Storm-1977 targets education sector with password spraying, Microsoft warns

Microsoft Threat Intelligence attributes a year-long password-spraying campaign against education-sector cloud tenants to a threat actor tracked as Storm-1977. The actor used AzureChecker.exe to download AES-encrypted target lists and validate credentials (including supplied accounts.txt), leading to at least one breach where a guest account created a resource group and more than 200 containers for cryptomining; the report warns of broader risks to containerized environments and lists common threats and mitigations.