Unverified50% confidenceEventExact time
In the Storm-3168 incident, attackers first performed tenant mapping (enumerating resources, permissions, and asset relationships) before carrying out targeted deletion operations.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/2/2026
First Seen
Valid until: 12/31/2026
Sources
Related Entities
Related Claims
UnverifiedIn the Storm-3168 incident disclosed by Microsoft, attackers used only about seven minutes to complete full resource mapping of an entire tenant via two compromised Azure service principals and deleted storage accounts, Key Vaults, and multiple application resources.69% similarUnverifiedA typical attack workflow targeting S7 PLCs includes initial intrusion, lateral movement, target identification, logic tampering, and covert persistence.61% similarUnverifiedCommon prompt injection attack techniques include role hijacking, instruction override, context poisoning, and data exfiltration induction59% similarUnverifiedAPT attackers actively clear logs, forge timestamps, and leverage legitimate tools (i.e., Living off the Land) to evade detection.58% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/967326API
curl https://kongchang.com/api/v1/knowledge/claims/967326MCP
get_claim(id=967326)