Microsoft sues cybercrime group Storm-2139 for developing AI jailbreak tools
Microsoft filed a lawsuit against cybercrime group Storm-2139, allegedly for developing tools that bypass safety guardrails in generative AI services to create non-consensual deepfake imagery and other harmful content. The updated complaint names four individuals from Iran, the United Kingdom, Hong Kong, and Vietnam as key members who obtained unauthorized access to AI systems through compromised credentials and resold modified tools to generate illicit material.
What happened
Microsoft's Digital Crimes Unit filed a complaint in the Eastern District of Virginia against a cybercrime network known as Storm-2139, alleging they developed tools designed to bypass safety guardrails of generative AI services including Azure OpenAI.
According to Microsoft's investigation, Storm-2139 members obtained exposed customer credentials from public sources and used them to gain unauthorized access to generative AI services, then altered AI capabilities and resold access to other actors with instructions for generating harmful content.
The updated complaint names four individuals as key figures: Arian Yadegarnia from Iran, Alan Krysiak from the United Kingdom, Ricky Yuen from Hong Kong, and Phát Phùng Tấn from Vietnam.
Reported impact
Microsoft alleges that the tools enabled users to generate illicit content including non-consensual intimate images of celebrities and sexually explicit deepfake material.
The cybercrime network operated with three defined roles: creators developing the software, providers distributing modified tools for payment, and users applying them to generate synthetic content violating Microsoft's policies.
Index analysis
The incident involved deliberate development of software specifically engineered to circumvent AI safety measures deployed at multiple levels including the model, platform, and application layers.
Governance controls
Upon discovery, Microsoft revoked cybercriminal access, implemented countermeasures, and enhanced safeguards to block similar malicious activity.
The court granted Microsoft a temporary restraining order and preliminary injunction, allowing the company to seize a website allegedly central to Storm-2139's operations and gather evidence about the individuals and monetization of these illicit services.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.