Microsoft has identified a threat actor, tracked as Storm-1977, conducting password spraying attacks against cloud tenants in the education sector throughout the past year. The attacks utilize “AzureChecker.exe,” a Command Line Interface (CLI) tool that has become popular among various threat actors.

According to Microsoft Threat Intelligence, the malicious binary connects to an external server named “sac-auth.nodefunction[.]vip” to retrieve AES-encrypted data containing password spray targets. The tool also processes an “accounts.txt” file containing username and password combinations for the attack.

In one documented compromise, the threat actor exploited a guest account to create a resource group within the victim’s subscription. They subsequently created over 200 containers within this resource group to conduct unauthorized cryptocurrency mining operations.

Microsoft warns that containerized assets face multiple security risks, including:

– Cloud credential compromise leading to cluster takeover
– Exploitation of vulnerable container images
– Attacks on misconfigured management interfaces
– Compromised nodes running vulnerable code

To protect against these threats, organizations should:

– Implement secure container deployment practices
– Monitor for unusual Kubernetes API requests
– Restrict container deployment from untrusted registries
– Verify container images are free from vulnerabilities