Microsoft Says Storm-2949 Abused SSPR in Azure Data-Theft Attacks
Summary
Microsoft reports that Storm-2949 used social engineering and allegedly abused SSPR to access privileged accounts, then stole data and credentials from Microsoft 365 and Azure. Microsoft recommends stronger access controls, phishing-resistant MFA and cloud monitoring.
Key points
- Microsoft says Storm-2949 targeted privileged users with social engineering and believes the group abused SSPR to reset passwords, remove MFA controls and enroll its own authenticator.
- Using compromised accounts, the group enumerated users, roles, applications and service principals with Microsoft Graph API and custom Python scripts.
- The group searched OneDrive and SharePoint for VPN configurations and IT files; Microsoft says one operation downloaded thousands of files in a single action.
- Microsoft reports the attackers used privileged Azure RBAC roles to access production resources, including Key Vaults, SQL databases, storage accounts and virtual machines.
- The group reportedly changed Key Vault access settings and stole secrets, and altered network rules to retrieve storage keys and SAS tokens.
- Microsoft says the attackers also abused Azure VM management features, deployed ScreenConnect, attempted to disable Defender and tried to wipe forensic evidence.
- Microsoft recommends least privilege, conditional access, phishing-resistant MFA for privileged users, restricted Key Vault and RBAC access, and monitoring high-risk Azure operations.
Article Details
- Attack Vectors
- Storm-2949 reportedly used social engineering, posing as IT support, to trick privileged users into approving MFA prompts during an abused Self-Service Password Reset flow and to obtain Microsoft Entra ID credentials.
- The group used compromised accounts and Microsoft Graph API to enumerate users, roles, applications, and service principals.
- After accessing Microsoft 365, the group searched and downloaded files from OneDrive and SharePoint, including VPN configurations and IT operational files.
- The group used privileged Azure RBAC permissions to access Azure resources, deploy FTP, Web Deploy, and the Kudu console, and remotely browse files, inspect environment variables, and execute commands.
- The group modified Azure Key Vault access settings and stole secrets, including database credentials and connection strings; it also changed Azure SQL and Storage network access rules and retrieved storage keys and SAS tokens.
- The group reportedly abused Azure VMAccess and Run Command to create rogue administrator accounts, run remote scripts, and steal credentials.
- In later attack stages, the group deployed ScreenConnect, attempted to disable Microsoft Defender protections, and wiped forensic evidence.
- Defensive Notes
- Apply least privilege and limit Azure RBAC permissions.
- Enable conditional access and MFA for all users; require phishing-resistant MFA for privileged users such as administrators.
- Limit access to Azure Key Vault, restrict public access, and retain Key Vault logs for up to a year.
- Use data protection options in Azure Storage and monitor high-risk Azure management operations.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe group used Kudu and Azure VM Run Command to execute commands remotely in app and VM contexts.T1059.006 · PythonThe group used custom Python scripts for enumeration and to exfiltrate data from Azure SQL and Storage.T1078.004 · Cloud AccountsStorm-2949 reportedly used compromised Microsoft Entra ID accounts to access Microsoft 365 and Azure resources.T1087.004 · Cloud AccountUsing Microsoft Graph API, the group enumerated users and roles in compromised environments.T1098.005 · Device RegistrationAfter resetting a victim's password and removing MFA controls, the group enrolled Microsoft Authenticator on its device.T1136 · Create AccountThe group reportedly used Azure VMAccess and Run Command to create rogue administrator accounts on Azure VMs.T1219 · Remote Access ToolsIn later attack stages, the group deployed ScreenConnect on compromised systems.T1526 · Cloud Service DiscoveryThe group used Microsoft Graph API to enumerate applications and service principals and assess persistence opportunities.T1530 · Data from Cloud StorageThe group searched and downloaded files from OneDrive and SharePoint and exfiltrated data from Azure Storage.T1562.001 · Disable or Modify ToolsThe group reportedly attempted to disable Microsoft Defender protections.T1621 · Multi-Factor Authentication Request GenerationThe group reportedly tricked targeted users into approving MFA prompts during the abused SSPR flow.
Threat Actors
Vendors
Products
AzureStorm-2949 is stealing sensitive data from Microsoft 365 and Azure production environments by abusing legitimate administration features and social engineering privileged users.Azure Key VaultTo protect cloud resources, the company advises limiting Azure RBAC permissions, keeping Azure Key Vault logs up to a year, reducing access to Key Vault, restricting public access to Key Vaults, using data protectionAzure SQLThe attackers also targeted Azure SQL servers and Storage accounts by changing firewall and network access rules, retrieving storage keys and SAS tokens, and exfiltrating data using custom Python scripts.Microsoft 365 Apps for EnterpriseStorm-2949 is stealing sensitive data from Microsoft 365 and Azure production environments by abusing legitimate administration features and social engineering privileged users.Microsoft AuthenticatorThe hacker then reset the password, removed the MFA controls, and enrolled Microsoft Authenticator on their device.Microsoft Defender Antimalware PlatformIn the later stages of the attack, Storm-2949 deployed the ScreenConnect remote access tool on compromised systems, attempted to disable Microsoft Defender protections, and wipe forensic evidence.Microsoft Entra IDThe attackers use social engineering and SSPR abuse to steal Microsoft Entra ID credentials.Microsoft GraphCompromised accounts are used to enumerate users, roles, apps, and service principals via Microsoft Graph API.Microsoft OneDriveNext, they accessed OneDrive and SharePoint in Microsoft 365, searching for VPN configurations and IT operational files, looking for remote access details that could help with lateral movement from the cloud into theMicrosoft SharePointNext, they accessed OneDrive and SharePoint in Microsoft 365, searching for VPN configurations and IT operational files, looking for remote access details that could help with lateral movement from the cloud into the