Storm-2949

Storm-2949 is a cloud-focused threat actor tracked by Microsoft for methodical intrusions centered on identity compromise and abuse of legitimate Microsoft 365 and Azure control-plane features. The actor’s operations prioritize high-value enterprise assets and appear designed to maximize data theft rather than deploy traditional malware-heavy intrusion chains. Known targeting has included privileged identities such as senior leadership and internal IT personnel, followed by expansion across SaaS, PaaS, and IaaS resources in Microsoft cloud environments. A characteristic Storm-2949 intrusion begins with social engineering and credential phishing, including help-desk impersonation and reported technical-interview lures, to drive victims through multi-factor authentication fatigue and abuse of Self-Service Password Reset workflows. After taking over Microsoft Entra ID accounts, the actor removes legitimate authentication methods and enrolls attacker-controlled Microsoft Authenticator devices to maintain persistence. Post-compromise activity includes tenant and role enumeration through Microsoft Graph API and custom Python tooling, identification of privileged Azure RBAC paths, and attempts to establish additional persistence through identity and application abuse. Storm-2949 has repeatedly targeted Microsoft 365 data stores such as OneDrive and SharePoint, with particular interest in sensitive operational documentation including VPN and remote-access materials that can facilitate further compromise. The actor then pivots into Azure production environments by abusing legitimate administrative permissions and management-plane actions. Observed tradecraft includes retrieval of Azure App Service publishing profiles, use of deployment and management interfaces to access file systems and execute commands, rapid manipulation of Azure Key Vault access controls to obtain secrets, modification of Azure SQL firewall rules for direct database access, abuse of Azure Storage key and token mechanisms for bulk data theft, and use of Azure VM management features to create rogue administrator access and run scripts remotely. On virtual machines, Storm-2949 has used remote management tooling and Azure-native execution features for post-exploitation, including deployment of ScreenConnect and Syncro/Servably, attempts to disable Microsoft Defender protections, credential and certificate hunting, host and domain discovery, and artifact cleanup. The actor’s operations are notable for blending into normal administrative activity by relying heavily on legitimate cloud features, signed remote-management software, and authorized interfaces rather than custom malware. Storm-2949 is best characterized as an intrusion actor specializing in cloud identity takeover, privilege expansion, persistence, and large-scale exfiltration from Microsoft enterprise environments.