​​Beyond source code: A path to the keys to the kingdom

Microsoft DART investigated an intrusion by Storm-3068 that began with a self-service password reset compromise and escalated into Azure DevOps and cloud environments; the actor modified pipelines to harvest Kubernetes credentials, deployed Atera and Chisel to establish remote access and reverse tunnels, and added stolen kubeconfig files to a repository. The report outlines DART's investigation and remediation actions and provides recommendations such as monitoring password reset activity, enforcing phishing-resistant MFA, requiring code-change approvals, restricting pipeline permissions, and applying least-privilege access across identities and cloud resources.