Linux News and Insights | Microsoft Security Blog

March 31, 2025
13 min read

Analyzing open-source bootloaders: Finding vulnerabilities faster with AI

Using Microsoft Security Copilot to expedite the discovery process, Microsoft has uncovered several vulnerabilities in multiple open-source bootloaders impacting all operating systems relying on Unified Extensible Firmware Interface (UEFI) Secure Boot.

Colleagues working in a library on laptops

September 14, 2023
13 min read

Uncursing the ncurses: Memory corruption vulnerabilities found in library

A set of memory corruption vulnerabilities in the ncurses library could have allowed attackers to chain the vulnerabilities to elevate privileges and run code in the targeted program’s context or perform other malicious actions.

Two women and one man join an in-person meeting in a medium sized conference room with a companion device. One woman is casting from her mobile device while standing at the back of the room.

June 22, 2023
11 min read

IoT devices and Linux-based systems targeted by OpenSSH trojan campaign

Microsoft has uncovered an attack leveraging custom and open-source tools to target internet-facing IoT devices and Linux-based systems.

A man standing in their workstation with multiple computer screens.

December 21, 2022
12 min read

Microsoft research uncovers new Zerobot capabilities

The Microsoft Defender for IoT research team details information on the recent distribution of a Go-based botnet, known as Zerobot, that spreads primarily through IoT and web-application vulnerabilities.

Male first line worker using laptop folded open as tablet, standing on home furnishings sales floor, looking at a wall-mounted customer support monitor which displays an advertisement for bedding. A desktop monitor sits on a desk behind him.

December 15, 2022
9 min read

MCCrash: Cross-platform DDoS botnet targets private Minecraft servers

The Microsoft Defender for IoT research team analyzed a cross-platform botnet that infects both Windows and Linux systems from PCs to IoT devices, to launch distributed denial of service (DDoS) attacks against private Minecraft servers.

October 25, 2022
11 min read

DEV-0832 (Vice Society) opportunistic ransomware campaigns impacting US education sector

In recent months, Microsoft has detected active ransomware and extortion campaigns impacting the global education sector, particularly in the US, by a threat actor we track as DEV-0832, also known as Vice Society.

August 19, 2022
8 min read

Uncovering a ChromeOS remote memory corruption vulnerability

Microsoft discovered a memory corruption vulnerability in a ChromeOS component that could have been triggered remotely, allowing attackers to perform either a denial-of-service (DoS) or, in extreme cases, remote code execution (RCE).

CISO (chief information security officer) collaborating in a security operations center.

June 13, 2022
15 min read

The many lives of BlackCat ransomware

The use of an unconventional programming language, multiple target devices and possible entry points, and affiliation with prolific threat activity groups have made the BlackCat ransomware a prevalent threat and a prime example of the growing ransomware-as-a-service (RaaS) gig economy.

May 19, 2022
27 min read

Rise in XorDdos: A deeper look at the stealthy DDoS malware targeting Linux devices

Observing a 254% increase in activity over the last six months from a versatile Linux trojan called XorDdos, the Microsoft 365 Defender research team provides in-depth analysis into this stealthy malware’s capabilities and key infection signs.

April 26, 2022
9 min read

Microsoft finds new elevation of privilege Linux vulnerability, Nimbuspwn

Microsoft has discovered several vulnerabilities, collectively referred to as Nimbuspwn, that could be chained together, allowing an attacker to elevate privileges to root on many Linux desktop endpoints.

December 11, 2021
32 min read

Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability

Microsoft is tracking threats taking advantage of the remote code execution (RCE) vulnerability in Apache Log4j 2.

July 22, 2021
8 min read

When coin miners evolve, Part 1: Exposing LemonDuck and LemonCat, modern mining malware infrastructure

LemonDuck, an actively updated and robust malware that’s primarily known for its botnet and cryptocurrency mining objectives, adopted more sophisticated behavior and escalated its operations.

Linux

Refine results