Storm-2949 Turned Entra ID Account Takeovers Into a Cloud-Wide Azure Breach

Microsoft reported that Storm-2949 used social engineering and abuse of Microsoft Self-Service Password Reset (SSPR) to compromise multiple Microsoft Entra ID accounts, including accounts tied to IT staff and senior leadership, then expanded access across Microsoft 365 and Azure. After the initial identity takeover, the actor conducted tenant discovery through the Microsoft Graph API, exfiltrated data from OneDrive and SharePoint, and sought persistence by re-registering MFA methods and attempting to abuse service principal credentials.

The intrusion then moved deeper into Azure, where Storm-2949 relied on legitimate management-plane operations and privileged Azure RBAC roles to access App Services, Key Vault, SQL databases, Storage accounts, and virtual machines. Microsoft said the actor used publish profiles, Key Vault permission changes, SQL firewall rule modifications, storage key listing, VMAccess, and Run Command to harvest credentials, execute code, deploy ScreenConnect on VMs, weaken Microsoft Defender Antivirus, and exfiltrate large volumes of data while blending into normal administrative activity; the group also cleared event logs and deleted artifacts to hinder detection.