Author: Robert Timlick

  • 3 Simple Power Automate Workflows to Automatically Identify and Terminate Unused Cloud Resources

    3 Simple Power Automate Workflows to Automatically Identify and Terminate Unused Cloud Resources

    The cloud makes it easy to create virtual machines, databases, and storage accounts with just a few clicks. The problem is, these resources are often left running long after they’re needed. This “cloud sprawl,” the unmanaged growth of cloud resources, can quietly drain your budget every month. According to Hashi Corp’s State of Cloud Strategy Survey 2024, the top reasons for this waste are lack of skills, idle or underused resources, and overprovisioning, which together drive up costs for businesses of all sizes.

    Why Should I Care About Cloud Resources?

    The business benefit is tangible and dramatic. While organizations struggle with cloud budgets exceeding limits by an estimated 17%, automation offers a clear path to control. 

    For example, a VLink saved a significant amount of money on its non-production cloud spend by implementing a rigorous cloud shutdown automation policy. This policy automatically powered down all development and test environments that were not explicitly tagged as ‘Production’ outside of normal business hours (8 AM to 6 PM). The savings from just this single automated action accounted for 40% off their non-production cloud spend, freeing up that budget for new growth initiatives.

    3 Power Automate Workflows

    Finding these unused cloud resources feels like hunting for ghosts. But what if you could automate the hunt? Microsoft Power Automate is a powerful tool for this exact task. Let’s look at three straightforward workflows to identify and terminate waste automatically.

    1. Automate the Shutdown of Development VMs

    Development and test environments are the worst offenders for cloud waste. A team needs a virtual machine for a short-term project. The project ends, but the VM continues to run, costing money. You can build a workflow that stops this waste. Create a Power Automate flow that triggers daily and queries Azure for all virtual machines with a specific tag, like “Environment: Dev.”

    The flow then checks the machine’s performance metrics. If the CPU utilization has been below 5% for the last 72 hours, it executes a command to shut down the VM. This simple Azure automation does not delete anything, it simply turns off the power, slashing costs immediately. Your developers can still start it if needed, but you are no longer paying for idle time.

    2. Identify and Report Orphaned Storage Disks

    When you delete an Azure virtual machine, you are often given an option to delete its associated storage disk. This step is frequently missed, and the orphaned disks continue to incur storage charges month after month. You can create a flow to find them. 

    Build a Power Automate schedule that runs weekly. The flow will list all unattached managed disks in your subscription and will then compose a detailed email report that lists the disk names, their sizes, and the estimated monthly cost. The report acts as a clear, actionable list that could be used for cleanup purposes, and you can send it using the “Send an email” action to your IT manager or finance team for further evaluation on whether to keep or delete the disks.

    3. Terminate Expired Temporary Resources

    Some business projects require temporary cloud resources, like a blob storage container for a file transfer or a temporary database for data analysis. Since these resources have a finite lifespan, you need to directly integrate build expiration dates into your deployment process. For this, you can use a Power Automate flow that is triggered by a custom date field. This means that whenever you create a temporary resource, you add a descriptive tag such as “Deletion Date.” 

    After implementing this best practice, i.e., adding descriptive tags to cloud resources, set the flow to run daily and check for all resources that bear the “Deletion Date” tag. For each resource the flow finds, it should check whether the current date matches or is later than the “Deletion Date” property. If this condition is met, the flow deletes the resource automatically. This hands-off cleanup ensures that temporary items do not become permanent expenses. This approach not only eliminates the risk of human oversight but also uses automation to enforce financial discipline.

    Troubleshoot Your Automated Workflows

    Using Power Automate to build these workflows is a great start, but you also need to implement them safely. Automations that delete resources are powerful and need controls in place. To be safe, always launch these flows in report-only mode, which lets you test and simulate automations without enforcing them. For example, you can modify the “Terminate Expired Temporary Resources” flow to send an email alert instead of deleting resources for the first couple of weeks as you observe. This helps validate whether your flow logic is sound and gives you an opportunity to fix errors and oversights.

    You can also consider adding a manual approval requirement for certain high-risk actions, such as the deletion of very large storage disks. This ensures that your automations work to your benefit and not against you. 

    Take Control of Your Cloud Spend

    These three Power Automate workflows are a good starting point for businesses using Microsoft Azure. They help you shift from a reactive to a proactive position, ensuring you only pay for the resources you actively use.

    Stop overspending on idle cloud resources. To take control of your cloud environment and start saving, contact us today to implement these Power Automate workflows and optimize your Azure spend.

    Featured Image Credit

    This Article has been Republished with Permission from The Technology Press.

