Password spray attack leads to containers being used for cryptomining (Campaign)
ID: ef636759-e395-5b78-b77c-fbab34c2b445
STIX ID: report--ef636759-e395-5b78-b77c-fbab34c2b445
Feed Name: Wiz Cloud Threat Landscape
Date Published: 2025-04-23
Date Updated: 2026-05-01
Author: [email protected] (Wiz Threat Research)
Microsoft observed AzureChecker (Storm-1977) conducting password-spray attacks against education-sector cloud tenants using AzureChecker.exe and credential lists (including an encrypted file and accounts.txt). One successful compromise via a guest account resulted in the creation of a resource group with over 200 containers repurposed for cryptomining, illustrating active exploitation of cloud accounts and resource abuse.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.