Executive Summary
Microsoft Threat Intelligence has identified a sophisticated campaign by Storm-2949 targeting Microsoft 365 and Azure cloud environments. The actor initiates attacks through social engineering, specifically abusing Self-Service Password Reset (SSPR) workflows to hijack multifactor authentication (MFA) and gain persistent identity access. Once inside, the actor avoids traditional malware, instead utilizing legitimate administrative features and the Microsoft Graph API to move laterally and discover high-value assets.
The attack progresses from SaaS identity theft to full-scale Azure infrastructure compromise, affecting App Services, Key Vaults, SQL databases, and Storage accounts. By abusing Azure Resource Manager (ARM) operations and VM extensions like Run Command, Storm-2949 executes code and extracts sensitive credentials to facilitate large-scale exfiltration of production data.
This campaign highlights a shift toward control-plane abuse where legitimate management tools are weaponized. Organizations are urged to enforce phishing-resistant MFA, restrict Azure RBAC permissions, and monitor for unusual service principal modifications or unauthorized SQL firewall changes.