[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/ "Cloud Cybersecurity Research") [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/) # Dirty DAG: New Vulnerabilities in Azure Data Factory's Apache Airflow Integration ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 15 min read Related Products [![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/product-category/cortex/ "Cortex")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Ofir Balassiano](https://unit42.paloaltonetworks.com/author/ofir-balassiano/) * [David Orlovsky](https://unit42.paloaltonetworks.com/author/david-orlovsky/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:December 16, 2024 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Apache Airflow](https://unit42.paloaltonetworks.com/tag/apache-airflow/) * [Containers](https://unit42.paloaltonetworks.com/tag/containers/) * [Kubernetes](https://unit42.paloaltonetworks.com/tag/kubernetes/) * [Microsoft Azure](https://unit42.paloaltonetworks.com/tag/microsoft-azure/) * [Microsoft Azure Data Factory](https://unit42.paloaltonetworks.com/tag/microsoft-azure-data-factory/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/azure-data-factory-apache-airflow-vulnerabilities/?pdf=download&lg=en&_wpnonce=48697d1bdd "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/azure-data-factory-apache-airflow-vulnerabilities/?pdf=print&lg=en&_wpnonce=48697d1bdd "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Dirty%20DAG:%20New%20Vulnerabilities%20in%20Azure%20Data%20Factory’s%20Apache%20Airflow%20Integration&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fazure-data-factory-apache-airflow-vulnerabilities%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fazure-data-factory-apache-airflow-vulnerabilities%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fazure-data-factory-apache-airflow-vulnerabilities%2F&title=Dirty%20DAG:%20New%20Vulnerabilities%20in%20Azure%20Data%20Factory’s%20Apache%20Airflow%20Integration "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fazure-data-factory-apache-airflow-vulnerabilities%2F&text=Dirty%20DAG:%20New%20Vulnerabilities%20in%20Azure%20Data%20Factory’s%20Apache%20Airflow%20Integration "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fazure-data-factory-apache-airflow-vulnerabilities%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Dirty%20DAG:%20New%20Vulnerabilities%20in%20Azure%20Data%20Factory’s%20Apache%20Airflow%20Integration%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fazure-data-factory-apache-airflow-vulnerabilities%2F "Share in Mastodon") ## Executive Summary Unit 42 researchers have discovered new security vulnerabilities in the Azure Data Factory Apache Airflow integration. Attackers can exploit these flaws by gaining unauthorized write permissions to a directed acyclic graph (DAG) file or using a compromised service principal. While classified as low severity vulnerabilities by Microsoft, the risk still carries significant potential impact for organizations that use Azure Data Factory. The vulnerabilities can provide attackers with shadow admin control over Azure infrastructure, which could lead to data exfiltration, malware deployment and unauthorized data access. Our research identified multiple vulnerabilities in the Azure Data Factory: * Misconfigured Kubernetes RBAC in Airflow cluster * Misconfigured secret handling of the Azure's internal Geneva service * Weak authentication for Geneva Exploiting these flaws could allow attackers to gain persistent access as shadow administrators over the entire Airflow Azure Kubernetes Service (AKS) cluster. This could enable malicious activities like data exfiltration, malware deployment or covert operations within the cluster. Once inside, attackers can also manipulate Azure's internal Geneva service, which is responsible for managing critical logs and metrics. This could allow attackers to potentially tamper with log data or access other sensitive Azure resources. Although the cluster we used was isolated from other clusters, the fact that the managed Airflow instance used default, non-changeable configurations and the cluster admin role is attached to the Airflow runner caused a security issue. Attackers could manipulate this issue to control the Airflow cluster and related infrastructure. Unit 42 researchers have shared these vulnerabilities with Azure. This issue highlights the importance of carefully managing service permissions to prevent unauthorized access. It also highlights the importance of monitoring the operations of critical third-party services to prevent such access. In this article, we provide an overview of our findings and outline key mitigation strategies to help safeguard cloud environments from similar threats. We will also examine Azure's internal Geneva service, which was used in an Airflow instance with write permissions to specific shared storage accounts. Figure 1 illustrates the Azure Data Factory Airflow infrastructure and the attack process. ![Flowchart demonstrating a cybersecurity attack involving four steps: Step 1 shows pushing a malicious Dag; Step 2 depicts privilege escalation in a Kubernetes system; Step 3 involves data access in a PostgreSQL Server; and Step 4 outlines footprint masquerading in an Azure Tenant scenario.