Tuesday , April 1 2025
Azure

Microsoft Uncovers Hackers Selling Illegal Azure AI Access

Microsoft has filed an amended complaint in recent civil litigation, naming the main developers of malicious tools that bypass the safeguards of generative AI services, including its Azure OpenAI Service. The legal action aims to stop their actions, dismantle their illegal operation, and deter others from misusing AI technology.

The individuals involved are: (1) Arian Yadegarnia (“Fiz”) from Iran, (2) Alan Krysiak (“Drago”) from the UK, (3) Ricky Yuen (“cg-dot”) from Hong Kong, and (4) Phát Phùng Tấn (“Asakuri”) from Vietnam. They are part of a global cybercrime network called Storm-2139, tracked by Microsoft. This group unlawfully accessed accounts of certain generative AI services by using exposed customer credentials. They then modified these services and resold access to others while providing instructions for generating harmful and illicit content, including non-consensual intimate images of celebrities.

CVE-2025-1268
Patch urgently! Canon Fixes Critical Printer Driver Flaw

Canon has announced a critical security vulnerability, CVE-2025-1268, in printer drivers for its production printers, multifunction printers, and laser printers....
Read More
CVE-2025-1268  Patch urgently! Canon Fixes Critical Printer Driver Flaw

Within Minute, RamiGPT To Escalate Privilege Gaining Root Access

RamiGPT is an AI security tool that targets root accounts. Using PwnTools and OpwnAI, it quickly navigated privilege escalation scenarios...
Read More
Within Minute, RamiGPT To Escalate Privilege Gaining Root Access

Australian fintech database exposed in 27000 records

Cybersecurity researcher Jeremiah Fowler recently revealed a sensitive data exposure involving the Australian fintech company Vroom by YouX, previously known...
Read More
Australian fintech database exposed in 27000 records

Over 200 Million Info Leaked Online Allegedly Belonging to X

Safety Detectives' Cybersecurity Team found a forum post where a threat actor shared a .CSV file with over 200 million...
Read More
Over 200 Million Info Leaked Online Allegedly Belonging to X

FBI investigating cyberattack at Oracle, Bloomberg News reports

The Federal Bureau of Investigation (FBI) is probing the cyberattack at Oracle (ORCL.N), opens new tab that has led to...
Read More
FBI investigating cyberattack at Oracle, Bloomberg News reports

OpenAI Offering $100K Bounties for Critical Vulns

OpenAI has increased its maximum bug bounty payout to $100,000, up from $20,000, to encourage the discovery of critical vulnerabilities...
Read More
OpenAI Offering $100K Bounties for Critical Vulns

Splunk Alert User RCE and Data Leak Vulns

Splunk has released a security advisory about critical vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. These issues could lead...
Read More
Splunk Alert User RCE and Data Leak Vulns

CIRT alert Situational Awareness for Eid Holidays

As the Eid holidays near, cybercriminals may try to take advantage of weakened security during this time. The CTI unit...
Read More
CIRT alert Situational Awareness for Eid Holidays

Cyberattack on Malaysian airports: PM rejected $10 million ransom

Operations at Kuala Lumpur International Airport (KLIA) were unaffected by a cyber attack in which hackers demanded US$10 million (S$13.4...
Read More
Cyberattack on Malaysian airports: PM rejected $10 million ransom

Micropatches released for Windows zero-day leaking NTLM hashes

Unofficial patches are available for a new Windows zero-day vulnerability that allows remote attackers to steal NTLM credentials by deceiving...
Read More
Micropatches released for Windows zero-day leaking NTLM hashes

This activity violates our generative AI services’ terms of use and involves intentionally bypassing our safeguards. We will not name specific celebrities to protect their privacy and have omitted synthetic images and prompts from our filings to prevent the spread of harmful content.

Storm-2139 is a global network of creators, providers, and end users. In December 2024, Microsoft’s Digital Crimes Unit (DCU) sued 10 unidentified individuals in Virginia for violating U.S. law and Microsoft’s policies. This lawsuit allowed us to learn more about the criminal operations involved.

Storm-2139 has three main categories: creators, providers, and users. Creators make the illegal tools for abusing AI services. Providers customize and distribute these tools to users, often with different service levels and payment options. Users then employ these tools to create harmful synthetic content, usually involving celebrities and sexual imagery.

Microsoft’s investigation has identified several personas, including four defendants. Two actors in the U.S., from Illinois and Florida, are known but their identities are kept confidential to protect ongoing criminal investigations. Microsoft is preparing to notify law enforcement in the U.S. and abroad.

Cybercriminals react to Microsoft’s website seizure and court filing.

The Court issued a temporary restraining order and preliminary injunction allowing Microsoft to seize a key website used in a criminal operation, disrupting the group’s services. The seizure and unsealing of legal documents in January prompted immediate reactions, leading some group members to blame each other. We noted discussions about the lawsuit on their monitored channels, speculating about the identities of the “John Does” and possible outcomes.

The discussion board features two posts. The first humorously claims that “fiz” leaked the name “Arian,” not “Arianna” or “Ariel.” The second post includes a LinkedIn URL containing “arian,” implying a link to the first post. Both are from an anonymous user with timestamps.

Screenshot of online chatter discussing “Fiz’s” real name.

Some members in these channels “doxed” Microsoft’s attorney by sharing their names, personal details, and photos. Doxing can lead to serious issues like identity theft and harassment.

The image features a discussion board post titled “DESU DEEP STRIKING INTO THIS THREAD.” An anonymous user shares a URL ending with “/offendants” and mentions having work profile images and contact information for attorneys from PDF documents. The post implies that they have enough information to create cards and suggest the attorneys are being monitored.

Screenshot from post on online channels providing information about the case lawyers.

Microsoft’s legal team received several emails, including ones from suspected Storm-2139 members trying to shift blame onto others in the group.

By 2025, India’s First Semiconductor Chip to be ready

Check Also

Webex

Cisco alerts about a Webex flaw that exposes credentials

Cisco has alerted customers about a vulnerability in Webex for BroadWorks that could allow unauthorized …

Leave a Reply

Your email address will not be published. Required fields are marked *