Storm-3068: Identity Compromise to Full Cloud Access via CI/CD

Tue, 29 Sep 2026 16:53:02 +0000

Engineer — Plan: Storm-3068’s attack path — compromised identity → pipeline access → cloud escalation — directly targets stacks engineers own. Review CI/CD pipeline service account permissions, OIDC trust configurations, and cloud role bindings against the TTPs described in the post this quarter.
SOC/IR — Plan: Named actor campaign with a documented identity-to-cloud-pivot chain offers a concrete detection opportunity. Extract Storm-3068 TTPs from the post and build or tune detections for unusual identity federation events, pipeline credential usage, and lateral movement from CI runners into cloud APIs.
Leader — Learn: The campaign illustrates how a single compromised developer identity can cascade into full cloud environment access — useful framing for board-level conversations about pipeline security investment and the risk of over-permissioned CI/CD service accounts.

Identity-Compromise on CuraSec