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-407088-137792-1.jpeg) Figure 1. Azure Data Factory and airflow cluster architecture overview. Palo Alto Networks customers are better protected from the threats discussed in this article through the following products: * [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Advanced WildFire](https://docs.paloaltonetworks.com/advanced-wildfire) * [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with the [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration) security subscription If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**Microsoft Azure**](https://unit42.paloaltonetworks.com/tag/microsoft-azure/), **[Containers](https://unit42.paloaltonetworks.com/tag/containers/)** | |----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------| ## Background: Azure Data Factory and Apache Airflow Before we delve into the intricacies of our research on Azure Data Factory and Apache Airflow, it's essential to be aware of the following fundamental concepts. * Data Factory service * [Data Factory](https://learn.microsoft.com/en-us/azure/data-factory/) is an Azure-based data integration service that enables users to manage data pipelines when moving data between different sources. * Airflow service * [Apache Airflow](https://airflow.apache.org/) is an open-source platform that facilitates the scheduling and orchestration of complex workflows. This enables users to manage and schedule tasks as Python-coded DAGs. * Airflow DAG files * DAG files define the workflow structure as Python code. These files specify the sequence in which tasks should be executed, dependencies between tasks and scheduling rules. * Azure Airflow integration with Data Factory * Azure Data Factory offers a [managed Airflow instance](https://learn.microsoft.com/en-us/azure/data-factory/concepts-workflow-orchestration-manager) integration that is deployed as an AKS cluster managed by Azure. ## Gaining Initial Access to the Azure Data Factory Airflow Integration Here's a high-level overview of the flow of an initial attack scenario: * Craft a DAG file that opens a reverse shell to a remote server and runs automatically when imported. * Upload the DAG file to a private GitHub repository connected to the Airflow cluster. Airflow imports and runs the DAG file automatically from the connected Git repository, opening a reverse shell on an Airflow worker. At this point, we gained cluster admin privileges due to a Kubernetes service account that was attached to an Airflow worker. There are two ways for attackers to gain access to and tamper with DAG files: * Gaining write permissions to the storage account containing DAG files by leveraging either a principal account with write permissions or a [shared access signature (SAS)](https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview) token for the files. SAS tokens temporarily grant limited access to DAG files. Once a DAG file is tampered with, it lies dormant until the DAG files are imported by the victim. * Gaining access to a Git repository by leaked credentials or a misconfigured repository. Once this is obtained, the attacker creates a malicious DAG file or modifies an existing one and the directory containing the malicious DAG file is imported automatically. We chose to use leaked credentials from a Git repository as an attack scenario. In this case, once the attacker manipulates the compromised DAG file, Airflow executes it and the attacker gets a reverse shell. For our research, we crafted a malicious DAG file (shown in Figure 2). ![Screenshot of code including import statements and a DAG definition with a bash operator.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-410128-137792-2.png) Figure 2. Reverse shell DAG code. The file ran automatically upon import (as shown in Figure 3) using the schedule\_interval and start\_date parameters. The file's purpose was to run a task that initiates a reverse shell to an external server. ![Screenshot of the Apache Airflow web interface displaying a list of DAGs (Directed Acyclic Graphs) with various statuses indicated by colored circles: green for success and red for failure. The screen shows options for triggering DAGs, refreshing the view, and filtering tasks.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-413022-137792-3.png) Figure 3. Airflow user interface (UI) showing current DAG files with details. Upon running the DAG file, we received the reverse shell connection and could communicate with the instance. The shell we received was running under the context of the Airflow user in a Kubernetes pod shown in Figure 4, which had minimal permissions. ![A computer screen displaying a command prompt where the command "whoami" has been typed and the response underneath is "airflow". The text is in white with a black background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-415656-137792-4.png) Figure 4. Whoami shows a non-root user. However, the pod had public internet access as shown below in Figure 5. ![Screenshot curl displaying various metrics such as DNS server IP address, download and upload speeds, total data spent, and current speed.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-418116-137792-5.png) Figure 5. Curl shows that we have public internet access. While inspecting the pod, we discovered a secret, which was a service account token mounted into the pod file system. Due to the pod's network connectivity, this new access allowed us to download Kubectl (Kubernetes' command-line tool) and to test our permissions as shown in Figure 6. ![Terminal screen showing a command `kubectl auth can-i --list` with the output displaying permissions for Resources and Non-Resource URLs in Kubernetes.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-420672-137792-6.png) Figure 6. Worker pod shows Kubernetes cluster admin privileges. We saw that the service account used by the pod had cluster admin permissions, giving us **full control**over the entire cluster. These permissions included creating pods, accessing Kubernetes secrets (shown in Figure 8) and creating new users. This allowed us to enumerate the cluster environments (shown in Figures 7 and 8) and to gain more insight on how Airflow was deployed. ![Screenshot of a computer terminal displaying the output of the Kubernetes command "kubectl get pods -A", listing several pods and their names.