Storm-3168
The first ransomware campaign documented by Microsoft as 'agentic,' in which compromised Azure service principal credentials were leveraged by automated components with autonomous decision-making capabilities to carry out rapid destruction of cloud resources.
Timeline (last 90 days)
In the Storm-3168 incident disclosed by Microsoft, attackers used only about seven minutes to complete full resource mapping of an entire tenant via two compromised Azure service principals and deleted storage accounts, Key Vaults, and multiple application resources.
In the Storm-3168 incident, attackers first performed tenant mapping (enumerating resources, permissions, and asset relationships) before carrying out targeted deletion operations.
For attacks at the seven-minute level, passive log retrospection is almost meaningless; behavioral baselines and real-time alerting or even automated blocking should be established for management plane operations.
All Facts (3)
For attacks at the seven-minute level, passive log retrospection is almost meaningless; behavioral baselines and real-time alerting or even automated blocking should be established for management plane operations.
50%UnverifiedIn the Storm-3168 incident disclosed by Microsoft, attackers used only about seven minutes to complete full resource mapping of an entire tenant via two compromised Azure service principals and deleted storage accounts, Key Vaults, and multiple application resources.
50%UnverifiedIn the Storm-3168 incident, attackers first performed tenant mapping (enumerating resources, permissions, and asset relationships) before carrying out targeted deletion operations.
50%