Microsoft said a threat actor it tracks as Storm-2949 stole data from an unnamed organization’s Microsoft 365 services and Azure-hosted production systems after compromising employee accounts and abusing legitimate cloud administration features.
The compromised users included IT personnel and senior leaders. Microsoft assessed with high confidence that the attacker used social engineering consistent with known abuse of Microsoft Entra ID’s Self-Service Password Reset (SSPR) process.
Account takeover and Microsoft 365 data theft
In the password-reset abuse sequence Microsoft described, an attacker initiates a reset and persuades the targeted user to approve multifactor authentication (MFA) prompts. The attacker can then reset the password, remove existing authentication methods and register Microsoft Authenticator on a device they control. Microsoft presented impersonation of internal IT support as an example of a possible pretext, rather than an established detail of this intrusion.
Microsoft said Storm-2949 used a similar process repeatedly against users in the organization. After gaining access, the actor used the Microsoft Graph API and a custom Python script to enumerate users and applications, and also examined service principals. An attempt to establish persistent access by adding credentials to a compromised service principal failed because the attacker lacked sufficient permissions.
The attacker searched OneDrive and SharePoint for sensitive IT documents, including VPN configurations and remote-access procedures, Microsoft said. The company assessed that the searches were intended to identify ways to move from compromised cloud accounts into the organization’s endpoint network.
In one instance, thousands of OneDrive files were downloaded in a single action to attacker-controlled infrastructure. Microsoft said the data-theft pattern was repeated across the compromised accounts, likely because different users could access different folders and shared directories.
Access to Azure production systems
Multiple compromised identities held privileged custom Azure role-based access control (RBAC) roles across several subscriptions, Microsoft said. The attacker used those permissions to target production resources, including App Service web applications, Key Vaults, Storage accounts, SQL databases and virtual machines.
After initial attempts to access a primary production web application failed, Storm-2949 compromised secondary App Service applications by using privileged permissions to retrieve their publishing profiles, Microsoft said. Such profiles can contain deployment credentials for endpoints including FTP, Web Deploy and the Kudu management console. Kudu allows authenticated users to browse application files, inspect environment variables and execute commands within the application’s context.
Those secondary applications did not initially provide access to the primary production application. Microsoft said the attacker then targeted a Key Vault over which one compromised account held the Owner role. Within four minutes, the actor changed the vault’s access configuration and accessed dozens of secrets, including database connection strings and identity credentials.
Microsoft believes credentials found among those secrets enabled access to the primary production application. The company said the attacker subsequently authenticated to that application, changed its password and began stealing sensitive data.
The actor also changed Azure SQL server firewall rules, connected using credentials obtained from Key Vault and exfiltrated data, Microsoft said. The modified firewall rules were later deleted, which the company described as consistent with defense evasion.
For Azure Storage, Microsoft reported changes to network access settings, acquisition of storage account keys and shared access signature (SAS) tokens, and downloads using a custom Python script. The company said data theft from several storage accounts continued over multiple days.
Virtual machine access and security tampering
Microsoft said Storm-2949 used the VMAccess extension to create a local administrator account on a targeted Azure virtual machine and used Run Command to execute scripts. An attempt to retrieve secrets from a production-related Key Vault through the virtual machine’s managed identity failed because that identity lacked the required permissions.
The company also reported installation of the ScreenConnect remote management tool on compromised systems. Scripts attempted to weaken Microsoft Defender Antivirus protections and remove forensic artifacts, including Windows event logs, command histories and temporary files.
Microsoft said the compromised endpoints primarily supported discovery and credential harvesting and did not appear to yield high-value data aligned with the attacker’s objectives.
The company’s accompanying guidance recommended least privilege, Conditional Access policies, MFA for all users and phishing-resistant MFA for privileged accounts. It also recommended monitoring Azure management activity, limiting administrative permissions and retaining Key Vault logs for up to a year.
