Vardesyn — News & TIL

TIL — Today I Learned

running notes worth remembering

28 Mar 2026

Entra ID cross-tenant token protection is now GA in Conditional Access — always validate requirementProvider claims in staging before broad rollout.

entra identity

source

15 Mar 2026

Azure Policy audit effect flags non-compliance but never blocks — swap to deny on critical controls inside landing zone scaffolding.

azure governance

02 Mar 2026

Defender XDR now correlates MCAS signals with Defender for Endpoint telemetry — noticeable drop in alert fatigue for tenants over 5 k seats.

defender m365

Platform Updates

new features & previews per M365 service

Feed unavailable — check back shortly.

Security & Tech Blogs

live feed — updated every 12 hours

Microsoft named a Leader in The Forrester Wave™ for Sovereign Cloud Platforms Microsoft is named a Leader in The Forrester Wave™ for Sovereign Cloud Platforms, recognizing Microsoft Sovereign Cloud leadership… Azure Blog 09 Apr How Drasi used GitHub Copilot to find documentation bugs How Microsoft uses AI agents and Drasi to keep open‑source documentation accurate and working. The post How Drasi used GitHub Copi… Azure Blog 09 Apr Cloud Cost Optimization: How to maximize ROI from AI, manage costs, and unlock real business value Get practical strategies and best practices to help you plan, design, and manage AI investments for sustainable value and efficien… Azure Blog 08 Apr Azure IaaS: Keep critical applications running with built-in resiliency at scale Azure IaaS provides foundational capabilities across compute, storage, and networking to help organizations stay resilient. The po… Azure Blog 01 Apr Building sovereign AI at the edge: Microsoft and Armada collaborate to deliver Azure Local on Galleon modular datacenters Explore how Microsoft and Armada bring sovereign AI to the edge with Azure Local, enabling secure, resilient workloads in disconne… Azure Blog 31 Mar Navigating digital sovereignty at the frontier of transformation Digital sovereignty has become a practical leadership discipline grounded in risk management, continuity planning, and long-term a… Azure Blog 30 Mar

Building your cryptographic inventory: A customer strategy for cryptographic posture management Learn how to build a comprehensive cryptographic inventory and strengthen quantum‑safe readiness using Microsoft Security tools, b… MS Security 10h ago Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise The Microsoft Defender Security Research Team uncovered a sophisticated macOS intrusion campaign attributed to the North Korean th… MS Security 11h ago Incident response for AI: Same fire, different fuel AI changes how incidents unfold and how we respond. Learn which IR practices still apply and where new telemetry, tools, and skill… MS Security 1d ago The agentic SOC—Rethinking SecOps for the next decade In the SOC of the future, autonomous defense moves at machine speed, agents add context and coordination, and humans focus on judg… MS Security 09 Apr Investigating Storm-2755: “Payroll pirate” attacks targeting Canadian employees Microsoft Incident Response – Detection and Response Team (DART) researchers observed an emerging, financially motivated threat ac… MS Security 09 Apr Intent redirection vulnerability in third-party SDK exposed millions of Android wallets to potential risk A severe Android intent‑redirection vulnerability in a widely deployed SDK exposed sensitive user data across millions of apps. Mi… MS Security 09 Apr

Patch Tuesday, April 2026 Edition Microsoft today pushed software updates to fix a staggering 167 security vulnerabilities in its Windows operating systems and rela… Krebs on Security 2d ago Russia Hacked Routers to Steal Microsoft Office Tokens Hackers linked to Russia's military intelligence units are using known flaws in older Internet routers to mass harvest authenticat… Krebs on Security 07 Apr Germany Doxes “UNKN,” Head of RU Ransomware Gangs REvil, GandCrab An elusive hacker who went by the handle "UNKN" and ran the early Russian ransomware groups GandCrab and REvil now has a name and … Krebs on Security 06 Apr ‘CanisterWorm’ Springs Wiper Attack Targeting Iran A financially motivated data theft and extortion group is attempting to inject itself into the Iran war, unleashing a worm that sp… Krebs on Security 23 Mar Feds Disrupt IoT Botnets Behind Huge DDoS Attacks The U.S. Justice Department joined authorities in Canada and Germany in dismantling the online infrastructure behind four highly d… Krebs on Security 20 Mar Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker A hacktivist group with links to Iran's intelligence agencies is claiming responsibility for a data-wiping attack against Stryker,… Krebs on Security 11 Mar

