Plan
archived
Storm-3068: Identity Compromise to Full Cloud Access via CI/CD
- Engineer — Plan: Storm-3068’s attack path — compromised identity → pipeline access → cloud escalation — directly targets stacks engineers own. Review CI/CD pipeline service account permissions, OIDC trust configurations, and cloud role bindings against the TTPs described in the post this quarter.
- SOC/IR — Plan: Named actor campaign with a documented identity-to-cloud-pivot chain offers a concrete detection opportunity. Extract Storm-3068 TTPs from the post and build or tune detections for unusual identity federation events, pipeline credential usage, and lateral movement from CI runners into cloud APIs.
- Leader — Learn: The campaign illustrates how a single compromised developer identity can cascade into full cloud environment access — useful framing for board-level conversations about pipeline security investment and the risk of over-permissioned CI/CD service accounts.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.