Storm-2949 turned Self-Service Password Reset into a full Azure breach

No malware in the identity phase. A phone call impersonating IT support, a triggered SSPR, an approved MFA prompt — and then dozens of secrets pulled from a single Key Vault in about four minutes.

At a glance

Affected

Entra ID tenants where privileged users are in scope for Self-Service Password Reset, and Azure subscriptions with permissive custom RBAC roles.

Impact

Account takeover with attacker-registered MFA, thousands of files taken from OneDrive and SharePoint, App Service publishing profiles and Key Vault secrets extracted, rogue local administrators created on virtual machines.

Action

Exclude administrative roles from SSPR entirely, require two methods to reset, enforce Authentication Strengths for admins, and enable Key Vault purge protection with Private Endpoints.

Client status

SSPR scope and administrative exclusions are part of our standard Entra baseline. Clients who inherited a tenant from another provider should have this audited — it is a common default gap.

Report an incident

Detail

Self-Service Password Reset is a helpdesk cost-saving feature. Storm-2949 used it as the entire initial access vector, and the case is worth reading because nothing in the identity phase involved malware, exploits or phishing pages.

The operators phoned targeted privileged users — IT staff and senior leadership — impersonating internal IT support. They triggered SSPR for the victim's account, talked the victim into approving the resulting MFA prompt, and completed the reset. Then they deleted the user's existing authentication methods and enrolled their own Authenticator. A phone call became durable identity persistence.

What followed

Reconnaissance ran through custom Python scripts calling Microsoft Graph to enumerate users, applications and service principals. The same SSPR technique was then reused to take three further cloud accounts — once it works, it keeps working.

They exfiltrated thousands of files from OneDrive and SharePoint, hunting specifically for VPN configurations and remote-access runbooks. They abused privileged custom Azure RBAC roles to pull App Service publishing profiles and Key Vault secrets — dozens of secrets from one vault in roughly four minutes, including database connection strings and identity credentials. They manipulated SQL and Storage firewall rules, and used the VMAccess extension and Run Command to create rogue local administrators and install ScreenConnect.

The specific settings to change

Exclude administrative roles from SSPR. There is no scenario in which a Global Administrator should be able to reset their own password over the phone with a single approval, and this case is the demonstration. Require two authentication methods for any reset that remains in scope, and enable the option requiring re-registration when SSPR is re-enabled for a user.

On the Azure side: audit custom RBAC roles, disable App Service basic authentication in favour of managed identity, enable Key Vault purge protection with 90-day retention, retain Key Vault logs for a year, and use Private Endpoints to remove public network access from Key Vault and Storage. Restrict VM extension deployment through Azure Policy — the VMAccess extension is a legitimate feature that is also a remote code execution primitive for anyone with the right role.

Microsoft states this cluster is not linked to ShinyHunters or to the device-code phishing campaigns. It is a separate financially motivated group arriving at the same conclusion everyone else has: the identity layer is where the leverage is.

If you find evidence of this activity, do not begin remediation before preserving evidence — console and appliance audit logs are frequently short-retention and will roll off. Acronis MDR provides around-the-clock detection and response for covered estates; otherwise reach us through the contact page and we will advise on preservation before containment.

Sources

Cybernalyst's analysis and recommendations are our own. The underlying research is credited below — please read the original reporting.

How Storm-2949 turned a compromised identity into a cloud-wide breachMicrosoft Defender Security Research Team·Microsoft Security Blog·18 May 2026
Microsoft Self-Service Password Reset abused in Azure data theft attacksBill Toulas·BleepingComputer·19 May 2026

← All advisories