New Microsoft Defender “RedSun” zero-day PoC grants SYSTEM privileges A researcher known as "Chaotic Eclipse" has published a proof-of-concept exploit for a second Microsoft Defender zero-day, dubbed … BleepingComputer 5h ago Hackers exploit Marimo flaw to deploy NKAbuse malware from Hugging Face Hackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy a new variant of NKAbuse malware host… BleepingComputer 9h ago Google expands Gemini AI use to fight malicious ads on its platform Google says it is increasingly using its Gemini AI models to detect and block harmful ads on its advertising platforms, as scammer… BleepingComputer 10h ago New ATHR vishing platform uses AI voice agents for automated attacks A new cybercrime platform called ATHR can harvest credentials via fully automated voice phishing attacks that use both human opera… BleepingComputer 11h ago Most "AI SOCs" Are Just Faster Triage. That's Not Enough. AI-powered SOC tools promise automation, but most only speed up triage instead of reducing real workload. Tines shows how real gai… BleepingComputer 11h ago Cisco says critical Webex Services flaw requires customer action Cisco has released security updates to patch four critical vulnerabilities, including a fixed improper certificate validation flaw… BleepingComputer 13h ago

Apache ActiveMQ Exploit Leads to LockBit Ransomware Key Takeaways An audio version of this report can be found on Spotify, Apple, YouTube, Audible, & Ama… The DFIR Report 23 Feb Cat’s Got Your Files: Lynx Ransomware Key Takeaways The DFIR Report Services Contact us today for pricing or a demo! The intrusion began in early March 2025 with a sing… The DFIR Report 17 Dec From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira Overview Bumblebee malware has been an initial access tool used by threat actors since late 2021. In 2023 the malware was first re… The DFIR Report 04 Nov From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion Key Takeaways Private Threat Briefs: 20+ private DFIR reports annually.   Contact us today for pricing or a demo!   Tabl… The DFIR Report 29 Sep Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs Key Takeaways Private Threat Briefs: 20+ private DFIR reports annually. Contact us today for pricing or a demo! Table of Contents:… The DFIR Report 08 Sep KongTuke FileFix Leads to New Interlock RAT Variant Researchers from The DFIR Report, in partnership with Proofpoint, have identified a new and resilient variant of the Interlock ran… The DFIR Report 14 Jul

North Korea Uses ClickFix to Target macOS Users' Data Sapphire Sleet uses fake job offers and phony Zoom updates to deliver ClickFix attacks that steal credentials and sensitive data f… Dark Reading 6h ago 'Harmless' Global Adware Transforms Into an AV Killer A benign looking update Dragon Boss pushed out in March 2025 established persistence via scheduled tasks and arranged for future p… Dark Reading 6h ago Two-Factor Authentication Breaks Free from the Desktop Threat actors know how to bypass security systems outside of traditional IT environments. Implementing 2FA could provide a needed … Dark Reading 10h ago Microsoft's Original Windows Secure Boot Certificate Is Expiring The Secure Boot refresh is one of the largest coordinated security maintenance efforts across the Windows ecosystem, Microsoft sai… Dark Reading 10h ago 6-Year Ransomware Campaign Targets Turkish Homes & SMBs While enterprises breaches make more headlines, smaller incidents tend to be under-reported, if at all, allowing campaigns to last… Dark Reading 20h ago Critical MCP Integration Flaw Puts NGINX at Risk Attackers can abuse the near-maximum severity flaw in nginx-ui to restart, create, modify, and delete NGINX configuration files. Dark Reading 1d ago

? shortcuts