Storm-0501 Exploits Entra ID to Exfiltrate and Delete Azure Data in Hybrid Cloud Attacks

The Storm-0501 threat actor has been refining its cloud-focused operations to exfiltrate data, destroy data and backups, and demand ransom in hybrid cloud environments. According to Microsoft Threat Intelligence, the group rapidly exfiltrates large volumes of data and uses cloud-native capabilities to carry out data destruction and extortion without relying on traditional on‑premises malware.

The campaign described involved moving between on‑premises and cloud environments, enumerating identities via Active Directory and Entra ID, and later compromising an Entra Connect server in a second tenant to extend access.

Microsoft notes that the attackers identified a non-human synced identity with a Global Admin role in Entra ID, reset the on‑prem password to synchronise to the cloud, and then registered a threat actor‑owned Entra ID tenant as a trusted federated domain to gain backdoor access before exfiltration and extortion. After exfiltration, the actors mass-deleted Azure resources and attempted to hinder remediation, with ransom negotiations reportedly conducted via Microsoft Teams.

The firm said Entra ID has been updated to restrict Directory Synchronization Accounts and Entra Connect Update 2.5.3[.]0 supports Modern Authentication, while enabling TPM on Entra Connect Sync servers is advised to mitigate credential‑extraction techniques. Storm-0501 has been active since 2021 and has previously been associated with several ransomware payloads and a shift from on‑premises to cloud operations.