The agentic SOC—Rethinking SecOps for the next decade

This Microsoft Security Blog feed (April–May 2026) highlights multiple active and emerging threats: financially motivated actors (Storm-2755) conducting payroll‑diversion attacks against Canadian employees; Storm‑1175 conducting high‑tempo Medusa ransomware campaigns by weaponizing recently disclosed web‑facing vulnerabilities; an intent‑redirection vulnerability in a widely used third‑party Android SDK exposing millions of wallets; a supply‑chain compromise of Axios npm packages attributed to North Korean actor Sapphire Sleet; SOHO router compromises and DNS hijacking attributed to Forest Bl​