Braving the Storm-2372: The Tempest Decoded

In this detailed threat intelligence briefing from the DEF CON 33 Cloud Village, a researcher decodes the tactics, techniques, and procedures (TTPs) of Storm-2372, an adversary specializing in sophisticated OAuth token abuse. Opening at 00:00, the speaker introduces device code phishing campaigns designed to circumvent modern multi-factor authentication (MFA) protections.

At 06:01, the presentation breaks down the mechanics of the OAuth 2.0 Device Authorization Grant (Device Code Flow), explaining how attackers trick users into entering a one-time code on a legitimate identity portal. At 12:01, the speaker analyzes why these attacks succeed, showing that once a victim authenticates, the adversary receives a valid OAuth primary refresh token that grants persistent cloud access without triggering standard MFA re-prompts.

At 18:00, the talk evaluates detection engineering challenges, comparing user-agent, IP geolocation, and timestamp discrepancies between code generation and token redemption. Concluding at 24:00, the speaker outlines defensive mitigations: disabling device code flow across corporate tenants where not explicitly required, enforcing strict Conditional Access policies, and continuously monitoring for anomalous token issuance. (AI summary — Gemini Flash)