Browse public community intelligence reports, source analysis, and threat research.
9 intel reports
Threat actors Storm-3121 and Storm-3032 utilize passkey-themed social engineering and AiTM phishing to compromise Microsoft cloud identities for automated data exfiltration via Microsoft Graph.
Storm-3168 (JADEPUFFER) utilizes compromised service principals to automate resource discovery, destruction, and credential theft across Microsoft Azure environments.
ExfilSquad is a data extortion group targeting organizations by exploiting misconfigured Microsoft Power Pages portals to exfiltrate Dataverse records via public APIs.
The threat actor Storm-2755, also known as Payroll Pirates, uses adversary-in-the-middle (AiTM) phishing and residential proxies to compromise Microsoft 365 accounts for targeted financial data collection.
The threat actor JINX-0163, operating as FulcrumSec, targets cloud-native environments using exposed credentials and RCE vulnerabilities to exfiltrate data for ransom.
Vulnerabilities in Microsoft Graph API allow attackers to bypass Conditional Access policies and escalate token privileges to enumerate entire Entra ID tenants using compromised credentials.
Midnight Blizzard leverages compromised Entra ID Agent Blueprints to pivot between tenants and escalate to Global Administrator using Temporary Access Passes.
The TeamPCP threat group is conducting a large-scale supply chain campaign using the 'Mini Shai-Hulud' worm to compromise npm packages, steal CI/CD and cloud credentials, and autonomously propagate.
Nation-state actors including Cloaked Ursa and Curious Serpens are weaponizing the ROADtools framework to enumerate Entra ID environments and maintain persistence through rogue device registration.
