Threat Intelligence · Cloud Security · Identity Security
Storm-2949: When Cloud Identity Becomes the Attack
Just your own cloud tools.
Storm-2949 shows how trusted identities, native cloud features, and weak control-plane governance can become the breach path.
Microsoft Threat Intelligence published an analysis of Storm-2949, a threat actor that used compromised cloud identity as the foundation for broader access across Microsoft Entra ID, Microsoft 365, Azure, and cloud-hosted data services.
The important lesson is uncomfortable: once attackers control a sufficiently privileged identity, many of their actions can look like ordinary administration. They can access documents, inspect cloud resources, change firewall rules, interact with Key Vault, and abuse trusted management-plane operations.
Identity is the new perimeter — but in Storm-2949, identity also became the attacker’s operating platform.
The Attack in Four Acts
Initial Access
Collection
Credential Access
Defense Evasion
Why This Matters for Defenders
The Storm-2949 pattern is dangerous because the attacker does not need to deploy noisy tooling to achieve impact. In a cloud-native environment, configuration changes, identity actions, and management-plane calls can be the attack path.
| Phase | Defender Concern | Priority Control | Risk |
|---|---|---|---|
| Identity compromise | SSPR abuse, MFA fatigue, helpdesk impersonation, risky sign-ins | Phishing-resistant MFA, number matching, conditional access, SSPR governance | Critical |
| Microsoft 365 access | Bulk file access and sensitive document discovery | M365 audit logs, DLP alerts, impossible travel, session risk controls | High |
| Azure privilege abuse | Owner-level roles, excessive RBAC assignments, stale privileged accounts | Least privilege, PIM/JIT access, break-glass governance, access reviews | Critical |
| Key Vault exposure | Secrets, certificates, credentials, application passwords | Vault separation, private endpoints, managed identities, rotation, alerting | Critical |
| Control-plane changes | Firewall rule changes, storage changes, application settings, cleanup activity | Azure Policy, IaC drift detection, GitOps reconciliation, SIEM correlation | High |
| Endpoint reconnaissance | Credential harvesting, certificates, remote administration tools | EDR, device compliance, certificate inventory, privileged workstation controls | Medium |
The IaC and Crossplane Angle Paolo Raised
Paolo made an important point: Infrastructure as Code and reconciliation loops change the defender’s position. They may not stop the initial social-engineering compromise, but they can make attacker-made configuration changes much harder to keep in place.
1. Desired State
Git, Terraform/OpenTofu, Crossplane, Bicep, ARM, or policy-as-code defines how the cloud environment should look.
2. Continuous Reconciliation
A control plane or GitOps process compares the live cloud state to the approved source of truth.
3. Drift Reverted
Unauthorized firewall, RBAC, Key Vault, or service configuration changes can be reverted automatically.
This is where the Storm-2949 discussion becomes more mature. Identity protection is necessary, but not enough. Defenders also need cloud configuration integrity. If an attacker changes a firewall rule or grants temporary access, the environment should detect the drift, revert the change, and alert the security team.
In practice, tools and patterns such as Crossplane, Terraform/OpenTofu, Azure Policy, GitOps, CI/CD guardrails, and configuration drift monitoring can create operational friction for attackers. That friction matters. It can reduce persistence time, increase attacker noise, and create better detection opportunities.
Three Things Your Team Should Do Now
Storm-2949 did not need to break the cloud. It used trust, identity, and configuration pathways already available inside the cloud.
Final Thought
The defensive lesson is clear: modern cloud security must combine identity governance, privilege minimisation, configuration drift control, IaC reconciliation, and unified telemetry.
Zero Trust should not only ask, “Can this user sign in?” It should also ask: Should this identity be able to change this control plane, extract this secret, alter this firewall rule, or rewrite this source of truth?
- Microsoft Security Blog — How Storm-2949 turned a compromised identity into a cloud-wide breach
- Crossplane documentation — Crossplane: Cloud Native Control Plane
- OpenTofu documentation — OpenTofu Infrastructure as Code documentation
- Microsoft Learn — Microsoft Entra Conditional Access
- Microsoft Learn — Azure Key Vault security features
