Storm-2949Threat actor
Storm-2949 is a sophisticated threat actor that exploited Microsoft’s Self-Service Password Reset process to compromise high-value accounts, primarily targeting IT personnel and senior leadership. They leveraged Azure tools and APIs to conduct reconnaissance, exfiltrate sensitive data from Microsoft 365 applications, and manipulate Azure resources, including Key Vaults and SQL databases.From MISP Galaxy
Last reported 27 days ago, by CERT-EU1 report
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1195Supply Chain Compromise
“…ers to target government and defence organisations in Asia and Poland, while another China-linked threat actor enacted a global supply-chain compromise leveraging Daemon Tools installers distributed from the software's legitimate site.”
- T1213.003Code Repositories
“… 19, GitHub began investigating unauthorised access to internal repositories, with TeamPCP claiming theft of roughly 4.000 private code repositories and seeking to sell the data.”
- T1219Remote Access Tools
“They hosted company laptops in the US, installed remote access tools, and helped overseas operatives pose as US-based employees, generating over 1.2 million US dollars for North Korea and affecting nearly 70 US firms.”
- T1485Data Destruction
“…ing an agreement with the threat actor, the group reportedly returned the data to Instructure, and received digital confirmation of data destruction.”
- T1505.003Web Shell
“UAT-8616 exploited Cisco Catalyst SD-WAN vulnerabilities to gain admin access and deploy web shells”
- T1684Social Engineering
“Authorities cited phishing and social-engineering attacks targeting public officials, including campaigns impersonating Signal support staff to hijack accounts, amid growing concerns over foreign-linked cyber threats and digital sovereignty.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Cyber Brief 26-06 - May 2026“On May 20, Microsoft reported Storm-2949 conducted a sustained, identity-driven campaign to steal sensitive data from a victim’s cloud environment.”
Thanks — we review every report.