Storm-2139 Azure OpenAI 护栏绕过 (AML.CS0057)

一句话通俗理解

伊朗团伙搭起「越狱即服务」：刮来的凭证 + 自研越狱工具，把 Azure OpenAI 变成有害内容工厂。

维度	内容
案例类型	真实事件
发生时间	2024-12-01
攻击者	Storm-2139
受害目标	Microsoft Azure OpenAI Service
披露方	Microsoft

Storm-2139（伊朗背景团伙）构建了绕过 Azure OpenAI 服务护栏的定制越狱工具链：先从公共代码仓库刮取泄露凭证获得访问，再批量生成有害合成内容（含辱虐图像），部分内容被用于牟利。微软以法律行动反制并公开了该团伙的运营模式。

以下攻击链映射来自 MITRE ATLAS 官方数据（AML.CS0057 的 employs 关系），按官方步骤编号排序；技术名称链接至本库对应技术文档，引用文字为官方对本次运用的描述。

开发能力 (AML.T0017)

Storm-2139 creators developed a tool called de3u to facilitate unauthorized use of generative AI services and bypass safeguards.

获取基础设施 (AML.T0008)

Storm-2139 acquired infrastructure to support a service that sold access to the jailbroken Azure OpenAI Service.

暂存能力 (AML.T0079)

Storm-2139 staged and operated a reverse proxy service to allow other malicious users to interact with abused generative AI services.

有效账户 (AML.T0012)

Storm-2139 used exposed customer credentials scraped from public sources to access valid accounts for generative AI services.

AI 模型推理 API 访问 (AML.T0040)

The stolen credentials provided access Azure OpenAI Service, allowing the actors and their customers to submit prompts and generate content. Storm-2139’s de3u tool was used as the frontend for this access.

LLM 越狱 (AML.T0054)

Storm-2139 deliberately bypassed Azure OpenAI Service safeguards and content filters to generate prohibited outputs. Microsoft reported that the actors iterated on blocked prompts, substituted celebrity descriptions, and used altered wording or technical notation to evade filters.

生成深度伪造 (AML.T0088)

End users generated abusive synthetic imagery, including non-consensual intimate images of celebrities and other sexually explicit, misogynistic, violent, or hateful content.

社会危害 (AML.T0048.002)

The generated abusive imagery could cause direct harm to depicted individuals.

财务危害 (AML.T0048.000)

Users whose accounts were stolen were harmed financially.

以下为 MITRE ATLAS 官方案例收录的参考来源：

版本: ATLAS 2026.09 | 更新: 2026-10-24 | 模板: ATLAS 案例研究 v1.0