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-423047-137792-7.png) Figure 7. Pods inside the cluster. ![Text-based screenshot depicting the output of a command-line operation to list Kubernetes secrets, showing columns for namespace, name, type, data, and age, with various entries under each heading.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-425386-137792-8.png) Figure 8. Kubernetes cluster secrets relevant to Azure and Airflow. We found secrets related to Airflow, such as the [PostgreSQL](https://airflow.apache.org/docs/apache-airflow/stable/howto/set-up-database.html) backend password and TLS certificates to the Airflow domain. Additionally, we observed an API key to an exposed storage account containing DAG files, shown in Figure 9. ![A terminal screen showing the output of the command `kubectl get secret`, displaying an output snippet including API version and data keys for Azure storage account and a web server secret.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-428163-137792-9.png) Figure 9. Showing secrets that are stored in the cluster. Microsoft's response to the underlying security issue that we reported was to underscore that "the above is isolated to the researcher's cluster alone." Although the cluster is isolated from other clusters, the fact that the managed airflow instance used default, non-changeable configurations and the cluster admin role is attached to the Airflow runner caused a security issue. Attackers could manipulate this issue to control the Airflow cluster and related infrastructure. When enumerating the cluster resources, we understood that a single tenant deployment and the cluster are available only to us. However, to exhaust our options, we further enumerated the cluster and primarily found Airflow pods such as the server backend and web UI, as well as some pods labeled geneva-services. We will delve into the meaning of this label further in a later section ([Exploiting Geneva -- Azure Internal Service)](#post-137792-_tb3lf9qfml6) to explore the potential impact. ## Container Escape: AKS Gaining Access to Host Once we had cluster admin permissions, we could perform [escalation and cluster takeover](https://unit42.paloaltonetworks.com/kubernetes-privilege-escalation/) by deploying a privileged pod and breaking out onto the underlying node as shown in Figure 10. The privileged pod had shared host resources and the host's root file system as a mounted volume. ![Command line interface displaying Kubernetes commands for a privileged pod test and entering a new root directory.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/F10.png) Figure 10. Accessing the host disk with a privileged pod. At this point, we gained access to the host virtual machine (VM) with **root access.** From the uname command output (shown in Figure 11), we understood that we were running in the scope of a VM scale set (Azure VM scaling solution), and that the Airflow cluster was running on top of that. ![A command line interface displaying a Linux kernel version, the text indicates it's running on Microsoft Azure, with specific version and build details.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-433365-137792-11.png) Figure 11. Uname command revealed information about a host. Figure 12 depicts the container breakout flow. ![Flowchart depicting a cybersecurity attack using containers and pods. From left to right: "Malicious DAG" symbol leads to "Run DAG," which connects to "Create Pod." This flows into a symbol labeled "Privileged Pod," then to "Chroot Host," and culminates with "Host Takeover." The symbols are connected by arrows indicating sequence.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-435825-137792-12.png) Figure 12. Chain of events leading to host takeover. ### Full Cluster Control Impact Having a high-privileged service account connected to the Airflow runner pod enables control to the node itself and presents attackers with multiple opportunities to extend their actions. Here are two examples of such opportunities: * **Shadow workloads through shadow administrator access:** An attacker could create another service account role with cluster admin privileges. The account could have full access to create pods and other resources inside the cluster that could cause damage, such as creating pods that serve malware or cryptomining without the victims' awareness. Figure 13 illustrates such a scenario. ![Diagram of an Airflow AKS Cluster showing various nodes. The nodes are labeled as Cluster Admin, Airflow-1, Airflow-2, Airflow-3, Attacker Cluster Admin, Malicious Workload, and Crypto Miner. Each node type is represented in either blue or red, with distinct icons for administrative and operational roles.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-439196-137792-13.png) Figure 13. An attacker can covertly take over the cluster and steal data sources from Airflow. * **Data exfiltration:** The attacker could gain persistence in the cluster through workload creation, actively leaking data that is connected to the Airflow environment over time as shown in Figure 14. Due to the level of access, the attacker could obtain credential information related to current and future data sources connected to the Airflow environment, such as storage accounts and SQL servers. ![Diagram showing an Airflow AKS Cluster with components: Cluster Admin, Cluster Secrets, Airflow-Backend, and their connection to Data Sources, which are being hijacked by an attacker cluster admin.