[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPNEhmpogUNlVteX66BJqR8aBj-tuC8HYSMdFkukYLcs":3},{"article":4,"iocs":57,"watch_terms":65,"solutions":66,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"3e140674-b6af-442c-b077-523cc828a988","​​Beyond source code: A path to the keys to the kingdom","beyond-source-code-a-path-to-the-keys-to-the-kingdom-37cce5","Explore how Storm-3068 turned a compromised identity into broader cloud access and the steps organizations can take to defend their identities, pipelines, and cloud infrastructure. The post ​​Beyond source code: A path to the keys to the kingdom appeared first on Microsoft Security Blog.","Threat actor Storm-3068 leveraged a compromised user identity, initially gained through a self-service password reset, to access Azure DevOps and Kubernetes resources. The group exploited trusted development pipelines to harvest credentials and establish persistent access to cloud infrastructure, bypassing traditional malware-based attacks. Microsoft's DART team investigated and disrupted the actor's activities.","Storm-3068 exploited compromised identity to gain cloud access via Azure DevOps and Kubernetes.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F09\u002F29\u002Fbeyond-source-code-a-path-to-the-keys-to-the-kingdom\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002Fcyberattackseries_header_imageQ1FY27.png","2026-09-29T16:00:00+00:00","2026-09-29T18:00:34.670547+00:00",8,[17,20,23,26,29],{"name":18,"type":19},"Storm-3068","threat_actor",{"name":21,"type":22},"Azure DevOps","product",{"name":24,"type":25},"Kubernetes","technology",{"name":27,"type":28},"Microsoft","vendor",{"name":30,"type":22},"Microsoft Defender Experts","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":53},{"id":54,"icon":33,"name":55,"slug":56},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[58,62],{"type":59,"value":60,"context":61},"malware","Atera","Remote management agent deployed by threat actor.",{"type":59,"value":63,"context":64},"Chisel","Tunneling utility deployed by threat actor.",[27,21,30],{"controls":67,"vendors":150},[68,96,124],{"slug":69,"name":70,"problem":71,"products":72},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[73,81,88],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":82,"vendor_name":27,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":97,"name":98,"problem":99,"products":100},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[101,109,116],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":97,"product_name":113,"url":114,"description":115},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":125,"name":126,"problem":127,"products":128},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[129,134,142],{"vendor_slug":82,"vendor_name":27,"vendor_logo":83,"product_slug":130,"product_name":131,"url":132,"description":133},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",[151],{"slug":82,"name":27,"logo_path":83,"roles":152},[153,154],"reported_by","affected",{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":173},"compromised-identity-opens-door-to-cloud-devops-pipeline-takeover","Compromised Identity Opens Door to Cloud DevOps Pipeline Takeover","Storm-3068 exploited a self-service password reset mechanism to gain initial access, highlighting how weak identity controls can serve as a launchpad for deep infrastructure compromise. Once inside, the threat actor abused trusted CI\u002FCD pipelines — a classic supply chain attack vector — to harvest credentials and move laterally into Azure DevOps and Kubernetes environments without ever deploying traditional malware. This matters because development pipelines are often implicitly trusted by cloud infrastructure, meaning a single compromised identity can cascade into full environment takeover. The attack demonstrates that 'keys to the kingdom' increasingly live not in production systems, but in the overlooked identity and pipeline layers that serve them.",[160,161,162,163,164,165,166,167,168,169,170,171,172],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 16 – Application Software Security","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 AU-6 (Audit Record Review)","NIST SP 800-218 SSDF PW.4 (Secure Development Environments)","NIST Zero Trust Architecture SP 800-207","MITRE ATT&CK T1078 (Valid Accounts)","MITRE ATT&CK T1552 (Unsecured Credentials)","MITRE ATT&CK T1195 (Supply Chain Compromise)","ITIL – Change Enablement (pipeline configuration as change-controlled asset)",{"MITRE ATT&CK T1078 (Valid Accounts)":174,"CIS Control 5 – Account Management":175,"NIST Zero Trust Architecture SP 800-207":176,"NIST SP 800-53 AC-2 (Account Management)":177,"NIST SP 800-53 AU-6 (Audit Record Review)":178,"MITRE ATT&CK T1552 (Unsecured Credentials)":179,"CIS Control 6 – Access Control Management":180,"MITRE ATT&CK T1195 (Supply Chain Compromise)":181,"NIST SP 800-53 IA-5 (Authenticator Management)":182,"NIST SP 800-53 SI-3 (Malicious Code Protection)":183,"CIS Control 16 – Application Software Security":184,"NIST SP 800-218 SSDF PW.4 (Secure Development Environments)":185,"ITIL – Change Enablement (pipeline configuration as change-controlled asset)":186},"Valid accounts were Storm-3068's foothold, so monitoring identity use is key to detection.","Account management controls how accounts are created and recovered, which matters when self-service password reset is the weak link.","Zero trust architecture requires continuous verification, limiting what a compromised identity can access.","Account management that monitors password resets helps detect abuse of self-service recovery.","Reviewing audit records of pipeline changes helps spot unauthorised modifications by attackers.","Unsecured credentials in pipelines let Storm-3068 move deeper, so secrets should be vaulted and rotated.","Access control management limits what a compromised identity can reach in CI\u002FCD pipelines.","Supply chain compromise via CI\u002FCD pipelines can spread malicious code, as Storm-3068 demonstrated.","Authenticator management strengthens password reset processes with strong verification, closing Storm-3068's entry point.","Malicious code protection on build systems helps detect tampering in CI\u002FCD pipelines.","Application software security includes securing CI\u002FCD pipelines, which Storm-3068 abused to harvest credentials.","Securing development environments includes protecting CI\u002FCD pipelines and their secrets from compromised identities.","Treating pipeline configuration as change-controlled means unauthorised edits are detected and reviewed."]