Loading threat actor…
Storm-2949 is a cloud-focused threat actor tracked by Microsoft for methodical intrusions centered on identity compromise and abuse of legitimate Microsoft 365 and Azure control-plane features. The actor’s operations prioritize high-value enterprise assets and appear designed to maximize data theft rather than deploy traditional malware-heavy intrusion chains. Known targeting has included privileged identities such as senior leadership and internal IT personnel, followed by expansion across SaaS, PaaS, and IaaS resources in Microsoft cloud environments. A characteristic Storm-2949 intrusion begins with social engineering and credential phishing, including help-desk impersonation and reported technical-interview lures, to drive victims through multi-factor authentication fatigue and abuse of Self-Service Password Reset workflows. After taking over Microsoft Entra ID accounts, the actor removes legitimate authentication methods and enrolls attacker-controlled Microsoft Authenticator devices to maintain persistence. Post-compromise activity includes tenant and role enumeration through Microsoft Graph API and custom Python tooling, identification of privileged Azure RBAC paths, and attempts to establish additional persistence through identity and application abuse. Storm-2949 has repeatedly targeted Microsoft 365 data stores such as OneDrive and SharePoint, with particular interest in sensitive operational documentation including VPN and remote-access materials that can facilitate further compromise. The actor then pivots into Azure production environments by abusing legitimate administrative permissions and management-plane actions. Observed tradecraft includes retrieval of Azure App Service publishing profiles, use of deployment and management interfaces to access file systems and execute commands, rapid manipulation of Azure Key Vault access controls to obtain secrets, modification of Azure SQL firewall rules for direct database access, abuse of Azure Storage key and token mechanisms for bulk data theft, and use of Azure VM management features to create rogue administrator access and run scripts remotely. On virtual machines, Storm-2949 has used remote management tooling and Azure-native execution features for post-exploitation, including deployment of ScreenConnect and Syncro/Servably, attempts to disable Microsoft Defender protections, credential and certificate hunting, host and domain discovery, and artifact cleanup. The actor’s operations are notable for blending into normal administrative activity by relying heavily on legitimate cloud features, signed remote-management software, and authorized interfaces rather than custom malware. Storm-2949 is best characterized as an intrusion actor specializing in cloud identity takeover, privilege expansion, persistence, and large-scale exfiltration from Microsoft enterprise environments.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
42 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
11 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducted a cloud control-plane intrusion campaign centered on identity compromise, targeting enterprise administrative infrastructure across SaaS, PaaS, and IaaS. The group used social engineering and abuse of Microsoft Self-Service Password Reset to hijack accounts, establish persistence through attacker-controlled Microsoft Authenticator enrollment, enumerate Azure RBAC roles, access OneDrive and SharePoint data, compromise Azure App Service and Key Vault, manipulate Azure SQL and Storage firewall/access settings for exfiltration, and use VM management features to add backdoor admin access and disable defenses.
Targets Microsoft 365 and Azure environments to exfiltrate sensitive data from high-value assets by abusing legitimate cloud applications, identity workflows, and administrative features.
Associated in the content with a supply chain attack involving a compromised Nx Console VS Code extension that stole developer credentials, cloud tokens, and CI/CD secrets, and established persistence via a Python backdoor and sudoers modification.
Associated with a cloud-focused intrusion in which a compromised identity was leveraged to enable a broader cloud-wide breach.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.