Microsoft Threat Intelligence - 1

2026 (3)

September (1)

security: NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

Microsoft Security Blog

2026-09-28

Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions. It uses custom loaders, encrypted archives, and extensible components to keep access and support follow-on activity.

August (2)

security: TerminalFix campaign deploys a reverse tunnel through multistage intrusion

Microsoft Security Blog

2026-08-29

Microsoft Threat Intelligence analyzed the TerminalFix ClickFix campaign, which uses fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel in a multistage intrusion. The post includes detections and hunting guidance.

security: DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

Microsoft Security Blog

2026-08-10

Microsoft Threat Intelligence describes DeadLock ransomware as a financially motivated operation using a Rust-based encryptor and decentralized infrastructure for victim communications, negotiations, and data leak operations. The group uses double extortion to pressure victims.