#APT 主题 - Cyber Security Daily Radar

学术论文2026-09-15 发布INFO

Not All Relations Are Equal: Relation-Balanced and Calibrated Graph Learning for Provenance-Based Intrusion Detection

基于溯源（provenance）的入侵检测系统（PIDS）通过分析进程、文件、网络等实体之间的系统交互关系来识别高级持续性威胁（APT）。现有方法大多将各类关系（relation，即图中边类型，如读/写文件、网络连接、进程派生等）一视同仁地

历史摘要 · 未重新核验 · arXiv cs.CR

#cs.LG #provenance #intrusion-detection #graph-learning #apt #anomaly-detection

学术论文2026-09-14 发布INFO

Tractable Defense against Advanced Persistent Threats in Networked Settings

该论文关注大规模网络环境下防御高级持续性威胁（APT）的决策理论问题。作者基于近期提出的布尔动力系统（Boolean Dynamical Systems）框架展开研究，该框架能自然刻画 APT 的四个第一性原理要素：攻击的隐蔽性、来自入侵检

历史摘要 · 未重新核验 · arXiv cs.CR

#apt #network-defense #boolean-dynamical-systems #mean-field #decision-theory #game-theory

威胁情报2026-09-12 发布INFO

Read the report

历史摘要 · 未重新核验 · Mandiant

#report #apt #mandiant

威胁情报2026-09-10 发布INFO

Protecting organizations from AI-assisted executive impersonation and invoice fraud

Microsoft examines an AI-assisted business email compromise campaign that used executive impersonation and fake invoices

历史摘要 · 未重新核验 · Microsoft Threat Intelligence

#malware #apt #ti #microsoft

威胁情报2026-09-10 发布INFO

Detect and disrupt AI-themed attacks with Microsoft Defender

See how Microsoft Defender detects and disrupts AI-themed phishing, malware, and multi-stage attacks across the attack c

历史摘要 · 未重新核验 · Microsoft Threat Intelligence

#apt #ti #microsoft #malware

威胁情报2026-09-10 发布INFO

The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE

Learn how root access on a compromised K8s node allows attackers to utilize SPIFFE/SPIRE metadata to spoof and harvest c

历史摘要 · 未重新核验 · Palo Alto Unit 42

#apt #paloalto #unit42 #malware

威胁情报2026-09-09 发布INFO

Threat matrix: Mapping threats across cloud web applications

Microsoft introduces the Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework that helps defenders und

历史摘要 · 未重新核验 · Microsoft Threat Intelligence

#apt #ti #microsoft #malware

威胁情报2026-09-09 发布INFO

Passkey-themed social engineering leads to identity and cloud compromise

Passkey-themed social engineering is being used to compromise identities and enable broader cloud attacks. Learn how thr

历史摘要 · 未重新核验 · Microsoft Threat Intelligence

#apt #ti #microsoft #malware

威胁情报2026-09-09 发布INFO

CrowdStrike Falcon Guardian Defines the Next Generation of AI SecuritySep 01, 2026

历史摘要 · 未重新核验 · CrowdStrike

#crowdstrike #apt #edr

威胁情报2026-09-04 发布INFO

How to secure edge AI in customer-owned environments

这篇文章由微软安全博客发布，针对AI向客户自有环境及边缘设备下沉的趋势，提出了系统化的安全建议。主体观点认为，在客户拥有且可物理接触的硬件环境中部署Edge AI时，传统云端信任边界已不适用，需要在保护敏感数据、凭据和模型之前，先对底层的系

历史摘要 · 未重新核验 · Microsoft Threat Intelligence

#microsoft #malware #ti #apt

威胁情报2026-09-03 发布INFO

ASCII smuggling crosses over from AI prompt injection to phishing evasion

Invisible Unicode characters popularized for hiding instructions from AI models are now being used to obfuscate words be

历史摘要 · 未重新核验 · Microsoft Threat Intelligence

#apt #microsoft #malware #ti

威胁情报2026-09-03 发布INFO

Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America

Explore how attackers targeting Latin American entities use AI for data exfiltration and how basic OpSec errors allow de

历史摘要 · 未重新核验 · Palo Alto Unit 42

#malware #unit42 #paloalto #apt

威胁情报2026-09-02 发布INFO

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collabor

历史摘要 · 未重新核验 · Microsoft Threat Intelligence

#apt #microsoft #malware #ti

威胁情报2026-09-02 发布INFO

An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation

Using autonomous AI agents, an attacker breached an enterprise network in a matter of hours. Understand how to address a

历史摘要 · 未重新核验 · Palo Alto Unit 42

#apt #paloalto #malware #unit42

威胁情报2026-09-02 发布INFO

CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access

这是一篇来自 CrowdStrike 官方博客的公告，介绍 CrowdStrike 与 Zscaler 达成合作，旨在将持续身份（Continuous Identity）能力引入零信任访问（Zero Trust Access）。文章核心内容

历史摘要 · 未重新核验 · CrowdStrike

#crowdstrike #edr #apt

威胁情报2026-09-02 发布INFO

How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem

历史摘要 · 未重新核验 · CrowdStrike

#crowdstrike #edr #apt

威胁情报2026-09-02 发布INFO

Agents of Chaos: A New $100K Agentic Security ChallengeAug 31, 2026

历史摘要 · 未重新核验 · CrowdStrike

#crowdstrike #edr #apt

威胁情报2026-09-01 发布INFO

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and

历史摘要 · 未重新核验 · Microsoft Threat Intelligence

#apt #microsoft #ti #malware

威胁情报2026-09-01 发布INFO

Cybersecurity IR Workshop: The workshop you shouldn’t miss

Cyber resilience starts before a crisis. Gain practical insights from DART to strengthen readiness and response. The pos

历史摘要 · 未重新核验 · Microsoft Threat Intelligence

#apt #microsoft #ti #malware

威胁情报2026-09-01 发布INFO

Disrupting Glassworm: Inside CrowdStrike’s Takedown of a Developer-Targeting Botnet

历史摘要 · 未重新核验 · CrowdStrike

#edr #crowdstrike #apt