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-442137-137792-14.png) Figure 14. An attacker can hijack the cluster for malicious uses. ## Discovering Assets in the New Azure Environment ### From Root to Azure Identity After getting root access on the host, we were able to start with the discovery process of our new environment. First, we used the Instance Metadata Service (IMDS) endpoint to grab the machine authentication token. The IMDS endpoint provides information about currently running virtual machine (VM) instances. This can be used to manage and configure VMs, including getting an authentication token for managed identities assigned to the VM. IMDS is accessed via an exposed endpoint only from the machine itself. #### WireServer Azure's WireServer is another endpoint that can be accessed from within any Azure VM that in some scenarios exposes sensitive metadata and configuration information. WireServer facilitates communication between Azure VMs and the Azure environment. It does so by enabling the delivery of configuration information and management tasks from Azure to the VMs, ensuring that they operate in accordance with the user's specifications and Azure's infrastructure requirements. The WireServer is accessed via an HTTP endpoint, which uses the IP address [168.63.129\[.\]16](https://learn.microsoft.com/en-us/azure/virtual-network/what-is-ip-address-168-63-129-16)\*\*.\*\*This endpoint can be queried to retrieve information about VM extensions and sensitive data. By using the IMDS and WireServer endpoints, we discovered that two managed identities were connected to the Virtual Machine Scale Set (VMSS), a group of load-balanced VMs. We used the WireServer to obtain further information regarding the instance. The following activities formed our high-level workflow: * Querying the WireServer endpoint to discover managed identities * Querying IMDS to get an access token for each identity * Enumerating the Azure environment * Querying the Microsoft.Authorization/roleAssignments API call to discover custom roles First, we queried the WireServer endpoint to see VM extension information and general information with the command shown in Figure 15. ![Terminal screenshot displaying a curl command with user-agent and version specified in the command.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/F15.png) Figure 15. WireServer API call. From this query, we got the following output shown in Figure 16. The output shows the virtual machine state, different configurations and information that can be gathered about the machine. ![Screenshot of a computer screen displaying code. The text includes elements like machine details, host information, and IP addresses. Some of the information has been redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/F16.png) Figure 16. WireServer API output. After that, we did the same for the extension endpoint shown in Figure 17, with the following command: * hXXp://168.63.129\[.\]16:80/machine/\-6f7490f0cc7b/\-ab78-81795f77ad10.\_aks-agentpool-30850510-vmss\_2?comp=config;type=extensionsConfig;incarnation=2 We received the response shown in Figure 17. ![Screenshot of code with highlighted sections indicating the "ClientId" and "TenantID" values. Two lines are highlighted in green and two in red.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/F17.png) Figure 17. WireServer VM identity information. We can see two user-assigned managed identities that are created for the cluster: * httpapplicationrouting-\ * \-agentpool For each identity, there is an attached attribute IdentityClientId that is used when querying the IMDS endpoint to obtain its relevant access token. Figure 18 depicts how to query the IMDS endpoint for a specific user-assigned managed identity token.*![](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-452007-137792-18.png)* ![Screenshot of a command line interface using a curl request to the Azure API, including parameters for identity, client ID, resource URL, and metadata settings.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/F18.png) Figure 18. IMDS API call to retrieve specific managed identity credentials. From our query, we received the token shown in Figure 19. ![Code snippet displaying an access token response from Microsoft Azure, including keys for client ID, expiration times, and token type.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/F19.png) Figure 19. Azure access token for relevant identity. ### The Discovery Process in the New Azure Environment At this point, we started analyzing the Azure subscription we were running on by using the new identity tokens. We found some resources we could access, and by enumerating them in the environment, we could better understand our options. A dedicated resource group for each Airflow deployment is created when the AKS is deployed. A special HTTP application-routing add-on for Kubernetes is added that can create records in the DNS zone resource and enable network routing to the AKS instance. This add-on will soon be retired and it is not suitable for production usage, as described in this article on [Azure.AKS.HTTPAppRouting](https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AKS.HttpAppRouting/). The add-on creates the HTTPApplicationRouting identity with a Reader role (shown in Figure 20) over the resource group and a Contributor role over the DNS zone, which enabled us to modify the DNS service attached to the cluster. ![Diagram showing a Microsoft Azure internal subscription, including an HTTPApplicationRouting Managed Zone connected to a Unique Client Resource Group and a VM scale set with several virtual machines labeled VM1 through VMN within an AKS cluster environment. The layout includes icons representing network structures and text annotations that explain the roles and components of the Azure services.