Threat Actors Weaponize AzureHound for Cloud Enumeration

AzureHound, a legitimate BloodHound penetration testing tool, is being weaponized by nation-state actors including Iranian Curious Serpens and Russian Void Blizzard. What's concerning: the tool queries Microsoft Graph and Azure REST APIs to gather detailed information about users, groups, permissions, roles, and resources—mapping entire Azure tenants from external locations. What makes it powerful: requires no special network positioning since both APIs are externally accessible, and integration with BloodHound visualization software transforms API data into graphical attack paths showing privilege escalation and lateral movement opportunities. Threat actors deploy post-compromise to rapidly enumerate user hierarchies, identify Global Administrators, map role assignments, and locate critical infrastructure (storage accounts, key vaults). Recent campaigns show sophisticated adversaries incorporating AzureHound to accelerate attack timelines and operate efficiently within victim environments. Defense requires monitoring for specific commands: list users, list groups, list role-assignments, list storage-accounts executed rapidly or by unexpected accounts.