Microsoft Azure, like all other cloud platforms, provides the foundational service of compute. Compute workloads can be used as production servers, application hosts, jump boxes, development environments, and platforms for running business-critical services. Azure Virtual Machines are the cornerstone of this compute offering, enabling organizations to deploy and manage Windows or Linux workloads in the cloud.

​

Just like in traditional data centers, Windows-based Azure VMs can be encrypted using BitLocker for an added layer of security at rest. Since these are virtual machines, the disks of critical compute workloads are usually backed up in the form of snapshots to support recovery, or migration.

​

In this webinar, we will learn how BitLocker recovery keys backed up to Entra ID can be abused by threat actors to access data stored on Azure VMs. We will explore how a VM disk snapshot can be obtained and unlocked to read its contents. We will then examine various ways to access the live Azure VM to enable further lateral movement. We will also discuss the potential impact and cover practical mitigations to reduce the risk.