Identity as the Perimeter: Analyzing Storm-2949’s Sophisticated Azure and Microsoft 365 Exploitation

Modern threat actors are increasingly moving away from traditional file-based malware, opting instead for “living-off-the-cloud” techniques. A recent, highly methodical campaign conducted by a threat actor identified as Storm-2949 exemplifies this shift. This was not a blunt-force attack; it was a surgical, multi-layered operation designed with a singular objective: the systematic exfiltration of high-value data from deeply embedded cloud assets.

The campaign demonstrates a profound understanding of Azure Role-Based Access Control (RBAC). By abusing legitimate permissions, Storm-2949 successfully breached Key Vaults, storage accounts, and production environments, blending seamlessly into the noise of standard administrative activity.

Phase 1: Identity Compromise and Directory Reconnaissance

The intrusion began at the identity layer. Rather than exploiting software vulnerabilities, the attackers targeted human processes within Microsoft Entra ID. Using social engineering, the actors impersonated IT support personnel to manipulate users into approving Multi-Factor Authentication (MFA) prompts during the Self-Service Password Reset (SSPR) process.

Once an MFA prompt was successfully bypassed, the attackers executed a “lockout” maneuver: they reset account credentials, stripped existing authentication methods, and registered their own managed devices. This ensured persistent, long-term access while simultaneously denying legitimate users the ability to recover their accounts.

Following the initial foothold, Microsoft Threat Intelligence reports that Storm-2949 utilized the Microsoft Graph API for extensive directory reconnaissance. By deploying automated scripts to enumerate users, service principals, and application permissions, the attackers mapped the organizational hierarchy to pinpoint high-privileged accounts. This reconnaissance extended into Microsoft 365 environments, where they harvested sensitive documentation and VPN configurations from OneDrive and SharePoint to facilitate further lateral movement.

Phase 2: Escalation via Azure RBAC Abuse

The campaign transitioned from identity theft to infrastructure takeover as the actors pivoted into the Azure control plane. Leveraging the privileges gained from compromised accounts, they targeted the intersection of SaaS, PaaS, and IaaS layers.

A critical pivot point involved the exploitation of Azure App Services. By retrieving publishing profiles, the attackers gained access to deployment credentials and management interfaces like Kudu. While their initial attempts to directly breach the primary production application were unsuccessful, the attackers demonstrated high levels of adaptability.

They shifted their focus to Azure Key Vault. Utilizing accounts with “Owner” level permissions, they modified access policies to programmatically extract secrets, including database connection strings and authentication tokens. These stolen secrets provided the keys necessary to bypass secondary defenses and access the production application directly.

Simultaneously, the actors manipulated the network security posture of the cloud environment by:

• Modifying Azure SQL firewall rules to whitelist their own command-and-control (C2) IP addresses.
• Generating Storage Account access keys to facilitate the bulk downloading of data via custom automation scripts.
• Performing “cleanup” operations, such as reverting firewall changes, to minimize the forensic footprint.

Phase 3: Endpoint Persistence and VM Manipulation

Storm-2949 did not limit their activity to the cloud control plane; they also targeted the compute layer. By abusing legitimate Azure VM Extensions—specifically Run Command and VMAccess—the attackers bypassed traditional perimeter security to execute code directly on virtual machines.

These extensions were used to create backdoor administrator accounts and deploy remote management tools like ScreenConnect. By disguising these tools as legitimate administrative processes, the attackers maintained a foothold for continuous credential harvesting and local reconnaissance.

Strategic Takeaways for Defenders

The Storm-2949 campaign highlights a fundamental evolution in the threat landscape: the move from malware-centric attacks to identity-centric attacks. Detection can no longer rely solely on spotting malicious binaries; it requires sophisticated, behavior-based monitoring that correlates signals across identity, cloud management, and endpoint telemetry.

To defend against such sophisticated actors, organizations must move beyond basic MFA and embrace a strict Zero Trust architecture, prioritizing the principle of least privilege (PoLP) and continuous monitoring of administrative API calls.

Indicators of Compromise (IOCs)

Attacker egress pointAttacker egress pointScreenConnect instance used by actor

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution. Please re-fang these indicators only within a secure, controlled environment such as a SIEM, MISP, or VirusTotal.