Hackers Exploit Azure RBAC to Steal Key Vault Secrets

Hackers are increasingly exploiting cloud identity and access management systems, and a methodical, sophisticated, and multi-layered attack, where a threat actor we track as Storm-2949 launched a relentless campaign with a singular focus: to exfiltrate as much sensitive data from a target organization’s high-value assets as possible.

The attack, attributed to a threat actor tracked as Storm-2949, demonstrates how Azure role-based access control (RBAC) permissions can be abused to steal sensitive data from Key Vaults, storage accounts, and production cloud environments.

The operation began with targeted identity compromise and quickly escalated into a large-scale cloud takeover. Instead of deploying traditional malware, the attackers relied entirely on legitimate Microsoft cloud features, allowing them to blend into normal administrative activity while expanding their access across Microsoft 365 and Azure services.

The initial entry point involved social engineering techniques that exploited Microsoft Entra ID accounts. The attackers abused the Self-Service Password Reset (SSPR) process by impersonating IT support staff and convincing users to approve multifactor authentication prompts.

Once approved, the attackers reset account credentials, removed existing authentication methods, and registered their own devices for persistent access. This effectively locked out legitimate users while maintaining long-term control.

According to Microsoft Threat Intelligence, Storm-2949 conducted extensive directory reconnaissance using Microsoft Graph API. Automated scripts were used to enumerate users, roles, and applications, helping the attackers identify privileged accounts and expand their foothold.

They then accessed Microsoft 365 services such as OneDrive and SharePoint, exfiltrating sensitive files, including VPN configurations and internal documentation that could aid further lateral movement.

Hackers Exploit Azure RBAC

The attack intensified when the threat actor pivoted to Azure environments. Using compromised accounts with privileged RBAC roles, they targeted critical cloud resources, including Azure App Services, Key Vaults, storage accounts, and SQL databases. Their objective was clear: locate and extract high-value secrets and production data.

The attack spanned various Azure resources, with emphasis on software-as-a-service (SaaS), platform-as-a-service (PaaS), and infrastructure-as-a-service (IaaS) layers.

A key breakthrough came when the attackers exploited RBAC permissions to retrieve publishing profiles from Azure App Services.

This allowed them to access deployment credentials and management interfaces such as Kudu, enabling deeper inspection of application environments. Although initial attempts to access the primary production application failed, the attackers adapted their strategy.

They shifted focus to Azure Key Vault, where sensitive credentials are often stored. With Owner-level permissions on a Key Vault, Storm-2949 modified access policies and extracted numerous secrets within minutes.

These included database credentials and authentication tokens, which ultimately enabled them to access the targeted production application and begin data exfiltration.

In parallel, the attackers manipulated Azure SQL firewall rules to allow their own IP addresses and used stolen credentials to access databases.

They also abused storage account permissions to generate access keys and download large volumes of data using custom scripts. These actions were carefully followed by cleanup efforts, such as removing firewall rules, to evade detection.

Beyond cloud services, Storm-2949 also compromised virtual machines by abusing Azure VM extensions like Run Command and VMAccess. They created backdoor administrator accounts, attempted credential harvesting, and deployed remote management tools such as ScreenConnect.

These tools were disguised as legitimate processes and used to perform reconnaissance and collect additional credentials from compromised systems.

Microsoft noted that the attack generated multiple alerts across cloud and endpoint environments, which were correlated to provide a full view of the intrusion. This highlights the importance of behavior-based detection systems that can link identity, cloud, and endpoint activity.

This campaign underscores a broader shift in cyberattacks, where identity compromise and control-plane abuse are replacing traditional malware-driven intrusions.

Organizations relying heavily on cloud infrastructure must prioritize identity protection, enforce least-privilege access, and monitor administrative actions closely to defend against similar threats.

Indicators of compromise (IOCs)

Indicator	Type	Description
176.123.4[.]44	IP address	Attacker egressed from this address
91.208.197[.]87	IP address	Attacker egressed from this address
185.241.208[.]243	IP address	ScreenConnect instance used by Attacker

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.