Global Cybercrime Network Storm-2139 Allegedly Exploits AI to Generate Deepfake Content

A global cybercrime network, Storm-2139, allegedly exploited stolen credentials and developed custom tools to bypass AI safety guardrails. They reportedly generated harmful deepfake content, including nonconsensual intimate images of celebrities, and their software is reported to have disabled content moderation, hijacked AI access, and resold illicit services. Microsoft disrupted the operation and filed a lawsuit in December 2024, later identifying key members of the network in February 2025.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.2 AI system security vulnerabilities and attacks

The incident involved a cybercrime network exploiting stolen credentials to gain unauthorized access to Azure OpenAI services, bypass safety guardrails, and manipulate the system's capabilities.

Additional risk subdomains

• 1.2 Exposure to toxic content: The hijacked AI systems were used to generate thousands of sexually explicit images and non-consensual intimate images of celebrities.
• 4.3 Fraud, scams, and targeted manipulation: The actors created tools to generate non-consensual intimate images of celebrities, which constitutes targeted creation of humiliating or sexual imagery.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by human malicious actors who intentionally hijacked deployed AI services to bypass safety guardrails and generate illicit content.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The generative AI models are used to produce synthetic content and deepfakes, which falls under the transparency and notification obligations of Risk Level 3.

AI system and alleged parties

• AI system: Azure OpenAI Service (Microsoft)
• AI purpose: Image Generation; Deepfake Image Generation
• Behaviour type: Tool
• Alleged developer: Unidentified Storm-2139 actor from Illinois, Unidentified Storm-2139 actor from Florida, Storm-2139, Ricky Yuen (cg-dot), Phát Phùng Tấn (Asakuri), Arian Yadegarnia (Fiz), Alan Krysiak (Drago)
• Alleged deployer: Unidentified Storm-2139 actor from Illinois, Unidentified Storm-2139 actor from Florida, Storm-2139, Ricky Yuen (cg-dot), Phát Phùng Tấn (Asakuri), Arian Yadegarnia (Fiz), Alan Krysiak (Drago)
• Alleged harmed parties: Victims of deepfake abuse, OpenAI, Microsoft, celebrities, Azure OpenAI customers, AI service providers

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Minor
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Minor
• Psychological: direct Negligible, indirect Minor
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: Yes, the reports mention unauthorized AI usage charges and the monetization of the hijacked services, though specific dollar amounts are not fully quantified.

Directly caused: The average financial loss per occurrence is unquantified, but involved unauthorized charges on compromised customer Azure accounts.

Indirectly caused: Microsoft incurred significant operational and legal costs to investigate, litigate, and seize the cybercriminals' infrastructure.

Inferred additional harm: Compromised enterprise customers likely suffered thousands of dollars in unauthorized API usage bills before the credentials were revoked.

Malicious content

Reported: Yes, the reports explicitly state that the hijacked accounts were used to generate thousands of harmful, sexually explicit, and non-consensual intimate images.

Directly caused: The bypassed AI models directly generated thousands of violating synthetic images, including non-consensual intimate images of celebrities.

Inferred additional harm: It is likely that these images were further circulated on online forums and social media platforms, exposing a wider audience to toxic content.

Privacy

Reported: Yes, the reports describe the exploitation of stolen customer credentials and the doxing of Microsoft's legal counsel.

Indirectly caused: Cybercriminals violated the privacy of Microsoft's legal counsel by doxing them, posting their names, personal information, and photographs online.

Inferred additional harm: The credentials of numerous Azure customers were compromised, potentially exposing sensitive enterprise data and personal information associated with those accounts.

Psychological

Reported: Yes, the report notes that doxing can result in harassment, and highlights the serious and lasting impacts of abusive imagery for victims.

Indirectly caused: The generation of non-consensual intimate images of celebrities and the doxing of Microsoft's legal counsel caused distress, harassment, and psychological harm to the affected individuals.

Inferred additional harm: It is highly likely that dozens of targeted celebrities experienced significant emotional distress and anxiety due to the creation and potential circulation of explicit deepfakes.

Epistemic

Reported: Yes, the reports mention attempts to create false imagery of celebrities and public figures.

Directly caused: The hijacked AI was used to generate false synthetic imagery of celebrities, eroding the reliability of visual evidence.

