How Storm-2949 turned a compromised identity into a cloud-wide breach

Storm-2949 turned stolen credentials into a cloud-wide breach, moving from identity compromise to large-scale data theft without using malware. This incident shows how threat actors can exploit trusted systems to operate undetected. The post How Storm-2949 turned a compromised identity into a cloud-wide breach appeared first on Microsoft Security Blog .

In this article Attack chain overview Cloud compromise: Microsoft Entra ID and Microsoft 365 Initial access and persistence through targeted social engineering and SSPR abuse Directory discovery and persistence Microsoft 365 discovery and exfiltration Cloud compromise: Microsoft Azure Azure App Service and Key Vault compromise Azure Storage and SQL data exfiltration Azure Virtual Machines compromise ScreenConnect installation and defense evasion Post-compromise activity using ScreenConnect Mitigation and protection guidance Ensure adequate security coverage across attack surfaces Security hardening and best practices General hygiene recommendations Indicators of compromise (IOCs) Microsoft Defender XDR detections Learn more Microsoft Threat Intelligence recently uncovered a methodical, sophisticated, and multi-layered attack, where a threat actor we track as Storm-2949 launched a