基于LLM的方法）对比，实验结果表明TGCM在高交织和技术共享场景下具有更好的分离鲁棒性，并且能在无需重训练的情况下零样本泛化到自然交织的真实世界基准（DARPA TC-E5）。

Rockwell Automation 发布安全公告，其 Logix 5370 和 5570 系列可编程逻辑控制器（PLC）存在一个拒绝服务漏洞（CVE-2026-11317）。该漏洞源于产品对特制 CIP（通用工业协议）消息的处理不当，导致资源关闭或释放缺陷（CWE-404）。攻击者无需身份验证即可通过网络发送恶意 CIP 报文，触发设备出现重大不可恢复故障（MNRF），致使控制器停止运行。受影响的产品包括 CompactLogix 5370（固件版本 ≤34.016）、Compact GuardLogix 5370（≤35.015）、ControlLogix 5570（≤35.015）和 GuardLogix 5570（36.012）。内存较小的设备更容易受影响。恢复设备需要重新下载程序。Rockwell Automation 已发布修复固件版本：CompactLogix 5370 34.016 及更高版本、Compact GuardLogix 5370 35.015 及更高版本、ControlLogix 5570 36.012 及更高版本、GuardLogix 5570 37.011 及更高版本。CISA 建议用户尽快更新固件，并采取网络隔离、防火墙、VPN 等防御措施。该漏洞的 CVSS v3.1 评分为 7.5（高危），CVSS v4.0 评分为 8.7（高危）。CISA 在其 ICS 公告中强调了该漏洞对关键制造业的潜在影响，因为相关控制器广泛部署于全球工业控制系统。目前尚无公开的利用代码或在野利用报告。

CISA发布关于Rockwell Automation RSLinx Classic的漏洞通告，涉及CVE-2020-13573。该漏洞是一个栈缓冲区溢出漏洞，存在于RSLinx Classic版本4.50.00及更早版本中。攻击者无需身份验证即可通过网络远程触发漏洞，导致应用程序无响应且无法自行恢复，造成拒绝服务。CVSS v3.1基础评分为7.5（高），CVSS v4.0评分为8.7（高）。虽然CISA公告指出成功利用可能导致拒绝服务，但CVE详情中描述该漏洞为栈缓冲区溢出，可能允许远程执行任意代码。受影响行业包括关键制造业、能源、食品农业、水利和废水处理，系统部署在全球范围。Rockwell Automation建议用户升级到4.60.00或更高版本，或应用补丁BF31213。目前没有公开利用报道。

Rockwell Automation FLEX I/O EtherNet/IP 适配器（型号 1794-AENTR 和 1794-AENTRXT）存在两个严重漏洞，影响版本 V2.012。CVE-2026-0646 是内存未释放漏洞（CWE-401），攻击者可发送特制 CIP 协议请求导致适配器崩溃并断开与 I/O 模块的连接，需手动重置恢复，CVSS 3.1 评分 7.5，CVSS 4.0 评分 8.7。CVE-2026-0647 是嵌入式 Web 服务器缺少关键功能认证漏洞（CWE-306），未经身份验证的攻击者可通过发送特定 HTTP GET 请求更改设备 Web 界面密码，导致未授权访问、账户接管和 Web 服务器可用性丧失，CVSS 3.1 评分 9.4（严重），CVSS 4.0 评分 8.8。这些漏洞影响全球关键制造业用户。Rockwell Automation 已发布固件版本 2.013 修复漏洞。CISA 建议用户立即更新固件，并将控制设备与互联网隔离。

View CSAF Summary Successful exploitation of this vulnerability could result in an attacker executing privileged operations. The following versions of Rockwell Automation FactoryTalk Analytics PavilionX are affected: FactoryTalk Analytics PavilionX <7.01 (CVE-2025-14272) CVSS Vendor Equipment Vulnerabilities v3 7 Rockwell Automation Rockwell Automation FactoryTalk Analytics PavilionX Mis

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-48907 Widget Factory Joomla Content Editor Improper Access Control Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition. The following versions of Rockwell Automation CompactLogix are affected: CompactLogix 5370 L1 CompactLogix 5370 L2 CompactLogix 5370 L3 CVSS Vendor Equipment Vulnerabilities v3 7.5 Rockwell Automation Rockwell Automation CompactLogix Improper Validation of In

Unit 42 discovered a Vertex AI Python SDK vulnerability that allows remote code execution via bucket squatting. Read the article for more. The post Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE appeared first on Unit 42.

ESET researchers have discovered SprySOCKS for Windows, FishMonger’s backdoor weaponizing a kernel driver for advanced stealthiness

Threat IntelligenceExploitation of KnowledgeDeliver via ViewState Deserialization VulnerabilityBy Mandiant • 7-minute read

Inside Google Cloud

Google Cloud Next & Events

Google Cloud Consulting

Transform with Google Cloud

Google Cloud Products

Training & Certifications

Google Maps Platform

Google Workspace

Developers & Practitioners

Threat Intelligence RSS feed URL

Threat IntelligenceSnow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware SuiteBy Mandiant • 26-minute read

Threat IntelligenceDefending Your Enterprise When AI Models Can Find Vulnerabilities Faster Than EverBy Francis deSouza • 13-minute read

Threat IntelligenceThe German Cyber Criminal Überfall: Shifts in Europe's Data Leak LandscapeBy Google Threat Intelligence Group • 5-minute read

Threat IntelligencevSphere and BRICKSTORM Malware: A Defender's GuideBy Mandiant • 62-minute read

GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access

Threat IntelligenceWelcome to BlackFile: Inside a Vishing Extortion OperationBy Google Threat Intelligence Group • 16-minute read

Threat Intelligence2 PhaaS 2 Furious: The Evolution of Chinese-Language Phishing ServicesBy Google Threat Intelligence Group • 7-minute read

Threat IntelligenceSeeking Counsel: Ongoing Targeted Campaign Against US Law FirmsBy Mandiant • 19-minute read

Threat IntelligenceShinyHunters Targets Education Sector with Oracle PeopleSoft ExploitBy Mandiant • 12-minute read

Threat IntelligencePublic and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing Artificial Intelligence, Cyber, Medical, and National Defense ResearchBy Google Threat Intelligence Group • 21-minute read

Financial Services

Healthcare & Life Sciences

Media & Entertainment

Telecommunications

SAP on Google Cloud

Productivity & Collaboration

Storage & Data Transfer

Security & Identity

Jump to Content

Get started for free

AI & Machine Learning

Application Development

Application Modernization

Chrome Enterprise

Containers & Kubernetes

Maps & Geospatial

Threat Intelligence

Infrastructure Modernization

Attackers can move from access to exfiltration in 72 minutes. Learn how modern SOC teams close the speed gap with Unit 42's AI-driven automation, threat hunting, MDR and Managed XSIAM. The post Inside the Modern SOC: The 72-Minute Race appeared first on Unit 42.

See how Microsoft Defender performed in one year of real-world email security benchmarking against SEG and ICES vendors. The post Microsoft Defender email security benchmarking: Key insights from one year of data appeared first on Microsoft Security Blog.

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-20262 Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability CVE-2026-54420 LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber acto

A phishing kit subverting Microsoft’s legitimate authentication flow lets attackers break into accounts without stealing passwords or creating fake login pages

How to Protect Identities and Sessions from Infostealers

June 2026 Patch Tuesday: Microsoft Patches 206 Vulnerabilities Including Three Publicly Disclosed Zero-DaysJun 09, 2026