Unverified50% confidenceEventExact time
In the Storm-3168 incident disclosed by Microsoft, attackers used only about seven minutes to complete full resource mapping of an entire tenant via two compromised Azure service principals and deleted storage accounts, Key Vaults, and multiple application resources.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/2/2026
First Seen
Valid until: 12/31/2026
Sources
Related Entities
Related Claims
UnverifiedIn the Storm-3168 incident, attackers first performed tenant mapping (enumerating resources, permissions, and asset relationships) before carrying out targeted deletion operations.69% similarUnverifiedAzure provides mechanisms such as resource locks, soft delete, and Key Vault purge protection, which, when enabled, can retain a recovery window for deleted resources.63% similarUnverifiedData tracking shows that 98.5% of edits came from Microsoft Azure IP addresses, with the first edit occurring on May 11 and stopping on June 22.58% similarUnverified已有案例显示设备 Agent 曾删除系统文件导致系统崩溃，国家安全部门也曾发出安全提醒55% similarUnverifiedAzure Storage's table service once suffered a far-reaching outage caused by a developer who rewrote the table interface code to optimize Xbox performance, but the untested blob interface entered an infinite loop on zero-byte-length requests, causing the storage frontend to hang.55% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/967323API
curl https://kongchang.com/api/v1/knowledge/claims/967323MCP
get_claim(id=967323)