FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor

In-depth analysis of newly detected NOBELIUM malware: a post-exploitation backdoor that Microsoft Threat Intelligence Center (MSTIC) refers to as FoggyWeb. NOBELIUM uses FoggyWeb to remotely exfiltrate the configuration database of compromised AD FS servers, decrypted token-signing certificate, and token-decryption certificate, as well as to download and execute additional components.

The post FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor appeared first on Microsoft Security Blog.

Continue reading FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor

A guide to combatting human-operated ransomware: Part 2

In this post, we will tackle the risks of human-operated ransomware and detail DART’s security recommendations for tactical containment actions and post-incident activities in the event of an attack.

The post A guide to combatting human-operated ransomware: Part 2 appeared first on Microsoft Security Blog.

Continue reading A guide to combatting human-operated ransomware: Part 2

Automatic scaling with Azure Virtual Machine Scale Sets flexible orchestration mode

At Ignite March 2021, we announced the Public Preview of Azure Virtual Machine Scale Sets with flexible orchestration mode, an evolution of Azure Virtual Machine Scale sets that makes it easier to run a variety of virtual machine workloads at high scal… Continue reading Automatic scaling with Azure Virtual Machine Scale Sets flexible orchestration mode