Beyond Source Code: A Path to the Keys to the Kingdom
Microsoft, Tuesday, September 29th, 2026
Microsoft DART details how Storm-3068 turned a password reset into access to Azure DevOps pipelines and Kubernetes resources.
In its latest Cyberattack Series report, Microsoft's Detection and Response Team describes an investigation into Storm-3068, a threat actor that turned a successful self-service password reset into access to Azure DevOps, development pipelines and Kubernetes.
Using legitimate identity and cloud services rather than malware or exploits, the actor established persistence, enumerated repositories and obtained credentials that opened a path into connected cloud infrastructure.
The report offers guidance on defending identities, pipelines and cloud resources.