Loading story…
Microsoft disclosed that Microsoft Defender XDR automatically disrupted a ransomware intrusion at QNET by isolating an endpoint 128 seconds after the first detection, containing the incident to a single device. According to the incident summary, the attack began when a user opened a malicious file that launched mshta.exe, which then reached out to attacker-controlled infrastructure to retrieve a second-stage payload; Defender also observed signs consistent with persistence preparation through RunMRU registry activity.
Microsoft said its automatic attack disruption capability correlated multiple high-confidence alerts and triggered the IsolateDevice response playbook without SOC intervention, severing command-and-control communications before the attackers could establish persistence, move laterally, or pull down additional payloads. The case was presented as an example of Defender XDR's automated attack disruption workflow, which is designed to autonomously contain active attacks by taking response actions such as device isolation once sufficient confidence thresholds are met.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft publicly described the QNET incident as a case study showing its new automatic device isolation capability disrupting a ransomware-related multi-stage endpoint attack within 128 seconds of first detection. The report said no SOC action was required during the disruption window.
Microsoft published documentation describing automatic attack disruption capabilities in Microsoft Defender XDR, including automated response actions used to contain attacks. The documentation establishes the product capability later referenced in the QNET case study.
At 09:25:28 UTC, device isolation completed successfully on the compromised QNET endpoint, cutting off internal and external network communications except Defender management traffic. Microsoft said the incident remained contained to a single endpoint, with no further malicious activity, persistence, or lateral movement observed after isolation.
At 09:25:16 UTC, Microsoft Defender autonomously launched the IsolateDevice response playbook against the affected QNET endpoint. The action was taken without SOC intervention during the disruption window.
At 09:25:02 UTC, Microsoft Defender's disruption pipeline determined that device isolation was the most effective containment action for the compromised QNET endpoint. This followed multiple high-confidence detections and correlation of the observed attack behavior.
In the QNET incident, a user-opened malicious file launched mshta.exe, which contacted attacker-controlled infrastructure to retrieve and execute a second-stage payload. Microsoft said this execution occurred at approximately 09:23:20 UTC and showed signs of attempted persistence preparation via RunMRU registry activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
cyberaccord.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcemicrosoft.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators have repeatedly used tools and policy abuse to disable Microsoft Defender before encrypting Windows environments. DFIR reporting documented the freeware utility **Defender Control** being used in real intrusions by groups such as **Dharma**, **Phobos**, and **Crysis**, typically after access through exposed RDP, to turn off Defender through registry edits, service changes, driver unloading, and local group policy modifications. Separately, **LockBit 2.0** automated the same objective at enterprise scale by creating malicious Active Directory group policies on a domain controller, disabling Defender across domain-joined systems, and launching ransomware via scheduled tasks after enumerating hosts with AD and LDAP queries. More recent intrusions show the tactic evolving beyond simple utilities into **BYOVD** and broader policy abuse. WithSecure reported that the **CrazyHunter** ransomware actor used the vulnerable **Zemana Anti-Logger** driver `zam64.sys` to disable both Windows Defender and Trend Micro during attacks on Taiwanese hospitals and industrial organizations, including the Mackay Memorial Hospital incident. The operation also used publicly available tooling such as **SharpGPOAbuse** for lateral movement and persistence, reinforcing that defense evasion through Defender tampering and group policy manipulation remains a practical, low-barrier technique for ransomware actors ranging from smaller crews to more organized operators.
Aug 14, 2026
Microsoft has tracked **Storm-2570**, a ransomware affiliate active since April 2025, across the Qilin, DragonForce, Anubis, and BERT ransomware-as-a-service ecosystems. The actor has targeted organizations in North America and Europe across multiple sectors, retaining a consistent intrusion playbook despite rotating ransomware payloads: abuse of remote-management and tunneling software, credential theft, network reconnaissance, lateral movement through PsExec, RDP, and SMB, theft of `NTDS.dit`, Microsoft Defender tampering, cloud-based data theft, and encryption. Organizations should investigate unauthorized RMM software, encrypted outbound tunnels, Defender configuration changes, directory-database access, and `s5cmd` or Rclone activity as potential precursor signals. Microsoft recommends maintaining Defender’s always-on protections and tamper protection, which locks critical antivirus controls and alerts on attempted changes; any necessary administrative override should be restricted to authorized, time-limited troubleshooting mode and reviewed through Defender telemetry, device timelines, and advanced hunting.
Sep 24, 2026
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026