Threat Actors Abuse AzureHound Tool to Enumerate Azure and Entra ID Environments

Threat Actors Abuse AzureHound Tool to Enumerate Azure and Entra ID Environments discusses how AzureHound, a data-collection tool built into the BloodHound suite, is being weaponised by threat actors to enumerate Azure and Microsoft Entra ID environments by querying Microsoft Graph and Azure REST APIs.

Recent threat intelligence reveals that sophisticated adversaries, including Iranian-backed Curious Serpens and Russian-affiliated Void Blizzard, have incorporated AzureHound into their post‑compromise discovery phases. The tool enables attackers to map user hierarchies, identify administrative accounts such as Global Administrators, and locate storage accounts and key vaults, providing a clear roadmap for privilege escalation and lateral movement.

The article notes that the technique requires no special network positioning since the relevant APIs are accessible from external locations, facilitating rapid reconnaissance after initial access. It emphasises defensive measures such as enforcing multi‑factor authentication, implementing conditional access policies, and monitoring for AzureHound commands like list users, list groups, list role-assignments, and list storage-accounts.

Organisations are advised to pursue layered security, logging of Azure activity, and proactive threat hunting to mitigate cloud-discovery activity described in this piece, according to unit42.paloaltonetworks[.]com.