The agentic SOC—Rethinking SecOps for the next decade
2026-04-13T20:52:21Z•933c9689784f077f857407b33f0feb131015d659bcd597d65999c558262b1751
AI‑enabled attacksAndroidAxiosDNS hijackingForest BlizzardLinux hostingMFA bypassMITMMedusaPHP webshellSOHO routersSapphire SleetStorm‑1175Storm‑2755cookie‑gated webshelldependency management','threat-intelligencedevice‑code phishingintent redirectionmobile walletsnpmpatchingpayroll fraudransomwaresupply-chainvulnerability disclosure
What happened
Microsoft Security Blog (Apr 2026) summarizing multiple high‑risk observations and guidance: emerging financially motivated and ransomware actors (Storm‑2755 ‘payroll pirate’ targeting Canadian payrolls; Storm‑1175 running high‑tempo Medusa ransomware campaigns), a state‑linked SOHO router compromise (Forest Blizzard) enabling DNS hijacking and MITM, a severe Android intent‑redirection vulnerability in a widely deployed third‑party SDK exposing mobile wallets, cookie‑gated PHP webshell tradecraft in Linux hosting, an AI‑enabled device‑code phishing campaign and broader actor abuse of generativ
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 933c9689784f077f857407b33f0feb131015d659bcd597d65999c558262b1751
- Enrichment time
- 2026-04-13T20:52:21Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.