Azure DevOps

Reported Context (5)

by Storm-3068, a threat actor that turned a successful self-service password reset into access to Azure DevOps, development pipelines, and Kubernetes resources. Storm-3068 Used a Compromised Identity to Reach Azure DevOps and Kubernetes
to focus on the four most common VCS platforms across Wiz customers: GitHub, GitLab, Bitbucket, and Azure DevOps. Wiz Shares VCS Logging and Threat-Hunting Guidance for GitHub, GitLab, Bitbucket, and Azure DevOps
from assignment, many roles with permissions in applications outside of Entra (Exchange Administrator, Azure DevOps Administrator) and roles with heightened visibility (Global Reader) can still be assigned. Entra Agent ID Blueprints Can Expand the Impact of a Compromise Across Identities and Tenants
logic for common CI/CD platforms, including GitHub Actions, GitLab CI, Travis CI, CircleCI, Jenkins, Azure DevOps, AWS CodeBuild, Buildkite, AppVeyor, Bitbucket Pipelines, Drone, Semaphore, TeamCity, Bamboo, Bitrise, Mini Shai-Hulud Compromises 639 npm Package Versions in AntV-Heavy Campaign
The operator abuses Azure DevOps, Telegram, and Hookdeck as infrastructure—legitimate services inside most enterprise allowlists. Fake OpenClaw Installers Deliver Rust Malware Targeting Crypto Wallets and Password Managers

Malware (6)

Threat Actors (3)

MITRE ATT&CK (20)

Vendors (4)

Products (40)

Tools (4)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.