Threat Group UNC3944 Abusing Azure Serial Console for Total VM Takeover

A financially motivated cyber actor has been observed abusing Microsoft Azure Serial Console on virtual machines (VMs) to install third-party remote management tools within compromised environments.
Google-owned Mandiant attributed the activity to a threat group it tracks under the name UNC3944, which is also known as Roasted 0ktapus and Scattered Spider.
"This method of attack was unique in

0ktapus abusing actor azure compromised console cyber environments google install machines management mandiant microsoft microsoft azure name party remote management takeover third third-party threat threat group tools under virtual virtual machines vms