Storm-2949 is a threat actor exploiting Microsoft Self-Service Password Reset to compromise high-value Azure accounts.
Analyst brief
Storm-2949 is a threat actor that compromises high-value accounts, primarily targeting IT personnel and senior leadership, by exploiting Microsoft's Self-Service Password Reset process. They use Azure tools and APIs to perform reconnaissance, exfiltrate sensitive data from Microsoft 365 applications, and manipulate Azure resources including Key Vaults and SQL databases. The actor employs social engineering tactics to bypass MFA and utilizes custom Python scripts for directory discovery and data exfiltration. Defenders should focus on detecting lateral movement across cloud and endpoint environments that mimics legitimate administrative behavior.
Storm-2949
unknown
Storm-2949 is a sophisticated threat actor that exploited Microsoft’s Self-Service Password Reset process to compromise high-value accounts, primarily targeting IT personnel and senior leadership. They leveraged Azure tools and APIs to conduct reconnaissance, exfiltrate sensitive data from Microsoft 365 applications, and manipulate Azure resources, including Key Vaults and SQL databases. The actor employed social engineering tactics to bypass MFA and utilized custom Python scripts for directory discovery and data exfiltration. Their operations included lateral movement across cloud and endpoint environments while mimicking legitimate administrative behavior.