Chisel (Organization): news timeline & CVEs

Hackers Turn One Compromised Account Into Access to Azure DevOps and Kubernetes

Microsoft attributes to Storm-3068 an intrusion that hijacked one account via password reset, then abused Azure DevOps pipelines to steal Kubernetes credentials.

Microsoft DART attributed an intrusion to Storm-3068, which took over an account through a self-service password reset and registered its own authentication methods for persistence. Using legitimate admin tools and automated scripts, the actor enumerated Azure DevOps projects, repositories, pipelines, and deployment environments, then created a pipeline authorized for over 50 resources to harvest Kubernetes credentials at scale. Seven stolen cluster configuration files were added to a repository; pipeline scripts were also altered to install the Atera remote management agent and the Chisel tunneling utility, exposing the Kubernetes API server via a reverse tunnel. Microsoft recommends phishing-resistant MFA, password-reset monitoring, branch protection, and least-privilege pipeline permissions.

Cyber Security NewsSep 30, 11:15 UTC · 14h agoThreat actor 3 sources

Storm-3068 Hijacks Azure DevOps Pipelines to Steal Kubernetes Credentials After Account Takeover

Microsoft attributes an Azure DevOps intrusion to Storm-3068, who abused password resets to hijack accounts and steal Kubernetes kubeconfig files via malicious pipelines.

Microsoft detailed a Storm-3068 intrusion that began with self-service password reset abuse, registration of attacker-controlled authentication methods, and removal of legitimate MFA for persistent access. The actor enumerated Azure DevOps projects and pipelines, then created a malicious pipeline authorized to access more than 50 resources and ran jobs using the DUMPCLUSTERNAME pattern to dump kubeconfig files, committing them to an existing repository. Pipelines were also modified to deploy the Atera remote management agent and the Chisel tunneling utility for persistence and Kubernetes API access. The campaign escalated from identity compromise to supply-chain and production infrastructure risk within hours.

GBHackersupdated Sep 30, 11:15 UTC · 14h agofirst Sep 30, 06:38 UTC · 18h agoThreat actor in the wild 3 sources

Beyond source code: A path to the keys to the kingdom

Microsoft DART details how Storm-3068 hijacked an account via self-service password reset, then used Azure DevOps pipelines to harvest Kubernetes credentials across 50+ resources.

Microsoft's Detection and Response Team investigated Storm-3068 activity that began with a compromised user account obtained through a self-service password reset, with the actor registering its own authentication methods to take full control of the identity. Using legitimate administrative tools, the actor enumerated Azure DevOps repositories, projects, pipelines, and deployment environments, then created a malicious pipeline authorized against more than 50 resources to deploy a kube agent and collect kubeconfig files. Seven stolen kubeconfig files were added to a repository, and the Atera RMM agent plus the Chisel tunneling utility were installed to establish a reverse tunnel exposing the Kubernetes API server. No malware or software exploits were used; the intrusion relied entirely on legitimate identity and cloud services.

Microsoft Security Blogupdated Sep 30, 11:15 UTC · 14h agofirst Sep 29, 16:00 UTC · 1d agoThreat actor in the wild 3 sources

Chisel

Timeline3 articles

Appears with

Hackers Turn One Compromised Account Into Access to Azure DevOps and Kubernetes

Storm-3068 Hijacks Azure DevOps Pipelines to Steal Kubernetes Credentials After Account Takeover

Beyond source code: A path to the keys to the kingdom

Chisel

Timeline3 articles

Appears with

Hackers Turn One Compromised Account Into Access to Azure DevOps and Kubernetes

Storm-3068 Hijacks Azure DevOps Pipelines to Steal Kubernetes Credentials After Account Takeover

​​Beyond source code: A path to the keys to the kingdom

Beyond source code: A path to the keys to the kingdom