Storm-2949 Didn't Break In. They Logged In.

Here's the entire campaign in one sentence: an attacker phished a few MFA prompts, reset some passwords, and then used Microsoft's own administrative tooling — Graph API, publishing profiles, Run Command, VMAccess, storage account keys — to walk out with the contents of an organization's Microsoft 365 tenant, its Key Vaults, its SQL databases, and its storage accounts.

No malware. No zero-days. No exploit code.

Just credentials, and a cloud architecture that assumes credentials mean trust.

The four-minute vault

One detail deserves to be framed and hung on the wall of every CISO's office. Once Storm-2949 reached a Key Vault where a compromised user held the Owner role, it took them four minutes to reconfigure access and extract dozens of secrets. Database connection strings. Identity credentials. The keys to the production application they'd been after the whole time.

Four minutes. That's the blast radius of centralized secrets behind identity-based access control. The vault did exactly what it was designed to do: it gave the keys to whoever held the right identity. The attacker held the right identity.

This is the part nobody wants to say out loud: the system worked as designed. Every action Storm-2949 took was a legitimate management-plane operation. Microsoft's own write-up acknowledges it — the attacker "blended into expected administrative behavior." Of course they did. They were an administrator. They had the credentials to prove it.

Access control is not encryption

The cloud security industry has spent two decades building a fortress around a flawed premise: that controlling who can ask for data is the same as controlling who can read it.

It isn't.

When your data sits in plaintext — or in encryption where the provider, the platform, or any compromisable identity holds the keys — then every access control is just a speed bump between an attacker and your data. Conditional Access, phishing-resistant MFA, RBAC audits, private endpoints — Microsoft's mitigation section lists them all, and they're all worth doing. They raise the cost of attack.

But notice what every single recommendation has in common: they all try to keep the wrong person from asking. None of them changes what the attacker gets when the asking succeeds.

And the asking always eventually succeeds. Storm-2949 didn't defeat MFA with cryptography. They defeated it with a phone call.

What this looks like under a different architecture

Now run the same attack against a zero-knowledge, sharded architecture.

The attacker phishes the same user. Resets the same password. Enrolls their own authenticator. They're in. Full credentialed access.

What do they get?

Ciphertext fragments. Data encrypted client-side with keys the platform never held, then erasure-coded into shards distributed across independent jurisdictions and providers. The compromised identity can see that shards exist. It cannot read them. There is no Key Vault to drain in four minutes, because the keys were never in the provider's custody to begin with. There is no storage account whose access keys unlock the data, because the storage account only ever held mathematically meaningless fragments.

The breach still happens. The disclosure doesn't.

That's the distinction that matters. You cannot prevent identity compromise — Storm-2949 proves that the human at the other end of an MFA prompt is, and will remain, the softest target in the stack. What you can do is architect systems where identity compromise and data compromise are no longer the same event.

Sovereignty is a mathematical property

I write about this in the context of data sovereignty, because compelled disclosure and criminal exfiltration are the same problem wearing different jackets. In both cases, someone other than the data owner gains the legal or practical ability to demand the data — and in both cases, the only answer that survives contact with reality is an architecture where the custodian cannot comply, because the custodian holds nothing readable.

A government subpoena and a phished MFA prompt are both just access requests from a party you didn't intend. If your security model is "we decide who gets access," you've already lost to both. If your model is "access yields nothing without keys we never held," neither one works.

Storm-2949 spent days inside a major cloud environment, exfiltrating thousands of files, draining secrets, planting remote access tools — and the post-mortem's best advice is to monitor harder and configure tighter.

Monitor harder. Configure tighter. Against an adversary who logs in through the front door with valid credentials and uses the platform's own features.

That's not a security strategy. That's a hope.

Ross Norrie is the founder of SkyeConnex, a Canadian Data Sovereignty as a Service platform built on zero-knowledge encryption and multi-jurisdictional erasure-coded sharding. The architecture assumes your credentials will eventually be stolen. Plan accordingly.

Originally published by Ross Norrie, founder of SkyeConnex, on LinkedIn.

Published June 11, 2026 · More from the SkyeConnex blog