Storm-3068 Used a Compromised Identity to Reach Azure DevOps and Kubernetes
Summary
Microsoft says Storm-3068 abused a compromised account to access Azure DevOps, modify pipelines, collect Kubernetes credentials, and expand into cloud infrastructure. Its response team helped the customer investigate and contain the intrusion.
Key points
- The intrusion began when Storm-3068 gained access through a self-service password reset and registered its own authentication methods.
- The actor used legitimate tools and scripts to enumerate Azure DevOps repositories, projects, pipelines, and deployment environments.
- A malicious pipeline was used to collect kubeconfig files; seven stolen files were added to a repository.
- The actor also modified pipeline scripts to install the Atera remote management agent and Chisel tunneling utility, attempting to enable remote access to Kubernetes clusters.
- Microsoft’s Detection and Response Team investigated activity across identity, development, and cloud systems and worked with the customer on containment and remediation.
- Microsoft recommends phishing-resistant MFA, tighter password-reset protections, code review and branch protections, restricted pipeline permissions, and least-privilege access.
Article Details
- Victim Organization
- Not disclosed
- Incident Type
- Identity compromise followed by unauthorized access to Azure DevOps, development pipelines, and Kubernetes resources; pipeline modification to harvest Kubernetes credentials and establish attempted alternative remote access.
- Data Types Exposed
- Kubernetes configuration files containing cluster connection details and authentication information
- Credentials
- Affected Records
- Seven stolen kubeconfig files were added to a repository; no broader record count disclosed.
- Operational Impact
- The threat actor gained persistent access, enumerated repositories and pipelines, and accessed connected cloud infrastructure. Microsoft DART investigated and disrupted the threat actor's access; no operational outage is reported.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Threat Actors
Vendors
Products
Azure DevOpsby Storm-3068, a threat actor that turned a successful self-service password reset into access to Azure DevOps, development pipelines, and Kubernetes resources.Kubernetesturned a successful self-service password reset into access to Azure DevOps, development pipelines, and Kubernetes resources.Microsoft Defender Experts Cybersecurity Incident Responsehow the Microsoft Detection and Response Team (DART)—the team that delivers Microsoft Defender Experts Cybersecurity Incident Response—investigated activity by Storm-3068, a threat actor that turned a successful
Tools
Atera remote management agentIn addition to deploying a kube agent, the threat actor modified pipeline scripts to install the Atera remote management agent and download the Chisel tunneling utility.ChiselIn addition to deploying a kube agent, the threat actor modified pipeline scripts to install the Atera remote management agent and download the Chisel tunneling utility.