Detecting threat actors in recent German industrial attacks with Windows Defender ATP – Microsoft Secure

This Microsoft Secure blog describes the Winnti malware implant and two activity groups (BARIUM and LEAD) that have used it for persistent access and industrial espionage, summarizes observed victim types and intrusion methods, provides IOCs and TTPs (e.g., malicious DLLs, rundll32 loading, registry persistence, file locations and hashes), and demonstrates how Windows Defender ATP detects, presents contextual telemetry, and enables response options such as machine isolation and enterprise-wide file blocking.