Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Logon Type
SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks
Executive summary Forest Blizzard, a threat actor linked to the Russian military, has been compromising insecure home and small-office internet equipment like routers, then modifying their settings in ways that turn them into part of the actor’s malicious infrastructure. The threat actor then hides behind this legitimate but compromised infrastructure to spy on additional targets or conduct follow-on attacks.
Vulnerabilidad en token de identidad de Azure permite compromiso total en Windows Admin Center
Una vulnerabilidad de alta gravedad en la implementación de Azure Single Sign-On del Windows Admin Center ha expuesto máquinas virtuales de Azure y sistemas conectados a Arc a accesos no autorizados en inquilinos completos. Los laboratorios de investigación de Cymulate descubrieron el fallo, ahora registrado como CVE-2026-20965, que demuestra cómo una validación incorrecta de tokens puede derribar los límites de seguridad entre máquinas individuales y entornos completos de Azure.
Azure Identity Token Vulnerability Enables Tenant-Wide Compromise in Windows Admin Center Original
A high-severity vulnerability in Windows Admin Center’s Azure Single Sign-On implementation has exposed Azure virtual machines and Arc-connected systems to unauthorized access across entire tenants. Cymulate Research Labs discovered the flaw, now tracked as CVE-2026-20965, which demonstrates how improper token validation can collapse security boundaries between individual machines and complete Azure environments.
Follow the Breadcrumbs with Microsoft Incident Response and MDI: Working Together to Fight Identity
In cybersecurity incidents, one of the first to gain credentials and elevate their privileges. For this reason, they will almost always target user identities and the underlying identity infrastructure. This blog post discusses how Microsoft Incident Response and Microsoft Defender for Identity (MDI) work together to fight identity-based attacks. We demonstrate how MDI can be used to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions.
Future Proof your SOC with the Power of the Azure Ecosystem and Defender Threat Intelligence
In today’s world of ever-evolving sophisticated threats, time is of the essence when it comes to an efficient SOC’s continuous feedback loop for reducing attacker dwell time. The days of humans writing effective rules to detect malicious activity are gone.
How to Track Important Windows Security Events with PowerShell
Many organizations rely on Microsoft technologies to get work done. At the same time, threat actors can exploit operating systems like Windows. Luckily, Windows logs OS security events to help you track down this behavior. Security events produced by Windows serve as a critical resource in the incident response process.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Logon
Contact Logon, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack