A threat actor known as Storm-2949 has launched a sophisticated, multi-layered cloud attack campaign targeting Microsoft Entra ID accounts to steal sensitive data from Microsoft 365 and Azure environments. <\/p>\n
The campaign was recently uncovered and has raised serious concerns about how modern attackers can abuse legitimate cloud features to carry out large-scale data theft across organizations.<\/a><\/p>\n What makes this attack stand out is that it did not rely on traditional malware or device-level exploits. Instead, the attackers used legitimate Microsoft cloud management tools and administrative features<\/a> to silently move through an organization\u2019s entire cloud infrastructure. <\/p>\n Sensitive files, database credentials, application secrets, and stored data all fell into the attackers\u2019 hands.<\/a><\/p>\n Microsoft said in a report<\/a> shared with\u00a0<\/a>Cyber Security News (CSN)\u00a0that Storm-2949 executed a relentless campaign focused on exfiltrating as much sensitive data as possible from a target organization\u2019s high-value assets. <\/p>\n The attack spanned Microsoft 365 applications, file-hosting services, and Azure-hosted production environments, hitting SaaS, PaaS, and IaaS layers across the board.<\/a><\/p>\n The breach began with a targeted identity compromise and quickly escalated into a full takeover of the organization\u2019s cloud infrastructure. <\/p>\n Analysts noted that the attackers deliberately targeted IT staff and senior leadership, showing clear signs of prior reconnaissance and a calculated plan to maximize damage.<\/a><\/p>\n This incident highlights a growing shift in how threat actors approach cloud environments. Rather than targeting individual devices, attackers are zeroing in on cloud identities and control-plane access, where they can blend with expected administrative behavior and go undetected for extended periods.<\/a><\/p>\n Storm-2949 gained initial access through a social engineering technique that abused Microsoft\u2019s Self-Service Password Reset process. <\/p>\n The attackers impersonated internal IT support staff and tricked targeted users into approving fraudulent multi-factor authentication prompts<\/a>, effectively handing over full account control.<\/a><\/p>\n Once a user approved the fake prompt, the attackers reset the account password, removed all existing authentication methods, and registered their own device as a new authenticator. <\/p>\n This gave them persistent access while locking the real user out entirely. The same technique was repeated across multiple accounts within the same organization.<\/a><\/p>\n After establishing a foothold, the attackers used a custom Python script and Microsoft Graph API queries to enumerate user accounts and privileged identities within the tenant. <\/p>\n They then turned to Microsoft 365, targeting OneDrive and SharePoint to locate and bulk-download thousands of sensitive files, particularly those related to VPN configurations and remote access procedures.<\/a><\/p>\n With compromised accounts holding privileged Azure role-based access control permissions, Storm-2949 moved aggressively into the Azure environment. <\/p>\n They targeted Azure App Services, Key Vaults, Storage accounts, and SQL databases, using legitimate management-plane operations to extract secrets and reconfigure access controls.<\/a><\/p>\n By accessing a Key Vault that contained database connection strings and identity credentials, the attackers dramatically expanded the breach\u2019s blast radius. <\/p>\n Within just four minutes, they read dozens of secrets and used those credentials to authenticate into the primary production web application they had been pursuing all along.<\/a><\/p>\n To pull data from Azure Storage, the attackers manipulated network access settings and abused storage account key listing operations to obtain Shared Access Signature tokens. <\/p>\n They then used a custom Python script to systematically download large volumes of data<\/a> over several days, while SQL server firewall rules were altered to allow access and then deleted to cover their tracks.<\/a><\/p>\n The attackers also compromised Azure Virtual Machines using the VMAccess extension to create backdoor admin accounts, and deployed ScreenConnect after attempting to disable Microsoft Defender Antivirus. <\/p>\n Before exiting, they cleared Windows event logs and removed local artifacts to complicate any forensic investigation.<\/a><\/p>\n Organizations facing similar threats are encouraged to enforce phishing-resistant multi-factor authentication for all privileged users, apply least privilege across Azure role assignments, and restrict public network access to Key Vaults and Storage accounts. <\/p>\n Security teams should monitor suspicious management-plane activity<\/a> and audit the use of Azure VM features such as Run Command and VMAccess to stop this type of lateral movement.<\/a><\/p>\n Indicators of Compromise (IoCs):-<\/strong><\/p>\nHackers Abuse Microsoft Entra ID Accounts<\/strong><\/h2>\n
![\"Storm-2949](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjhtZ5mOB1BfCBU-mo7Y9C2zXQYo400hnezplhroxVn9qljaQ-to2u7QlKCvhOtIwOrKD8q-uKLXjQ9TtviBeu8tf7waZjoka87wH6JHPX5NnEtRNvCBTWdkrXEeC51pqu2_0ckrEQ5ikiJ_cWeepHHotHrRO8a7pv6aagZU4C8Ig7BdPlVDJ5DbdZ_dzE\/s16000\/Storm-2949%2520attack%2520%28Source%2520-%2520Microsoft%29.webp?ssl=1\")
Azure-Wide Data Breach and Lateral Movement<\/strong><\/h2>\n