Attackers exploit Zimbra zero-click flaw CVE-2026-73570 on email servers
Microsoft says crafted mail runs commands when SNMP notifications are on, then webshells and mailbox staging follow; fix is 10.1.20.
84
Organization
Microsoft Threat Intelligence
- Mentions · 7d0
- Mentions · 30d2
- All mentions8
- First seenAug 11, 2026
- Last mentioned10d ago
Timeline
8 articles · newest firstHackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts
Attackers used a stolen ConnectWise Cloud Backup secret to access 173 Microsoft 365 tenants.
85
Unmasking EvilTokens: Getting to the root of device code phishing
Microsoft details the EvilTokens/Storm-2992 device-code phishing operation and shares Defender detections after disrupting the AI-powered platform.
76
Detect and disrupt AI-themed attacks with Microsoft Defender
Microsoft Threat Intelligence reports criminal campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek in phishing, AiTM, and malvertising attacks reaching 100,000 emails daily.
65
Mars Security Debuts Automated Threat Engine Processing Live Cyber Intelligence Into Validated Rules Within Minutes
Mars Security launches Real-Time Intel-Based Detection, converting threat intelligence advisories into validated, ATT&CK-mapped detection rules within minutes for SOCs.
22
Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.
82
Storm-1175 Replaces Medusa With New StormEncryptor Ransomware
Microsoft reports China-linked ransomware group Storm-1175 switched from Medusa to a new C++ strain, StormEncryptor, likely exploiting N-able flaw CVE-2026-18577.
62
DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt
Microsoft reports DeadLock ransomware using Polygon smart contracts and Session messaging for extortion infrastructure, claiming 96 victims across Europe and the U.S.
62
Related CVEs
by mentions- CVE-2025-5269186%10.0Unauthenticated Arbitrary File Upload RCE in SmarterTools SmarterMail
- CVE-2025-31161100%9.8Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161)
- CVE-2026-2376096%9.3Unauthenticated Admin Password Reset Bypass in SmarterTools SmarterMail
- CVE-2023-2152959%8.8Authenticated Deserialization RCE in Microsoft Exchange Server (CVE-2023-21529)
- CVE-2024-170895%8.4Path Traversal RCE in ConnectWise ScreenConnect (CVE-2024-1708)
- CVE-2026-1857715%8.2Authentication Bypass and Account Takeover in N-able N-central (Incomplete Patch)
- CVE-2023-46805100%8.2Authentication Bypass in Ivanti Connect Secure and Policy Secure Web Component
- CVE-2024-5772797%7.5Unauthenticated Path Traversal File Download in SimpleHelp 5.5.7 and Earlier
- CVE-2024-27199100%7.3Path Traversal in JetBrains TeamCity Allows Limited Admin Actions
- CVE-2024-5772864%7.2Zip-Slip Path Traversal RCE in SimpleHelp Remote Support 5.5.7 and Earlier
Appears with
- Microsoftvendor · 4
- CISAorganization · 2
- Windows Remote Managementproduct · 1
- Wizvendor · 1
- Quick Assistproduct · 1
- SimpleHelpproduct · 1
- INCthreat actor · 1
- Microsoft Copilotproduct · 1
- CrowdStrikevendor · 1
- Microsoft 365product · 1
- AnyDeskproduct · 1
- AWS Marketplaceproduct · 1
- Microsoftorganization · 1
- Storm-3075threat actor · 1
- Unit 42organization · 1
- Storm-1175threat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.