Star Blizzard's RedFlick chain needs one click, then runs entirely on binaries that ship with Windows: conhost.exe, ssh.exe, control.exe, curl. It ends in three scheduled tasks named like maintenance. Over 100 organisations hit. Four hunts in Defender KQL, Falcon CQL, Splunk and Kibana.

In the world of cloud security, things move fast. Sometimes, cracks in big systems like Microsoft's Entra ID show up in ways that make you double-check your own setup. Security researcher Dirkjan van der Bijl recently revealed a vulnerability that allows attackers to snag Global Admin rights in nearly any Entra ID tenant. This issue is tied to undocumented "Actor tokens" and a sloppy validation problem in the old Azure AD Graph API. If you're a security pro working with Micro

In the ever-evolving world of cybersecurity, new vulnerabilities can turn a seemingly secure setup into a hacker's playground. Just last month, on August 6, 2025, Microsoft documented CVE-2025-53786, an elevation of privilege (EoP) vulnerability affecting hybrid Microsoft Exchange Server deployments. This flaw allows attackers with administrative access on on-premises Exchange servers to escalate privileges and potentially compromise your entire Microsoft 365 (M365) Exchange

Identity and access management is no longer just an enterprise challenge. With hybrid work, cloud adoption, and the rise of generative AI, small and mid-sized businesses (SMBs) are facing the same risks — often with fewer resources. Microsoft’s Secure Employee Access Report 2025 highlights the problem: “58% of security leaders expect the number of identities in their organization to grow in the next year.” “61% reported an increase in identity- and network-related incidents d

Misconfigurations in Microsoft 365 and Azure remain one of the biggest cybersecurity risks. Inception Security explains how to close seven overlooked security gaps to protect against account compromise and tenant breaches. If you run Microsoft 365 and Azure, your biggest risk isn’t a zero‑day—it’s misconfiguration. Tenant compromises are frequently the result of compromised privileged accounts, which is why Microsoft stresses dedicated admin identities, MFA, and least privile