MURKY PANDA Abused Entra ID Service Principals to Breach Downstream Cloud Tenants

CrowdStrike reported that MURKY PANDA, a China-nexus espionage group active since at least 2023, compromised cloud trusted relationships to reach downstream customer environments in North America. The actor targeted government, technology, academic, legal, and professional services organizations, first gaining access through internet-facing appliances by rapidly exploiting n-day and zero-day vulnerabilities, then deploying tools including the Neo-reGeorg web shell and the low-prevalence Linux malware family CloudedHope.

In cloud intrusions, the group abused Microsoft Entra ID application secrets, service principals, and delegated administrative privileges after compromising SaaS providers and a Microsoft cloud solution provider. Because Entra ID applications can create tenant-specific service principals with local permissions across multiple customer tenants, the attackers were able to pivot into downstream environments, access customer email, escalate privileges, and maintain persistence. CrowdStrike said the campaign was aimed at intelligence collection and was supported by strong operational security, including timestamp tampering, log sanitization, and the use of compromised SOHO devices as exit nodes.