Actor Profile

Storm-3068 is a threat actor tracked by Microsoft that demonstrated sophisticated understanding of cloud-native attack paths. In this intrusion, the actor leveraged a compromised user identity obtained through self-service password reset to gain persistent access, then systematically pivoted through Azure DevOps to reach Kubernetes infrastructure. Rather than deploying malware, Storm-3068 exploited legitimate identity and cloud services, demonstrating operational maturity in targeting the intersection of identity, development pipelines, and cloud operations. The actor's motivation appears focused on establishing broad infrastructure access through trusted development toolchains.

TTPs (Tactics, Techniques, Procedures)

Storm-3068 employed identity-centric TTPs without relying on malware or exploits. Initial access was achieved via self-service password reset compromise, followed by persistence through registration of attacker-controlled authentication methods. The actor conducted extensive reconnaissance of Azure DevOps repositories, projects, pipelines, and deployment environments using legitimate administrative tools and automated scripts. For privilege escalation and lateral movement, Storm-3068 modified trusted development pipelines to harvest Kubernetes credentials at scale, deploying kube agents to collect kubeconfig files containing cluster authentication details. The actor established command and control through the Atera remote management agent and Chisel tunneling utility to create reverse tunnels exposing the Kubernetes API server. Credential access involved creating malicious pipelines authorized to access 50+ resources, ultimately exfiltrating seven kubeconfig files to a repository for persistent cluster access.

Targets & Patterns

Storm-3068 targeted organizations with integrated cloud infrastructure and software development environments, specifically focusing on cloud infrastructure and software development sectors. The actor demonstrated particular interest in Azure DevOps as a high-value pivot point sitting at the intersection of identity, source code, and cloud operations. Targeting patterns reveal focus on Kubernetes environments and deployment pipelines with broad resource access. The selection criteria appears to prioritize organizations where identities, source code repositories, CI/CD pipelines, and production cloud environments are tightly linked, enabling a single account compromise to cascade across multiple security boundaries. This represents an emerging attack pattern exploiting the trust relationships between development toolchains and production infrastructure.

Historical Context

This incident represents documented Storm-3068 activity investigated by Microsoft's Detection and Response Team (DART) and analyzed in collaboration with Microsoft Threat Intelligence. The case exemplifies a growing trend where threat actors exploit identity and cloud service integrations rather than traditional malware-based approaches. No specific previous Storm-3068 campaigns are detailed in the provided reporting, but the techniques align with broader industry observations of identity-driven attacks targeting cloud-native environments and supply chain attack surfaces through development infrastructure compromise.

Defensive Recommendations

  • Monitor self-service password reset activity for anomalous patterns including repeated reset attempts, velocity anomalies, or targeting of multiple privileged accounts within short timeframes
  • Enforce phishing-resistant multifactor authentication for all privileged accounts and exclude high-value identities from self-service password reset workflows where possible
  • Implement pipeline security controls including mandatory approvals for code changes, branch protection policies preventing direct commits to critical branches, and least-privilege permissions restricting who can create, modify, or execute build and deployment pipelines
  • Enable comprehensive logging and monitoring for Azure DevOps audit logs, Git version history, pipeline modifications, and service connection usage to detect unauthorized enumeration or credential harvesting activities
  • Apply network segmentation and authentication controls for Kubernetes API servers, monitor for unauthorized kubeconfig file access or exfiltration, and detect deployment of unexpected remote management tools like Atera or tunneling utilities like Chisel in pipeline environments