Storm-3168 Used Compromised Azure Service Principals to Destroy Cloud Resources
Summary
Microsoft details Storm-3168 activity in which compromised Azure service principals deleted cloud resources, targeted recovery protections, and retrieved storage keys. Microsoft found no confirmed data exfiltration or ransom note.
Key points
- Two compromised service principals enumerated Azure resources; one later performed destructive operations and collected credentials.
- More than 100 Azure Storage account deletion attempts occurred in a destructive sequence lasting about seven minutes. Most targeted accounts were deleted.
- A Key Vault, Function App, and App Service plan were also deleted. Attempts to delete Azure SQL databases failed because of an unsupported API version.
- The actor tried to remove Azure Site Recovery and Azure Backup protections, but resource locks and deletion safeguards blocked some actions.
- About 30 minutes after the destructive activity, the service principal made more than 30 successful requests to retrieve storage account keys.
- A service principal's credentials had previously appeared in a public GitHub issue, but Microsoft could not confirm whether those credentials enabled the activity.
- Microsoft did not observe a ransom note or confirm successful data exfiltration. It recommends promptly rotating exposed secrets, applying least privilege, and protecting recovery resources.
Article Details
- Attack Vectors
- Compromised Azure service principals were used to enumerate cloud resources, delete resources, target recovery protections, and request storage account keys.
- Storm-3168-linked infrastructure repeatedly probed sensitive paths on Azure App Services, including WordPress administration and PHP-CGI paths and LangFlow's /api/v1/validate/code endpoint; the article says the probed targets did not overlap with the affected subscriptions.
- A client ID, client secret, and tenant ID for a service principal had been exposed in plaintext in a public GitHub issue. Microsoft could not confirm whether the exposed secret was used in the activity.
- Defensive Notes
- Immediately revoke or rotate publicly exposed or compromised credentials; editing or deleting the original disclosure does not invalidate the credentials or remove copies in edit history.
- Protect workload identities and secrets, apply least privilege to service principals, and review their Azure RBAC permissions.
- Safeguard backup and recovery resources, and monitor attempts to modify or remove their protection controls.
- Enable relevant Microsoft Defender for Cloud workload protections for critical Azure resources.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 34[.]153[.]223[.]102 | Storm-3168-linked infrastructure used for App Service probing. |
| IPV4 | 45[.]131[.]66[.]106 | Storm-3168-linked infrastructure used for App Service probing and malicious ARM requests. |
| IPV4 | 64[.]20[.]53[.]230 | Storm-3168-linked infrastructure used for App Service probing. |
MITRE ATT&CK
T1078.004 · Cloud AccountsCompromised service principals were used for Azure resource discovery and destructive operations.T1190 · Exploit Public-Facing ApplicationStorm-3168-linked infrastructure repeatedly probed sensitive paths on applications hosted in Azure App Service for potential exploitation.T1485 · Data DestructionAzure Storage, Key Vault, Function App, and App Service plan resources were deleted; Azure SQL database deletion was also attempted.T1490 · Inhibit System RecoveryThe activity targeted Azure Site Recovery and Azure Backup protection locks for deletion.T1526 · Cloud Service DiscoveryThe identities enumerated subscriptions, virtual machines, resource groups, storage, web apps, App Service plans, locks, and Recovery Services.
Threat Actors
Vendors
Products
AzureOur investigation found an extensive Azure-focused resource destruction activity using compromised service principals and cloud credential collection that could be used to facilitate future exfiltration.Microsoft Defender for AI SecurityUse Microsoft Defender for AI Security (codename MDASH) to discover AI assets, identify vulnerabilities and misconfigurations, and reduce exposure to AI-related attack paths.Microsoft Defender for CloudOrganizations can reduce exposure by protecting workload identities and secrets, enforcing least privilege, safeguarding recovery resources, and enabling relevant Microsoft Defender for Cloud protections.Microsoft Defender XDRMicrosoft Defender XDR detectionsMicrosoft Entra Workload IDLearn more in the Microsoft Entra Workload ID documentation.Microsoft Security CopilotCustomers with provisioned access can also use Microsoft Security Copilot in Microsoft Defender to investigate and respond to incidents, hunt for threats, and protect their organization with relevant threat intelligence.