A ransomware investigation finds two unrelated intruders

Microsoft’s incident-response team reported on 22 June that an investigation uncovered parallel activity from two unrelated threat actors in the same environment. Its account describes ransomware-related behaviour alongside quieter attempts to establish longer-term access across hybrid infrastructure.

The report distinguishes observed activity from suspected initial-access attempts, including reconnaissance for a possible file-inclusion weakness where exploitation was not confirmed. It also describes abuse of legitimate remote-access tools. For responders, the case complicates a single-cause narrative: similar tools or overlapping timelines do not prove that every action belongs to one operator. Removing the most visible ransomware activity would not by itself establish that the other access had been understood or eliminated.