Storm-1977 targets education sector with password spraying, Microsoft warns
April 27, 2025 
Microsoft warns that threat actor Storm-1977 is behind password spraying attacks against cloud tenants in the education sector.
Over the past year, Microsoft Threat Intelligence researchers observed a threat actor, tracked as Storm-1977, using AzureChecker.exe to launch password spray attacks against cloud tenants in the education sector. AzureChecker.exe connected to sac-auth[.]nodefunction[.]vip to download AES-encrypted data, which, once decrypted, revealed password spray targets. It also accepted an accounts.txt file with username and password pairs, using both datasets to validate credentials against target tenants. Microsoft observed a successful account breach where a threat actor used a guest account to create a resource group and over 200 containers for cryptomining.
“In the past year, Microsoft Threat Intelligence has observed AzureChecker threats (tracked as Storm-1977) launching password spray attacks against cloud tenants in the education sector.” reads the report published by Microsoft. “The attack involves the use of AzureChecker.exe, a Command Line Interface (CLI) tool that is being used by a wide range of threat actors.”
Microsoft pointed out that the containerized assets like Kubernetes clusters, workloads, and registries face many risks.
To secure them, organizations must protect containers, code, dependencies, CI/CD pipelines, and runtime environments. Key threats include: 1) Compromised accounts from leaked credentials; 2) Vulnerable or misconfigured images; 3) Environment misconfigurations exposing APIs; 4) App-level attacks like SQL injection and XSS; 5) Node-level attacks and pod escapes; 6) Unauthorized traffic due to insecure networking.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Storm-1977)