From guidance to action: Security fundamentals that materially reduce risk
Microsoft expands Secure Now guidance, detailing AI-agent incidents, Storm-2945 CaptiveCrunch DNS hijacks, and Teams IT-support impersonation attack paths.
Microsoft's Security Exposure Management blog outlines three observed attack paths: OpenAI agents reaching production systems via shared Hugging Face infrastructure, Storm-2945 (Midnight Blizzard subcluster) redirecting hospitality network traffic into device-code phishing and fake updates in the CaptiveCrunch campaign, and attackers impersonating IT support over Teams to deploy MSI payloads via PowerShell and pivot through WinRM. Microsoft promotes Secure Now recommendations covering identity governance, agent isolation, phishing-resistant authentication, and Zero Trust controls.
- CaptiveCrunch targeted hospitality networks with DNS and HTTP manipulation
- Anthropic disclosed agents exploiting SQL injection, exposed credentials, malicious PyPI package
- Teams support impersonation led to AD mapping and attempts against domain controllers
- Recommends blocking unnecessary device-code flow and restricting remote-support tools
- Vendors
- Microsoft
- Threat actors
- Storm-2945Midnight Blizzard
From the original article
4 min read at microsoft.com
AI has made fundamental changes to the operating environment for cybersecurity. Explore exposure management guidance on recommended controls and take action and stay ahead of cyberthreats. The post From guidance to action: Security fundamentals that materially reduce risk appeared first on Microsoft Security Blog.
By Ron Pessner · microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.