One Password Reset, Many Doors: How Storm-3068 Turned a Single Account Into Cloud and DevOps Access

Microsoft's Detection and Response Team (DART) has published a case study on Storm-3068, a threat actor that expanded a single compromised identity into an organisation's development and cloud environments. The intrusion began when the actor gained access to a user account through a self-service password reset process. It then took full control of the identity by registering its own authentication methods, which gave it persistent access.

From there, the actor focused on Azure DevOps. Using legitimate administrative tools and automated scripts, it enumerated repositories, projects, pipelines and deployment environments. It did not rely on malware or software exploits. Instead, it used legitimate identity and cloud services, and in doing so obtained credentials that opened a path into connected cloud infrastructure, including Kubernetes resources.

Azure DevOps was a high-value target because it sits where identity, software development and cloud operations meet. By mapping trusted deployment paths and connected resources, the actor identified ways to expand beyond the initial compromise. Microsoft says the case shows a growing challenge for defenders: when identities, source code, pipelines and production environments are tightly linked, one account compromise can lead to much broader access across the organisation.