The agentic SOC—Rethinking SecOps for the next decade

This collection of Microsoft Security Blog posts (April 2026) highlights multiple high‑impact threat trends and incidents: financially motivated and nation‑state actors (Storm‑2755 “payroll pirate”, Storm‑1175 Medusa ransomware, Forest Blizzard, and Sapphire Sleet) conducting account takeovers, ransomware, DNS‑hijacking/MITM via compromised SOHO routers, and an npm supply‑chain compromise of Axios. Microsoft researchers also disclosed a severe intent‑redirection vulnerability in a widely used Android SDK that exposed wallets, detailed cookie‑gated PHP webshell tradecraft in Linux hosting, and—