Loading story…
Microsoft attributed a cloud and DevOps intrusion to Storm-3068, which abused a self-service password-reset workflow to take over a user identity and register attacker-controlled authentication methods. Using the account’s legitimate privileges rather than malware or a software exploit, the actor enumerated Azure DevOps projects, repositories, pipelines, deployment environments, and connected cloud resources.
Storm-3068 created and altered Azure DevOps pipelines to deploy a Kubernetes agent and collect cluster kubeconfig files and credentials. One malicious pipeline could access more than 50 resources and services, and investigators found seven stolen Kubernetes configuration files committed to a repository. The actor also modified pipeline scripts to install Atera and Chisel for alternate remote access and reverse tunneling. Microsoft recommends phishing-resistant MFA, limiting self-service password-reset access for privileged accounts, enforcing pipeline approvals and branch protections, constraining pipeline permissions, and applying least privilege across identity, DevOps, and cloud environments.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft DART used identity, Azure DevOps, Git-history, and cloud-infrastructure telemetry to reconstruct the intrusion and worked with the affected organization on containment and remediation. DART also collaborated with Microsoft Threat Intelligence on broader threat context.
Storm-3068 altered pipeline scripts to install the Atera remote-management agent and download Chisel. The actor used Chisel to establish a reverse tunnel to an external IP address, potentially enabling Kubernetes-cluster interaction and exposing the Kubernetes API server.
The actor added seven stolen kubeconfig files to an Azure DevOps repository. The files contained connection details and authentication information for targeted Kubernetes clusters.
Storm-3068 created a pipeline that deployed a kube agent and executed jobs to collect kubeconfig files at scale. The compromised account could deploy a pipeline authorized to access more than 50 resources and authenticated services.
Using the compromised identity's legitimate permissions, the actor enumerated Azure DevOps projects, repositories, pipelines, deployment environments, and connected cloud resources using administrative tools and scripts.
Storm-3068 abused a self-service password-reset process to take over a user account, then registered attacker-controlled authentication methods for persistent access. The intrusion did not rely on malware or a software exploit.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reported that **Storm-2949** used social engineering and abuse of Microsoft **Self-Service Password Reset (SSPR)** to compromise multiple **Microsoft Entra ID** accounts, including accounts tied to IT staff and senior leadership, then expanded access across **Microsoft 365** and **Azure**. After the initial identity takeover, the actor conducted tenant discovery through the **Microsoft Graph API**, exfiltrated data from **OneDrive** and **SharePoint**, and sought persistence by re-registering MFA methods and attempting to abuse service principal credentials. The intrusion then moved deeper into Azure, where Storm-2949 relied on legitimate management-plane operations and privileged **Azure RBAC** roles to access **App Services**, **Key Vault**, **SQL databases**, **Storage accounts**, and **virtual machines**. Microsoft said the actor used publish profiles, Key Vault permission changes, SQL firewall rule modifications, storage key listing, **VMAccess**, and **Run Command** to harvest credentials, execute code, deploy **ScreenConnect** on VMs, weaken Microsoft Defender Antivirus, and exfiltrate large volumes of data while blending into normal administrative activity; the group also cleared event logs and deleted artifacts to hinder detection.
Jun 29, 2026
Microsoft attributed destructive Azure activity to **JADEPUFFER**, tracked as **Storm-3168**, after the actor used two compromised service principals within one tenant to conduct broad reconnaissance and delete Azure Storage accounts and associated application resources. The operation also attempted to delete SQL databases and recovery-protection controls, an attack pattern consistent with impairing an organization’s ability to recover from a ransomware event. The actor successfully retrieved keys for more than 30 Azure Storage accounts, which could enable data access or exfiltration, though Microsoft observed neither confirmed data theft nor a ransom note. One compromised service principal’s client ID, secret, and tenant ID had been publicly exposed in a GitHub issue, but Microsoft could not verify that it enabled the intrusion. Microsoft assessed that parallel use of identities and tokens indicated automated or scripted execution, and urged organizations to rotate exposed credentials, enforce least privilege for workload identities, and protect backup and recovery resources.
Sep 29, 2026
Microsoft said the financially motivated threat actor **Storm-2755** targeted Canadian employees in payroll diversion attacks by compromising Microsoft 365 accounts and changing salary payments to attacker-controlled bank accounts. The campaign used SEO poisoning and malvertising to lure victims to `bluegraintours[.]com`, where an adversary-in-the-middle phishing flow captured credentials, session cookies, and OAuth tokens, allowing the attackers to bypass MFA through token replay and gain persistent access to victim accounts. After entering compromised tenants, Storm-2755 searched for payroll and HR workflows, created inbox rules to hide messages about direct-deposit or banking changes, and in some cases manually accessed HR SaaS platforms such as **Workday** to alter payment details. Microsoft reported indicators including Entra error code `50199`, a user-agent shift to **Axios 1.7.9** with the same session ID, and recurring non-interactive **OfficeHome** sign-ins about every 30 minutes; the company said it assisted affected organizations, carried out tenant takedowns, and urged defenses including phishing-resistant MFA, token revocation, Conditional Access, continuous access evaluation, suspicious inbox-rule monitoring, and device compliance enforcement.
Jun 29, 2026