Loading story…
Mandiant published remediation and hardening guidance for Microsoft 365 environments aimed at defending organizations against activity associated with UNC2452, the threat actor tied to high-profile cloud and email compromise operations. The guidance focuses on reducing exposure in Microsoft 365 tenants and helping defenders address weaknesses that can enable persistence, unauthorized access, and abuse of cloud-based identity and messaging services.
The advisory highlights practical steps for security teams to strengthen tenant security, improve detection, and remediate compromise paths in Microsoft 365. For CISOs and defenders, the publication serves as an operational reference for hardening cloud identity, email, and administrative controls against a sophisticated actor known for targeting enterprise and government environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Mandiant published a blog post outlining remediation and hardening strategies for Microsoft 365 environments to defend against UNC2452 activity. The reference does not provide additional dated incident details beyond the publication itself.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mandiant published guidance on detecting backdoors in **Microsoft 365** and **Azure Active Directory**, highlighting how attackers can establish persistent access in cloud identity environments after initial compromise. The report focuses on abuse of identity and administrative features that let intruders maintain control over tenant resources, evade remediation, and regain access even after passwords are reset. The guidance emphasizes hunting for persistence mechanisms tied to cloud accounts, applications, and federation settings in Microsoft environments, reflecting growing concern over identity-layer attacks against enterprise tenants. For defenders, the publication frames Microsoft 365 and Azure AD as critical investigation points during incident response because compromised identity infrastructure can provide long-term access across email, collaboration, and cloud administration services.
Jul 12, 2026
Google Cloud and Mandiant released frontline hardening guidance focused on **UNC3944**, a financially motivated cybercrime group known for aggressive intrusions that target enterprise environments. The advisory highlights defensive measures organizations can take proactively to reduce exposure to the group’s tactics, drawing on incident-response experience and threat intelligence gathered from real-world investigations. The guidance emphasizes practical security improvements aimed at disrupting UNC3944 tradecraft before compromise escalates, including stronger identity protections, tighter access controls, and broader enterprise hardening. By publishing the recommendations through Google Cloud’s threat-intelligence channel, the companies signaled continued concern over UNC3944’s ability to exploit weak authentication, privileged access, and operational gaps inside large organizations.
Jul 12, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the NSA and international partners from Australia and Canada, released comprehensive best practices to secure on-premises Microsoft Exchange Servers. This guidance addresses the persistent threat posed by attackers exploiting vulnerabilities in Exchange, especially as some versions reach end-of-life and no longer receive security updates. Key recommendations include restricting administrative access, enforcing multi-factor authentication (MFA), and implementing strong transport security measures such as TLS and HSTS to protect communications and reduce the attack surface. Industry experts emphasize that organizations should treat this guidance as a critical call to action, urging security teams to refine threat models, conduct tabletop exercises, and foster collaboration between IT, DevOps, and business leaders. The guidance highlights the importance of consistent patching, least privilege, and segmentation as foundational defenses against ongoing threats targeting Exchange environments. Organizations are encouraged to use this opportunity to reassess their security investments and ensure robust protection for their communication infrastructure.
Jul 12, 2026