Skip to content

Back to the catalog

​​Beyond source code: A path to the keys to the kingdom
microsoft.comwriteup

​​Beyond source code: A path to the keys to the kingdom

Microsoft's DART team details an investigation into Storm-3068, a threat actor that escalated from a self-service password reset account takeover into full control of an organization's Azure DevOps environment, then weaponized a malicious pipeline to harvest kubeconfig files and gain access to Kubernetes clusters. The actor also deployed the Atera remote management agent and the Chisel tunneling tool to establish reverse tunnels and alternate remote access, and exfiltrated seven stolen kubeconfig files into a repository. The report lays out the attack chain, DART's response, and hardening recommendations around SSPR monitoring, phishing-resistant MFA, branch protection, and pipeline permission controls.

TL;DR DART case study: Storm-3068 turned a self-service password reset into Azure DevOps pipeline abuse that harvested Kubernetes credentials at scale.
Open original ↗
Document

What it is

A Microsoft DART (Detection and Response Team) Cyberattack Series writeup on Storm-3068, detailing a specific attack chain from identity compromise through Azure DevOps into Kubernetes cluster access.

How it works

The sequence has a clear escalation shape worth laying out:

flowchart TD
    A[SSPR account takeover] --> B[Attacker registers own auth methods]
    B --> C[Enumerate Azure DevOps repos/pipelines/environments]
    C --> D[Create malicious pipeline]
    D --> E[Pipeline authorized to 50+ resources]
    E --> F[Deploy kube agent via pipeline]
    E --> G[Install Atera remote agent + Chisel]
    G --> H[Chisel reverse tunnel to external IP]
    F --> I[Harvest 7 kubeconfig files]
    I --> J[Commit kubeconfigs to repo]
    J --> K[Access to Kubernetes clusters]

The pivot point is Azure DevOps itself — the page frames it as uniquely dangerous because it sits at the intersection of identity, source code, and cloud deployment, letting one compromised account map trusted deployment paths into production infrastructure. The malicious pipeline wasn't just used to harvest credentials; it was also modified to install the Atera remote management agent and download Chisel, giving the attacker a second, independent remote-access channel in case the Azure DevOps foothold was cut off. Chisel was specifically used to build a reverse tunnel to an external IP to expose the Kubernetes API server for remote interaction.

Preconditions / Affected

Organizations using Azure DevOps with self-service password reset (SSPR) enabled on accounts that hold pipeline creation/execution privileges, and where Azure DevOps pipelines have broad authorization scope (here, over 50 resources/services) and connectivity to Kubernetes clusters via stored kubeconfig access.

What to do

Beyond the general hardening themes already noted, the page lists specific control points:

  • Monitor password reset activity for patterns like repeated resets or resets targeting multiple users.
  • Limit privileged accounts' exposure to SSPR workflows specifically (not just MFA generally).
  • Require code review approvals and branch protection; restrict direct commits to critical branches.
  • Control who can create, modify, or execute pipelines — the attack hinged on pipeline creation rights tied to one compromised identity.
  • Apply least privilege across identity, DevOps, and cloud resources so a single pipeline can't be authorized against 50+ resources.

Caveats

The page doesn't disclose how DART or the customer initially detected the intrusion, nor the organization's size/sector, how long the attacker had access, or whether the Kubernetes clusters were confirmed to have been actively exploited post-kubeconfig-theft. Full technical detail (IOCs, specific audit log queries) is gated behind the downloadable report, not included in the blog text itself.

Technologies named here

Techniques named here

  • Self-service password reset abuse
  • Repository and pipeline enumeration
  • Malicious CI/CD pipeline creation
  • Credential harvesting via kubeconfig theft
  • Tunneling for remote access

Threat actors named here

  • Storm-3068

Related in Threat Intel