Storm-0501: Azure Storage Account Key Abuse and Cloud Ransom
A cloud-native ransomware operation against a hybrid Microsoft Entra ID tenant, delivered entirely through the Azure control plane with no encryptor binary. A synced non-human identity holding Global Administrator without MFA is reused to sign in, a federated-domain SAML backdoor is planted, the operator elevates to Owner over every subscription, lists the storage account keys, exfiltrates the freight archive with AzCopy, deletes snapshots, restore points and the Recovery Services vault, then re-encrypts the surviving storage with a customer-managed key in an attacker key vault and extorts over Teams. Reconstruct the chain from the Azure Activity Log, storage diagnostics, and Entra sign-in telemetry, classifying the key-theft and encryption-for-impact techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Identify the identity that opened the cloud
35Every cloud operation that follows runs under one identity that should never have signed in. Identify the account behind the first malicious cloud sign-in.
Find the cloud persistence backdoor
35Before touching data, the operator made sure they could come back as anyone. Identify the domain they added to the tenant.
Classify the data-plane key abuse
30The operator turned a control-plane role into unrestricted access to every blob with one operation. Classify the MITRE technique for stealing those keys.
Pin the exfiltration channel
35The business data left before anything was destroyed. Identify the external IP that bulk-downloaded the freight archive.
Establish the recovery-destruction step
35Before encrypting, the operator made recovery impossible. Identify the backup resource whose deletion removed the last managed recovery path.
Classify the cloud encryption-for-impact
30No encryptor ran, yet the data became unreadable. Classify the technique behind the final impact.
Attribute the extortion message
35Close the loop on the ransom delivery. Identify the account used to send the Microsoft Teams ransom message.
8 tasks · 235 points total
Training Tools
Cloud Console
Cloud infrastructure logs
SIEM Console
Log analysis & SPL queries
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with Cloud concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allThree Gangs, One Affiliate: A Pre-Ransomware Intrusion
A five-day, hands-on-keyboard intrusion run by a single affiliate whose tooling overlaps with three ransomware operations, caught and evicted before any encryptor ran. The operator delivered a trojanized desktop utility, ran two parallel command channels, dumped LSASS, enumerated the domain, and exfiltrated a collection archive over FTP. Reconstruct the full pre-ransomware kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
HermeticWiper: Signed-Driver Destruction on the Eve of Invasion
A destructive, worm-assisted wiper operation run from inside an already-compromised Active Directory estate. An operator holding domain-administrator access pushed a binary signed to a code-signing identity to hosts over SMB, ran it as a service, and let it drop and load a legitimately signed EaseUS partition driver to reach the raw disk, overwrite the Master Boot Record, and shred the NTFS Master File Table. The crash-dump facility was disabled to slow forensics, a companion worm re-deployed the payload over SMB and WMI, and a decoy ransom note was dropped to misdirect responders. Reconstruct the destruction chain from SIEM, endpoint XDR, and firewall telemetry, and classify the key ATT&CK techniques.
Midnight Blizzard: Malicious Entra App Registration and Service Principal Abuse
A nation-state-style identity-plane intrusion that lives entirely in Microsoft Entra ID and Exchange Online. A low-and-slow password spray across rotating residential-proxy IPs lands on a legacy, no-MFA test account; from there the actor pivots into the application layer, creates a rogue user, registers a new malicious application and service principal, grants it the Office 365 Exchange Online full_access_as_app role plus EWS.AccessAsUser.All, adds a client secret for durable app-only access, and reads corporate mailboxes over Exchange Web Services with no user sign-in. Work the Entra sign-in audit, the application and service-principal lifecycle and role-assignment events, the credential change, and the EWS mailbox operations to reconstruct the chain and classify the key ATT&CK techniques.