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-457029-137792-20.jpeg) Figure 20. Cloud infrastructure topology of Airflow deployment. At this point, several Azure-managed resources were accessible to us. Initially, this was just the storage account where the DAG files were imported and the DNS zone to which we had contributor access and could modify records. Additionally, custom role definitions inside Azure's tenant with the keyword Geneva (shown in Figure 21) caught our eye. This was notable because the cluster had pods labeled geneva-service-xxxx (shown previously in Figure 7). ![Screenshot of a configuration file for Azure role-based access control, including definitions for role permissions and descriptions.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-460028-137792-21.png) Figure 21. Custom roles regarding Geneva, each with different permissions. The role definitions prompted questions about the nature of these pods, as well as the purpose of Geneva and its application. When we inspected the role's permissions, it showed us what type of capabilities Geneva could have. We found that it was able to manage multiple types of Azure resources, such as event hubs, subscription management and storage. Permissions such as Microsoft.Storage/storageAccounts/listKeys/action or Microsoft.Resources/subscriptions/read and Microsoft.EventHub/register/action (which is used to register an EventHub provider) show Geneva's potential capabilities. These high-privileged custom roles led us to inspect the pods in our cluster and their runtime behavior. Disclosing internal role definition information and enumerating the cluster's cloud environment could help attackers better understand what they can and can't do. Furthermore, attackers could use the access tokens to modify the DNS zone resource and access storage accounts related to Airflow. ## Exploiting Geneva -- Azure Internal Service Upon encountering Azure resources and pods regarding Geneva in our cluster, we assumed Geneva was related to gathering analytics data. We wanted to explore this to better understand this internal Azure system. Figure 22 shows which pods were in the AKS cluster. ![Text displaying three lines of code, each beginning with "geneva-services" followed by a unique suffix: cw98t, dz6jc, pjd9h.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/F22.png) Figure 22. Geneva pods in the Airflow cluster. Geneva service is an internal Azure service that monitors and gathers analytical data from Microsoft's infrastructure on a large scale. The impact of any security misconfigurations in this service can be detrimental. There isn't much information online about Geneva, other than on a small number of Microsoft forums for in-house developers. As such, we started analyzing the runtime behavior of the pods to gain a better understanding of the service. The following activities formed our high-level workflow: * Inspecting Geneva pods and the attached secrets in our cluster * Performing a runtime and static analysis of pods, as well as the certificate and key in the secrets * Discovering internal API endpoints used by pods * Leveraging the API endpoints to disclose multiple Azure resources * Exploiting read/write privileges on multi-tenant shared resources ### Geneva Service Pod Inspection Inspecting the pods revealed that they used the secrets azsecpack-auth\*\*,\*\* mdm-authandmdsm-auth (shown in Figure 23). ![Text-based screenshot depicting the output of a command-line operation to list Kubernetes secrets, showing columns for namespace, name, type, data, and age, with various entries under each heading.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-465270-137792-23.png) Figure 23. Secret list inside the cluster. Note the auth secrets. We saw processes inside the pod that ran the Azure mdsd monitoring agent (shown in Figure 24). ![A screenshot of a terminal with a process list, displayed using the "ps ef" command. The list includes columns for UID, PID, PPID, start time, and more.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-467735-137792-24.png) Figure 24. Geneva service pods running processes. At this point, we assumed that the mdsd agent collects metrics such as cluster health, pod status and current live processes. It then sends them to the Geneva service. Moreover, a binary that we found related to mdsd used a certificate and a key as a type of authentication. Figure 25 shows the different flags the binary used. ![A screenshot of a command-line interface displaying a list of allowed arguments for a utility, which includes commands related to help, monitoring environment, namespace, identity type, and configuration among others, with specific examples provided at the bottom.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-470440-137792-25.png) Figure 25. Non-standard mdsd utility binary in the pod that is used for debugging. The azsecpack-auth, mdm-auth and mdsm-auth secrets contained a certificate and a private key shown in Figure 26.![](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-472897-137792-26.png) ![A screenshot displaying commands and outputs on a computer terminal, including interactions with Kubernetes showing secret management commands. The visible text features keys and metadata.