Threat actor bypasses detection, protections in Microsoft Azure Serial Console

Mandiant researchers have observed threat actors abusing privileged account access to Microsoft Azure Serial Console, bypassing many defense and detection methods, thereby gaining full administrative access to text-based console window of virtual machines. The technique is widely known in the security community and could lead to the compromise of an organization's Azure environment, with threat actors being able to plant deepfakes, modify data, and even control IoT assets often managed within the cloud.