Storm-2949

Storm-2949 is a threat actor tracked by Microsoft Threat Intelligence that conducts methodical, multi-layered intrusions focused on Microsoft 365, Microsoft Entra ID, and Azure cloud control planes, with the apparent objective of exfiltrating sensitive data from high-value assets. The content describes the actor targeting privileged users, including IT personnel and senior leadership, using social engineering such as fake help-desk interactions and a technical interview pretext to drive MFA-fatigue and abuse Microsoft Self-Service Password Reset (SSPR). After account takeover, the actor removes existing authentication methods, re-registers MFA on attacker-controlled Microsoft Authenticator devices, and uses Microsoft Graph API and custom Python scripts to enumerate users, roles, applications, and privileged custom Azure RBAC roles. Post-compromise, Storm-2949 is described abusing legitimate administrative features across SaaS, PaaS, and IaaS environments rather than relying primarily on custom malware. Reported activity includes exfiltration of files from OneDrive and SharePoint, especially VPN and remote access documentation; retrieval of Azure App Service publishing profiles via microsoft.Web/sites/publishxml/action to gain FTP, Web Deploy, and Kudu access; rapid manipulation of Azure Key Vault access to obtain secrets such as database connection strings and identity credentials; modification of Azure SQL firewall rules for direct database access followed by deletion of those rules; abuse of storage account write and listkeys permissions to enable blob exfiltration and generate SAS-related access; and use of Azure VMAccess and Run Command to create rogue local administrator accounts, execute PowerShell, attempt to disable Microsoft Defender protections, and deploy ScreenConnect. The content also states that Storm-2949 used legitimate remote management tools including ConnectWise ScreenConnect and Syncro/Servably for persistence and remote access, and that Microsoft identified attacker infrastructure including 176.123.4[.]44, 91.208.197[.]87, and a ScreenConnect instance at 185.241.208[.]243:9090. No additional aliases or sub-groups beyond Storm-2949 are directly supported in the provided content.