Inferred additional harm: The creation of high-quality celebrity deepfakes likely contributed to the broader erosion of public trust in digital media and shared reality.

People affected

• Occurrences reported: 1
• People reportedly harmed: 5
• People reportedly exposed: 10

Potential causes

Management

• Insufficient Service Auditing: Inadequate proactive audits of non-human identities and service accounts.
• Inadequate Risk Assessment: Failure to anticipate the scale of LLMjacking and API key exploitation.
• Unsecured AI Adoption: Organizations prioritize growth over implementing strict access controls.

Technology

• Vulnerable API Key Storage: Customer API keys were exposed on public sources, allowing unauthorized access.
• Bypassable AI Guardrails: Built-in safety measures were bypassed using custom jailbreaking tools.
• Lack of LLM Access Controls: Insufficient restriction on non-human identities allowed API key abuse.

Data Inputs

• Scraped Customer Credentials: Exposed customer credentials scraped from public websites enabled hijacking.
• Stolen API Keys: Stolen API keys acted as digital credentials to gain unauthorized AI access.
• Use of Harmful Prompts: Malicious users input prompts to generate non-consensual explicit images.

Human Factors

• Poor Credential Hygiene: Customers exposed their sensitive API keys on public repositories.
• Malicious Intent of Actors: Cybercriminals deliberately sought to exploit AI for financial gain.
• Lack of Multi-Factor Auth: Users failed to implement strong authentication to secure their accounts.

Process and Methods

• Inadequate Access Monitoring: Lack of continuous monitoring failed to detect anomalous API key usage.
• Flawed LLM Key Rotation: Absence of regular credential rotation allowed long-term key exploitation.
• Lack of Least-Privilege Policy: Accounts held excessive permissions, expanding the potential attack surface.

Regulatory Environment

• Outdated Criminal Laws: Existing laws lack tools for law enforcement to combat AI misuse effectively.
• Lack of AI Governance Standards: Absence of strict global regulations on generative AI hosting and access.
• Absence of AI-Specific Laws: Current legal frameworks are not modernized to handle synthetic media abuse.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from Microsoft and multiple cybersecurity news outlets provide highly detailed, consistent, and corroborated accounts of the Storm-2139 cybercrime network, their methods (LLMjacking), and the resulting harms (NCII generation and doxing).
• Ambiguities identified: The exact number of compromised customer accounts and the specific celebrities targeted were withheld by Microsoft to protect privacy.
• Alternative interpretations: None. The incident is clearly a cybersecurity exploit of AI services to generate prohibited content.

A global cybercrime network hijacked Microsoft Azure OpenAI services to bypass safety guardrails and generate explicit celebrity deepfakes, subsequently doxing Microsoft legal counsel. While demonstrating evolved cybercrime capabilities in LLMjacking, the incident represents a minor national security threat managed through corporate legal action and law enforcement referrals.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: United States, United Kingdom, Iran, Hong Kong, Vietnam
• Alleged perpetrator: Storm-2139

Threat characteristics

• Imminence: Long-term. The specific operation was disrupted by Microsoft, representing an ongoing strategic cybercrime concern rather than an immediate national security crisis.
• Autonomy: Human-controlled. The AI systems were utilized as tools by human actors who bypassed guardrails to generate specific content, with no autonomous decision-making.
• Novelty: Evolved capability. Represents an evolution of cybercrime techniques, combining credential theft with specialized tools to bypass AI safety guardrails and resell unauthorized access.

Impact by dimension

• Physical security: Negligible. No physical systems, kinetic threats, or critical infrastructure were affected or targeted in this incident.
• Information security: Minor. While involving synthetic media (deepfakes), the targets were celebrities rather than political leadership or national institutions, representing a minor information security concern.
• Sovereignty: Negligible. No impact on state authority, electoral systems, or core government decision-making processes.
• Economic security: Minor. The incident involved unauthorized access to and monetization of commercial AI services (LLMjacking), representing minor economic and technological security concerns managed via civil litigation.
• Societal stability: Minor. The generation of explicit deepfakes and doxing of legal counsel caused individual harm and privacy violations, but did not threaten large-scale social cohesion or civil liberties.