A sophisticated threat actor designated Storm-2949 is conducting data theft operations against Microsoft 365 and Azure environments by exploiting legitimate password recovery mechanisms, according to security reporting from BleepingComputer.
The campaign represents a notable evolution in cloud-native attacks, leveraging Microsoft's own Self-Service Password Reset (SSPR) functionality to gain unauthorized access while evading traditional detection systems. Because SSPR operations originate from Microsoft's authentication infrastructure, the malicious activity blends into standard administrative traffic logs.
Attack Methodology
Storm-2949's operations follow a multi-stage intrusion pattern that begins with compromising Microsoft 365 accounts before pivoting into Azure production workloads. Once inside, the threat actor deploys legitimate management tools to harvest credentials from Azure Key Vault instances, modify firewall configurations, and extract sensitive data at scale.
What distinguishes this campaign is the abuse of built-in identity management features rather than exploiting software vulnerabilities. When attackers trigger SSPR operations, the resulting authentication events appear identical to legitimate password recovery attempts, creating significant blind spots for conventional security monitoring tools.
According to Microsoft's threat intelligence reporting, the group combines technical manipulation with social engineering tactics. Operators have been observed impersonating IT support personnel to convince privileged users into approving multi-factor authentication prompts. Once access is obtained, attackers remove existing MFA controls and register their own devices for persistent access.
Detection Challenges
Security teams face particular difficulty identifying these intrusions because SSPR reset events generate standard encrypted logs that match normal administrative patterns. Effective detection requires advanced identity analytics capable of correlating password reset events with subsequent privilege escalation attempts and unusual data access patterns.
The attack demonstrates a broader industry shift where identity systems have become the primary security perimeter. Traditional network-based defenses provide limited protection when attackers operate from within authenticated sessions using approved administrative functions.
Broader Implications for Cloud Security
This campaign underscores the growing sophistication of threats targeting cloud identity infrastructure. As organizations migrate critical workloads to Azure and Microsoft 365 platforms, attackers are adapting techniques that exploit the trust relationships inherent in these ecosystems.
The Storm-2949 operations highlight several critical concerns for IT security teams managing Microsoft cloud environments. First, legitimate administrative tools can be repurposed for malicious ends without triggering alert thresholds designed to catch unauthorized software deployment. Second, the integration between Microsoft 365 and Azure creates pathways for lateral movement that require coordinated monitoring across both platforms.
Organizations relying heavily on Microsoft's identity management stack should review their SSPR configurations and implement additional verification steps for password reset operations involving privileged accounts. Security teams may need to deploy identity threat detection and response capabilities that analyze behavioral patterns rather than relying solely on event log analysis.
Microsoft continues to update its defender platforms with detection rules specific to this campaign, though the fundamental challenge remains: distinguishing malicious use of legitimate features from normal administrative activity requires contextual analysis that extends beyond individual event inspection.
The Storm-2949 campaign serves as a reminder that cloud migration introduces new attack surfaces that demand corresponding evolution in security monitoring strategies. As identity becomes the de facto perimeter, organizations must invest in detection capabilities that can identify abuse of trusted systems before data exfiltration occurs.
根據 BleepingComputer 嘅安全報道，一個名為 Storm-2949 嘅高級威脅組織，正利用合法嘅密碼恢復機制，喺 Microsoft 365 同 Azure 環境入面進行數據盜竊行動。
呢次行動代表咗雲端原生攻擊嘅一個顯著演變，佢哋利用 Microsoft 自家嘅自助密碼重設（SSPR）功能，喺規避傳統偵測系統嘅同時取得未經授權嘅訪問權限。由於 SSPR 操作係由 Microsoft 嘅身份驗證基礎設施發出，所以呢啲惡意活動會同標準嘅管理流量日誌混為一談，好難分辨。
攻擊手法
Storm-2949 嘅行動跟住一套多階段入侵模式，由入侵 Microsoft 365 帳戶開始，然後轉戰到 Azure 嘅生產環境。一旦入到去，佢哋就會部署合法嘅管理工具，由 Azure Key Vault 實例度偷取憑證、修改防火牆設定，同埋大規模提取敏感數據。
呢次行動最特別嘅地方，係佢哋濫用內建嘅身份管理功能，而唔係利用軟件漏洞。當攻擊者觸發 SSPR 操作時，產生嘅身份驗證事件會同合法嘅密碼重設嘗試一模一樣，令到傳統嘅安全監控工具出現好大嘅盲點。
根據 Microsoft 嘅威脅情報報道，呢個組織會將技術操作同社會工程學手法結合埋一齊。觀察發現，佢哋會假扮 IT 支援人員，勸服有權限嘅用戶批准多因素身份驗證（MFA）提示。一旦取得權限，攻擊者就會移除現有嘅 MFA 控制，並登記自己嘅裝置嚟保持長期訪問權。
偵測難點
安全團隊喺識別呢啲入侵時面臨特別大嘅困難，因為 SSPR 重設事件生成嘅係標準加密日誌，同正常嘅管理模式一模一樣。要有效偵測到，就需要先進嘅身份分析技術，能夠將密碼重設事件同之後嘅權限提升嘗試同異常數據訪問模式關聯埋一齊。
呢次攻擊顯示咗業界一個更大嘅轉變，就係身份系統已經成為主要嘅安全邊界。當攻擊者喺已驗證嘅會話入面，利用經批准嘅管理功能進行操作時，傳統基於網絡嘅防禦措施就顯得保護力有限。
對雲端安全嘅廣泛影響
呢次行動突顯咗針對雲端身份基礎設施嘅威脅日益複雜。隨著企業將關鍵工作負載遷移去 Azure 同 Microsoft 365 平台，攻擊者亦都在調整手法，利用呢啲生態系統內建嘅信任關係。
Storm-2949 嘅行動為管理 Microsoft 雲端環境嘅 IT 安全團隊點出幾個關鍵問題。首先，合法嘅管理工具可以被轉作惡意用途，而唔會觸發專門針對未經授權軟件部署嘅警報閾值。其次，Microsoft 365 同 Azure 之間嘅整合創造咗橫向移動嘅路徑，需要喺兩個平台之間進行協調監控。
依賴 Microsoft 身份管理架構嘅組織應該檢視自己嘅 SSPR 設定，並喺涉及權限帳戶嘅密碼重設操作中增加額外嘅驗證步驟。安全團隊可能需要部署身份威脅偵測同回應能力，去分析行為模式，而唔係單單依賴事件日誌分析。
Microsoft 持續更新佢嘅 Defender 平台，加入針對呢次行動嘅偵測規則，不過根本嘅挑戰依然存在：要區分合法功能嘅惡意使用同正常管理活動，需要進行超出單一事件檢查嘅情境分析。
Storm-2949 嘅行動提醒咗我哋，雲端遷移帶嚟咗新嘅攻擊面，需要安全監控策略跟住進化。當身份成為實際嘅安全邊界，企業必須投資偵測能力，喺數據被竊取之前識別出對受信任系統嘅濫用。