  • Bitfinex Hack Convict Ilya Lichtenstein Released Early Under U.S. First Step Act

    Bitfinex Hack Convict Ilya Lichtenstein Released Early Under U.S. First Step Act

    Ilya Lichtenstein, who was sentenced to prison last year for money laundering charges in connection with his role in the massive hack of cryptocurrency exchange Bitfinex in 2016, said he has been released early.
    In a post shared on X last week, the 38-year-old announced his release, crediting U.S. President Donald Trump’s First Step Act. According to the Federal Bureau of Prisons’ inmate locator
  • New VVS Stealer Malware Targets Discord Accounts via Obfuscated Python Code

    New VVS Stealer Malware Targets Discord Accounts via Obfuscated Python Code

    Cybersecurity researchers have disclosed details of a new Python-based information stealer called VVS Stealer (also styled as VVS $tealer) that’s capable of harvesting Discord credentials and tokens.
    The stealer is said to have been on sale on Telegram as far back as April 2025, according to a report from Palo Alto Networks Unit 42.
    “VVS stealer’s code is obfuscated by Pyarmor,” researchers
  • Transparent Tribe Launches New RAT Attacks Against Indian Government and Academia

    Transparent Tribe Launches New RAT Attacks Against Indian Government and Academia

    The threat actor known as Transparent Tribe has been attributed to a fresh set of attacks targeting Indian governmental, academic, and strategic entities with a remote access trojan (RAT) that grants them persistent control over compromised hosts.
    “The campaign employs deceptive delivery techniques, including a weaponized Windows shortcut (LNK) file masquerading as a legitimate PDF document
  • The ROI Problem in Attack Surface Management

    The ROI Problem in Attack Surface Management

    Attack Surface Management (ASM) tools promise reduced risk. What they usually deliver is more information. 
    Security teams deploy ASM, asset inventories grow, alerts start flowing, and dashboards fill up. There is visible activity and measurable output. But when leadership asks a simple question, “Is this reducing incidents?” the answer is often unclear. 
    This gap between effort and
  • Cybercriminals Abuse Google Cloud Email Feature in Multi-Stage Phishing Campaign

    Cybercriminals Abuse Google Cloud Email Feature in Multi-Stage Phishing Campaign

    Cybersecurity researchers have disclosed details of a phishing campaign that involves the attackers impersonating legitimate Google-generated messages by abusing Google Cloud’s Application Integration service to distribute emails.
    The activity, Check Point said, takes advantage of the trust associated with Google Cloud infrastructure to send the messages from a legitimate email address (“
  • ThreatsDay Bulletin: GhostAd Drain, macOS Attacks, Proxy Botnets, Cloud Exploits, and 12+ Stories

    ThreatsDay Bulletin: GhostAd Drain, macOS Attacks, Proxy Botnets, Cloud Exploits, and 12+ Stories

    The first ThreatsDay Bulletin of 2026 lands on a day that already feels symbolic — new year, new breaches, new tricks. If the past twelve months taught defenders anything, it’s that threat actors don’t pause for holidays or resolutions. They just evolve faster. This week’s round-up shows how subtle shifts in behavior, from code tweaks to job scams, are rewriting what “cybercrime” looks like in
  • RondoDox Botnet Exploits Critical React2Shell Flaw to Hijack IoT Devices and Web Servers

    RondoDox Botnet Exploits Critical React2Shell Flaw to Hijack IoT Devices and Web Servers

    Cybersecurity researchers have disclosed details of a persistent nine-month-long campaign that has targeted Internet of Things (IoT) devices and web applications to enroll them into a botnet known as RondoDox.
    As of December 2025, the activity has been observed leveraging the recently disclosed React2Shell (CVE-2025-55182, CVSS score: 10.0) flaw as an initial access vector, CloudSEK said in an
  • Trust Wallet Chrome Extension Hack Drains $8.5M via Shai-Hulud Supply Chain Attack

    Trust Wallet Chrome Extension Hack Drains $8.5M via Shai-Hulud Supply Chain Attack

    Trust Wallet on Tuesday revealed that the second iteration of the Shai-Hulud (aka Sha1-Hulud) supply chain outbreak in November 2025 was likely responsible for the hack of its Google Chrome extension, ultimately resulting in the theft of approximately $8.5 million in assets.
    “Our Developer GitHub secrets were exposed in the attack, which gave the attacker access to our browser extension source
  • DarkSpectre Browser Extension Campaigns Exposed After Impacting 8.8 Million Users Worldwide

    DarkSpectre Browser Extension Campaigns Exposed After Impacting 8.8 Million Users Worldwide

    The threat actor behind two malicious browser extension campaigns, ShadyPanda and GhostPoster, has been attributed to a third attack campaign codenamed DarkSpectre that has impacted 2.2 million users of Google Chrome, Microsoft Edge, and Mozilla Firefox.
    The activity is assessed to be the work of a Chinese threat actor that Koi Security is tracking under the moniker DarkSpectre. In all, the