Incident Alert (Aug 31, 2025): A new malware-as-a-service (MaaS) campaign—“PhantomFlow”—has emerged, delivering a fileless loader via PowerShell through compromised Azure Function endpoints. Initial detection points to stealthy ransomware payloads being deployed across healthcare and manufacturing networks.

Key Details:

• Attack Vector: Azure Function apps abused for persistent payload execution.

• Payload: Fileless PowerShell loader using memory-resident obfuscation, avoiding disk writes.

• Targets Observed: Healthcare systems in North America and manufacturing environments in Europe.

• TTP Highlights:

  • Leveraging compromised Azure credentials stored in Git repos.

  • Post-compromise, lateral movement via SMB session hijacking and in-memory execution.

  • Final-stage payload is a ransomware wrapper that triggers both encryption and data exfil via SFTP.

Severity: High

• Novel vector: the use of Azure serverless functions as malware launch pads is a first-of-its-kind attack technique.

• High stealth: fileless design and memory-only components make detection by traditional AV extremely difficult.

CyberDudeBivash Recommended Actions:

1. Audit Azure Functions & Logging

   • Immediately review Function app activity logs for anomalous script execution.

   • Rotate and secure all Function credentials— do not store secrets in GitHub.

2. Deploy Memory-Based Detection

   • Utilize EDR that supports PowerShell script tracking, AMSI bypass detection, and memory-only persistence.

3. Harden Azure Environment

   • Lock down managed identities & access controls for Function apps.

   • Enforce network lockdowns—restrict outbound ports like SMB and SFTP from serverless environments.

4. Infra Threat Hunting

   • Look for in-memory anomalies, unexpected Azure exec logs, and unusual SFTP exfil attempts.

5. Contain & Notify

   • If detected, isolate affected Function apps.

   • Inform Azure Security Center and start incident response playbooks immediately.

CyberDudeBivash Insight:

PhantomFlow demonstrates a troubling shift: adversaries weaponizing cloud-native infrastructures—not just VMs or containers—but serverless compute. This elevates the threat posture across all DevOps-driven organizations using Azure or similar platforms.

CyberDudeBivash is formally monitoring this campaign and preparing a dedicated mitigation playbook (released within 48 hours) to secure azure-native pipelines.

Stay tuned for our ThreatWire Flash Edition, and share this alert across SOC/SecurityOps channels.

— CyberDudeBivash (Threat Intel Lead)
#CyberDudeBivash #FlashAlert #FilelessMalware #AzureFunctions #ThreatIntel