Storm-0501: Azure Storage Account Key Abuse and Cloud Ransom
A cloud-native ransomware operation against a hybrid Microsoft Entra ID tenant, delivered entirely through the Azure control plane with no encryptor binary. A synced non-human identity holding Global Administrator without MFA is reused to sign in, a federated-domain SAML backdoor is planted, the operator elevates to Owner over every subscription, lists the storage account keys, exfiltrates the freight archive with AzCopy, deletes snapshots, restore points and the Recovery Services vault, then re-encrypts the surviving storage with a customer-managed key in an attacker key vault and extorts over Teams. Reconstruct the chain from the Azure Activity Log, storage diagnostics, and Entra sign-in telemetry, classifying the key-theft and encryption-for-impact techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Identify the identity that opened the cloud
35Every cloud operation that follows runs under one identity that should never have signed in. Identify the account behind the first malicious cloud sign-in.
Find the cloud persistence backdoor
35Before touching data, the operator made sure they could come back as anyone. Identify the domain they added to the tenant.
Classify the data-plane key abuse
30The operator turned a control-plane role into unrestricted access to every blob with one operation. Classify the MITRE technique for stealing those keys.
Pin the exfiltration channel
35The business data left before anything was destroyed. Identify the external IP that bulk-downloaded the freight archive.
Establish the recovery-destruction step
35Before encrypting, the operator made recovery impossible. Identify the backup resource whose deletion removed the last managed recovery path.
Classify the cloud encryption-for-impact
30No encryptor ran, yet the data became unreadable. Classify the technique behind the final impact.
Attribute the extortion message
35Close the loop on the ransom delivery. Identify the account used to send the Microsoft Teams ransom message.
8 tasks · 235 points total
Training Tools
Cloud Console
Cloud infrastructure logs
SIEM Console
Log analysis & SPL queries
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with Cloud concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allThree Gangs, One Affiliate: A Pre-Ransomware Intrusion
A five-day, hands-on-keyboard intrusion run by a single affiliate whose tooling overlaps with three ransomware operations, caught and evicted before any encryptor ran. The operator delivered a trojanized desktop utility, ran two parallel command channels, dumped LSASS, enumerated the domain, and exfiltrated a collection archive over FTP. Reconstruct the full pre-ransomware kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
HermeticWiper: Signed-Driver Destruction on the Eve of Invasion
A destructive, worm-assisted wiper operation run from inside an already-compromised Active Directory estate. An operator holding domain-administrator access pushed a binary signed to a code-signing identity to hosts over SMB, ran it as a service, and let it drop and load a legitimately signed EaseUS partition driver to reach the raw disk, overwrite the Master Boot Record, and shred the NTFS Master File Table. The crash-dump facility was disabled to slow forensics, a companion worm re-deployed the payload over SMB and WMI, and a decoy ransom note was dropped to misdirect responders. Reconstruct the destruction chain from SIEM, endpoint XDR, and firewall telemetry, and classify the key ATT&CK techniques.
Operation Lunar Peek: PAN-OS Mgmt Interface Takeover
An internet-exposed PAN-OS firewall management interface was taken over in a single night. An unauthenticated attacker bypassed authentication on the management web interface to gain PAN-OS administrator privileges, chained an authenticated command injection to run commands as root, created a rogue administrator for persistence, and wrote a PHP web shell under the appliance web root that a separate host returned to drive interactively. Reconstruct the full management-plane chain from the firewall and SIEM telemetry and classify the key ATT&CK techniques.