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/F26.png) Figure 26. Certificate that was stored as a secret in the Airflow cluster. Using the OpenSSL command-line interface (CLI), we inspected the certificate with the following command: * openssl x509 -in certificate.crt -text -noout Figure 27 shows the details we received. ![Screenshot of a digital certificate displaying various encryption and authentication details including serial number, issuer, validity dates, and other security algorithms. Some information is redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/F27.png) Figure 27. OpenSSL information about certificate identity. The decoded certificate in Figure 27 above shows that the subject CN (which is the domain name protected by the certificate) was gcs.svc.datafactory.azure.com. When we inspected the same secrets in other Airflow deployments, we saw the same subject CN used across all deployments. In addition, all Airflow deployments use the same certificate to authenticate to the Geneva service. There is no separation between different Airflow deployments. ### Discovering Internal API Endpoints At this point, we wanted to better understand Geneva's mechanism through the mdsd binary. We reverse engineered the binaries to reveal multiple API endpoints that mdsd monitoring agents used to communicate with Geneva. Figures 28 and Figure 29 show snippets from the reverse engineering process. ![Screenshot of a computer screen displaying various lines of coding and configuration paths related to a monitoring account, which are highlighted in red boxes.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-478259-137792-28.png) Figure 28. API endpoints in binary strings. ![A screenshot of code from a computer program displayed in color-coded text on a black background. One line in the upper section is highlighted in red.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-480883-137792-29.png) Figure 29. REST API URL construction inside binary. In the reverse engineering process, we were able to reconstruct API calls to Geneva. And by using the certificate and key that we found earlier, we could authenticate to Geneva and call the API endpoints that we had found. The API endpoints we found disclosed more Azure resources. Some gave us write access to storage accounts, event hubs and other internal Azure systems. Figure 30 illustrates the access level we achieved. ![Illustration of a data involving an Airflow cluster named Geneva, which interacts with Databricks Hub and Storage Accounts through read and write operations using HTTP Rest and Geneva services.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/word-image-483710-137792-30.jpeg) Figure 30. Geneva service in our cluster with access to different Azure resources. ## Geneva's Aftermath: The Impact on Azure's Ecosystem ### Internal Data Assets Exposed Using the above endpoints and keys, we found multiple SAS tokens for data assets. Figures 31 and 32 show examples of the tokens we found. ![Screenshot of code with highlighted sections showing resource names as "BlobService" and "TableService." Some information has been redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/F31.png) Figure 31. Storage accounts keys found. ![Screenshot of a code snippet with some redacted text, mentioning URLs related to 'onedrive.windows.net', and showing key-value pairs for data fields including 'Session' and 'IPAddress'.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/F32.png) Figure 32. Event hub keys found. We also found we weren't restricted in writing to the datastores. Another notable API call we found disclosed entities such as users or machines that had access to Geneva (shown in Figure 33). ![A screenshot displaying code related to Microsoft Cloud permissions configuration. The repeated line of text includes references to identity, metrics, and user permissions within the Microsoft ecosystem. Some info is redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/F33.png) Figure 33. Information disclosed by an API regarding identities that use Geneva. ### Log Manipulation Attack Scenario By using the exposed SAS tokens for the event hubs, we could exploit and write arbitrary information to them. This means a sophisticated attacker could modify a vulnerable Airflow environment. For example, an attacker could create new pods and new service accounts. They could also apply changes to the cluster nodes themselves and then send fake logs to Geneva without raising an alarm. We used the code shown in Figure 34 to demonstrate this. ![A screenshot of code in a text editor. Specific AWS services are visible. The code includes function definitions, event handling, and print statements, all written on a dark themed background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/12/F34.png) Figure 34. Proof of concept code that demonstrated the impact of generating and sending crafted logs to Azure's central log service. ## Conclusion Our research identified multiple vulnerabilities in the Azure Data Factory: * Misconfigured Kubernetes RBAC in Airflow cluster * Misconfigured secret handling of the Geneva service * Weak authentication for Geneva These vulnerabilities could enable attackers to escape from their pods, gain unauthorized administrative control over clusters and access Azure's internal services (Geneva). Attackers could exploit the vulnerabilities through compromised service principals or unauthorized modifications to DAG files. This could enable attackers to become shadow administrators and to gain full control over managed Airflow deployments on a single tenant base. We would like to thank Microsoft MSRC for helping to resolve these issues. Adversaries have moved beyond basic tactics to more sophisticated service-specific attacks. Therefore, it is essential to adopt a comprehensive protection strategy that goes beyond simply safeguarding