Microsoft has initiated legal proceedings against a global cybercrime syndicate accused of developing sophisticated tools to bypass safety protocols in its Azure OpenAI Service.
The complaint, filed in the U.S. District Court for the Eastern District of Virginia, alleges that the group—tracked as Storm-2139—used stolen API keys, reverse proxy infrastructure, and custom software to generate harmful content, including non-consensual intimate imagery, through the DALL-E image generation model.
The attackers deployed a two-pronged technical strategy to exploit Microsoft’s generative AI infrastructure:
API Key Theft and Abuse:
Storm-2139 systematically harvested Azure OpenAI Service API keys—52-character alphanumeric authentication tokens—from compromised customer accounts, including U.S.-based enterprises in Pennsylvania and New Jersey.
These keys, designed to grant programmatic access to Azure’s AI models, were stolen via credential scraping from public repositories and phishing campaigns.
Microsoft’s investigation revealed that the group used these keys to impersonate legitimate users, bypassing Azure’s authentication gates.
Reverse Proxy Infrastructure:
The hackers operated a custom reverse proxy service (dubbed “oai-reverse-proxy”) hosted on domains like aitism.net and rentry.org/de3u.
This tool routed malicious HTTP requests through Cloudflare tunnels to mask their origin, enabling communication with Azure’s API endpoints (e.g., POST https://{endpoint}/openai/deployments/{deployment-id}/images/generations).
The proxy altered request parameters, such as endpoint addresses and deployment IDs, to evade Microsoft’s geo-fencing and content-filtering systems.
Client-Side Tool (“de3u”):
The de3u software, a GitHub-hosted frontend for DALL-E 3—allowed users to input text prompts while circumventing Azure’s content moderation.
For example, prompts flagged by Microsoft’s ensemble classifiers for sexual or violent content were revised using string manipulation to avoid detection (e.g., replacing blocked keywords with Unicode equivalents).
The tool also disabled Azure’s default “revised_prompt” functionality, which typically sanitizes user inputs.
Bypassing Multi-Layered AI Safeguards
Microsoft’s Azure OpenAI Service employs multiple defense mechanisms, including:
Content Filtering Models: Neural classifiers trained to detect hate, violence, sexual, and self-harm content across eight languages, with severity thresholds (safe/low/medium/high).
Abuse Monitoring: Real-time analysis of API call patterns and prompt completion logs, with human review via Secure Access Workstations (SAWs).
C2PA Metadata: Content Credentials (CR) icons embedded in generated images to verify AI provenance.
Storm-2139’s tools neutralized these measures by:
- Using the reverse proxy to intercept and strip CR metadata from DALL-E outputs.
- Leveraging asynchronous filtering to delay content moderation responses, allowing harmful images to reach end-users before Azure’s systems could block them
Legal and Operational Response
Microsoft’s 89-page complaint cites violations of the Computer Fraud and Abuse Act (CFAA), Digital Millennium Copyright Act (DMCA), and Racketeer Influenced and Corrupt Organizations Act (RICO).
The court has authorized the seizure of infrastructure, including the aitism.net domain and GitHub repositories hosting de3u.
The incident underscores critical vulnerabilities in API-based AI services:
Third-Party Reliance: Attackers exploited dependencies on Cloudflare and AWS IPs, highlighting risks in decentralized cloud ecosystems.
Token-Based Billing: Stolen API keys enabled “token theft” at scale, draining victim accounts of prepaid computational credits.
Microsoft urges enterprises to adopt Entra ID (formerly Azure AD) for OAuth-based authentication and audit API key usage. The case sets a precedent for holding tool developers, not just end-users, liable under anti-hacking statutes.
As Storm-2139’s members face potential extradition from Iran, the UK, Hong Kong, and Vietnam, the lawsuit signals intensified scrutiny of AI’s role in cybercrime.
With Azure OpenAI hosting 18,000 organizations globally, the stakes for securing generative AI have never been higher.
Collect Threat Intelligence on the Latest Malware and Phishing Attacks with ANY.RUN TI Lookup -> Try for free
