Volt Typhoon

According to CISA, Volt Typhoon actors may have attempted to move laterally from on-premises to a cloud environment in at least one case, but attribution was inconclusive. Investigation revealed anomalous login attempts to an Azure tenant potentially using credentials previously compromised from theft of NTDS.dit. These attempts, coupled with misconfigured virtual machines with open RDP ports, suggested a potential for cloud-based lateral movement.