the cluster's perimeter. This strategy should include: * Securing permissions and configurations within the environment itself, and using policy and audit engines to help detect and prevent future incidents (both within the cluster and in the cloud) * Safeguarding sensitive data assets that interact with different services in the cloud, to understand which data is being processed with which data service Palo Alto Networks customers are better protected from the threats discussed above through the following products: * [Advanced WildFire](https://www.paloaltonetworks.com/products/secure-the-network/wildfire) cloud-delivered malware analysis service accurately identifies known samples as malicious * [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) with the [Advanced Threat Prevention](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration) security subscription can help block the attacks with best practices via the following Threat Prevention signature: [54790](https://threatvault.paloaltonetworks.com/?query=54790) * [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) and [XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) offer protections relevant to the threat described such as through the reverse shell module for Behavioral Threat Protection. If you think you may have been compromised or have an urgent matter, get in touch with the[Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America Toll-Free: 866.486.4842 (866.4.UNIT42) * EMEA: +31.20.299.3130 * APAC: +65.6983.8730 * Japan: +81.50.1790.0200 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). Back to top ### Tags * [Apache Airflow](https://unit42.paloaltonetworks.com/tag/apache-airflow/ "Apache Airflow") * [Containers](https://unit42.paloaltonetworks.com/tag/containers/ "Containers") * [Kubernetes](https://unit42.paloaltonetworks.com/tag/kubernetes/ "Kubernetes") * [Microsoft Azure](https://unit42.paloaltonetworks.com/tag/microsoft-azure/ "Microsoft Azure") * [Microsoft Azure Data Factory](https://unit42.paloaltonetworks.com/tag/microsoft-azure-data-factory/ "Microsoft Azure Data Factory") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Crypted Hearts: Exposing the HeartCrypt Packer-as-a-Service Operation](https://unit42.paloaltonetworks.com/packer-as-a-service-heartcrypt-malware/ "Crypted Hearts: Exposing the HeartCrypt Packer-as-a-Service Operation") ### Table of Contents * ### Related Articles * [The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration](https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/ "article - table of contents") * [Paved With Intent: ROADtools and Nation-State Tactics in the Cloud](https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/ "article - table of contents") * [Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years](https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/ "article - table of contents") ## Related Cloud Cybersecurity Research Resources ![Pictorial representation of bucket hijacking technique for cloud data exfiltration. Digital illustration of Europe map highlighting network connections and nodes, depicted as glowing points and lines on a dark blue background, emphasizing major cities and connectivity across the continent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/09_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) June 22, 2026 [#### The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration](https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/) * [AWS](https://unit42.paloaltonetworks.com/tag/aws/ "AWS") * [Bucket hijacking](https://unit42.paloaltonetworks.com/tag/bucket-hijacking/ "bucket hijacking") * [Cloud data exfiltration](https://unit42.paloaltonetworks.com/tag/cloud-data-exfiltration/ "cloud data exfiltration") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/ "The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration") ![Pictorial representation of Vertex AI model uploads. Close-up view of a digital wall displaying various glowing icons, representing a high-tech network interface.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/AdobeStock_1270203474-1-786x354.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) June 16, 2026 [#### Pickle in the Middle -- Hijacking Vertex AI Model Uploads for Cross-Tenant RCE](https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/) * [Bucket squatting](https://unit42.paloaltonetworks.com/tag/bucket-squatting/ "bucket squatting") * [Google Cloud](https://unit42.paloaltonetworks.com/tag/google-cloud/ "Google Cloud") * [Joblib](https://unit42.paloaltonetworks.com/tag/joblib/ "joblib") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/ "Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE") ![Pictorial representation of Cloud Logging services for defense evasion. A vibrant digital illustration depicting a glowing, neon blue cloud symbol positioned over a circuit board landscape. The cloud symbolizes cloud computing technology, and the landscape features intricate electronic circuits with glowing lines and nodes, suggesting high-tech data transfer and connectivity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/11_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) June 9, 2026 [#### Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility](https://unit42.paloaltonetworks.com/cloud-logging-defense-evasion/) * [AWS CloudTrail](https://unit42.paloaltonetworks.com/tag/aws-cloudtrail/ "AWS CloudTrail") * [Cloud logging](https://unit42.paloaltonetworks.com/tag/cloud-logging/ "cloud logging") * [Defense evasion](https://unit42.paloaltonetworks.com/tag/defense-evasion/ "defense evasion") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cloud-logging-defense-evasion/ "Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility") ![Pictorial representation of ROADtools framework in the cloud. An Asian man wearing glasses sits in front of a computer screen. Reflecting in the glasses are lines indicating analysis. Bright blue city lights illuminate the rest of the image.