[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJ0ysT1WYOyptDyp1xOppLv0oZlaiY5IZR4hOAkXu7Z8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":39,"created_at":40,"published_at":41,"article":42,"tags":46,"podcasts":65,"controls":66},"95e18cf9-d4d9-4f67-9f0c-75b6a3c19914","compromised-identity-opens-door-to-cloud-devops-pipeline-takeover","3e140674-b6af-442c-b077-523cc828a988","Compromised Identity Opens Door to Cloud DevOps Pipeline Takeover","Storm-3068 exploited a self-service password reset mechanism to gain initial access, highlighting how weak identity controls can serve as a launchpad for deep infrastructure compromise. Once inside, the threat actor abused trusted CI\u002FCD pipelines — a classic supply chain attack vector — to harvest credentials and move laterally into Azure DevOps and Kubernetes environments without ever deploying traditional malware. This matters because development pipelines are often implicitly trusted by cloud infrastructure, meaning a single compromised identity can cascade into full environment takeover. The attack demonstrates that 'keys to the kingdom' increasingly live not in production systems, but in the overlooked identity and pipeline layers that serve them.","**Immediate Actions:**\n- Enforce phishing-resistant MFA (e.g., FIDO2\u002Fpasskeys) on all self-service password reset flows and privileged identity access.\n- Audit and rotate all secrets, tokens, and service principal credentials stored within CI\u002FCD pipeline configurations.\n- Restrict Azure DevOps and Kubernetes API access using Conditional Access policies tied to verified device compliance and location.\n\n**Long-Term Improvements:**\n- Adopt a zero-trust identity model ensuring least-privilege access for all pipeline service accounts and developer identities.\n- Implement secrets management solutions (e.g., Azure Key Vault, HashiCorp Vault) to eliminate hardcoded credentials in source repositories and pipelines.\n- Establish a formal pipeline security review process that treats CI\u002FCD configurations as critical infrastructure assets subject to change control.\n\n**Detection Measures:**\n- Enable detailed audit logging across Azure DevOps, Entra ID, and Kubernetes control planes and alert on anomalous service account activity or unusual pipeline executions.\n- Deploy identity threat detection tools (e.g., Microsoft Entra ID Protection) to flag suspicious sign-in patterns including those originating from password resets.\n- Continuously monitor for credential-harvesting indicators within pipeline job logs and container runtime environments.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 16 – Application Software Security","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 AU-6 (Audit Record Review)","NIST SP 800-218 SSDF PW.4 (Secure Development Environments)","NIST Zero Trust Architecture SP 800-207","MITRE ATT&CK T1078 (Valid Accounts)","MITRE ATT&CK T1552 (Unsecured Credentials)","MITRE ATT&CK T1195 (Supply Chain Compromise)","ITIL – Change Enablement (pipeline configuration as change-controlled asset)",{"MITRE ATT&CK T1078 (Valid Accounts)":26,"CIS Control 5 – Account Management":27,"NIST Zero Trust Architecture SP 800-207":28,"NIST SP 800-53 AC-2 (Account Management)":29,"NIST SP 800-53 AU-6 (Audit Record Review)":30,"MITRE ATT&CK T1552 (Unsecured Credentials)":31,"CIS Control 6 – Access Control Management":32,"MITRE ATT&CK T1195 (Supply Chain Compromise)":33,"NIST SP 800-53 IA-5 (Authenticator Management)":34,"NIST SP 800-53 SI-3 (Malicious Code Protection)":35,"CIS Control 16 – Application Software Security":36,"NIST SP 800-218 SSDF PW.4 (Secure Development Environments)":37,"ITIL – Change Enablement (pipeline configuration as change-controlled asset)":38},"Valid accounts were Storm-3068's foothold, so monitoring identity use is key to detection.","Account management controls how accounts are created and recovered, which matters when self-service password reset is the weak link.","Zero trust architecture requires continuous verification, limiting what a compromised identity can access.","Account management that monitors password resets helps detect abuse of self-service recovery.","Reviewing audit records of pipeline changes helps spot unauthorised modifications by attackers.","Unsecured credentials in pipelines let Storm-3068 move deeper, so secrets should be vaulted and rotated.","Access control management limits what a compromised identity can reach in CI\u002FCD pipelines.","Supply chain compromise via CI\u002FCD pipelines can spread malicious code, as Storm-3068 demonstrated.","Authenticator management strengthens password reset processes with strong verification, closing Storm-3068's entry point.","Malicious code protection on build systems helps detect tampering in CI\u002FCD pipelines.","Application software security includes securing CI\u002FCD pipelines, which Storm-3068 abused to harvest credentials.","Securing development environments includes protecting CI\u002FCD pipelines and their secrets from compromised identities.","Treating pipeline configuration as change-controlled means unauthorised edits are detected and reviewed.","published","2026-09-29T18:21:58.903975+00:00","2026-09-29T18:21:58.594+00:00",{"id":7,"url":43,"slug":44,"title":45},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F09\u002F29\u002Fbeyond-source-code-a-path-to-the-keys-to-the-kingdom\u002F","beyond-source-code-a-path-to-the-keys-to-the-kingdom-37cce5","​​Beyond source code: A path to the keys to the kingdom",[47,53,59],{"id":48,"name":49,"slug":50,"description":51,"color":52},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":54,"name":55,"slug":56,"description":57,"color":58},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":60,"name":61,"slug":62,"description":63,"color":64},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[67,71,75],{"slug":68,"name":69,"problem":70},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":72,"name":73,"problem":74},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":76,"name":77,"problem":78},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed."]