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/10_Cloud_cybersecurity_research_Overview_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) May 22, 2026 [#### Paved With Intent: ROADtools and Nation-State Tactics in the Cloud](https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/) * [Curious Serpens](https://unit42.paloaltonetworks.com/tag/curious-serpens/ "Curious Serpens") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Azure](https://unit42.paloaltonetworks.com/tag/microsoft-azure/ "Microsoft Azure") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/ "Paved With Intent: ROADtools and Nation-State Tactics in the Cloud") ![Pictorial representation of autonomous AI attack in cloud environments. Digital illustration of a glowing blue brain connected to a network of lines and lights.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/12_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) April 23, 2026 [#### Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System](https://unit42.paloaltonetworks.com/autonomous-ai-cloud-attacks/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Cloud](https://unit42.paloaltonetworks.com/tag/cloud/ "Cloud") * [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/autonomous-ai-cloud-attacks/ "Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System") ![Pictorial representation of passwordless authentication. Futuristic cityscape with skyscrapers surrounded by glowing, neon-lit pathways and digital clouds. The sky is vibrant with pink and orange hues, giving a surreal, cyberpunk aesthetic.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/02_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) March 23, 2026 [#### Google Cloud Authenticator: The Hidden Mechanisms of Passwordless Authentication](https://unit42.paloaltonetworks.com/passwordless-authentication/) * [Google](https://unit42.paloaltonetworks.com/tag/google/ "Google") * [Google authenticator](https://unit42.paloaltonetworks.com/tag/google-authenticator/ "google authenticator") * [Google Chrome](https://unit42.paloaltonetworks.com/tag/google-chrome/ "Google Chrome") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/passwordless-authentication/ "Google Cloud Authenticator: The Hidden Mechanisms of Passwordless Authentication") ![Close-up of a black woman with glasses examining colorful computer code on a screen. The scene is illuminated by various lights, creating a focused and analytical atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/13_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) February 6, 2026 [#### Novel Technique to Detect Cloud Threat Actor Operations](https://unit42.paloaltonetworks.com/tracking-threat-groups-through-cloud-logging/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [IAM](https://unit42.paloaltonetworks.com/tag/iam/ "IAM") * [MITRE](https://unit42.paloaltonetworks.com/tag/mitre/ "MITRE") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/tracking-threat-groups-through-cloud-logging/ "Novel Technique to Detect Cloud Threat Actor Operations") ![Pictorial representation of Azure OpenAI DNS resolution issue. Futuristic cityscape illustration with luminous structures and floating cloud elements, showcasing advanced technology and a dynamic, digitally enhanced environment.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/02_DNS_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) January 20, 2026 [#### DNS OverDoS: Are Private Endpoints Too Private?](https://unit42.paloaltonetworks.com/dos-attacks-and-azure-private-endpoint/) * [Microsoft Azure](https://unit42.paloaltonetworks.com/tag/microsoft-azure/ "Microsoft Azure") * [Networking](https://unit42.paloaltonetworks.com/tag/networking/ "networking") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/dos-attacks-and-azure-private-endpoint/ "DNS OverDoS: Are Private Endpoints Too Private?") ![Pictorial representation of cloud discovery with AzureHound. A digital representation of a cloud composed of blue light particles, superimposed over a blurred background of server racks in a data center.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/08_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 24, 2025 [#### Cloud Discovery With AzureHound](https://unit42.paloaltonetworks.com/threat-actor-misuse-of-azurehound/) * [Control plane](https://unit42.paloaltonetworks.com/tag/control-plane/ "control plane") * [Curious Serpens](https://unit42.paloaltonetworks.com/tag/curious-serpens/ "Curious Serpens") * [Data plane](https://unit42.paloaltonetworks.com/tag/data-plane/ "data plane") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-actor-misuse-of-azurehound/ "Cloud Discovery With AzureHound") ![Pictorial representation of a gift card fraud campaign. A glowing skull and crossbones on a circuit board.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/10/07_Cybercrime_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 22, 2025 [#### Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign](https://unit42.paloaltonetworks.com/cloud-based-gift-card-fraud-campaign/) * [CL‑CRI‑1032](https://unit42.paloaltonetworks.com/tag/cl-cri-1032/ "CL‑CRI‑1032") * [Microsoft](https://unit42.paloaltonetworks.com/tag/microsoft/ "Microsoft") * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cloud-based-gift-card-fraud-campaign/ "Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)