What is Threat Classification?<\/h4>
Threat classification organizes and prioritizes security alerts for faster response.<\/p><\/div><\/div><\/div><\/a><\/div><\/div><\/div>\n The second service principal attempted more than 150 destructive or credential-related operations over 35 minutes. The core wipe itself took about seven minutes.<\/p>\n Roughly 30 minutes after the destructive activity ended, the same service principal returned. It requested an inventory of storage accounts, then sent more than 30 successful ListKeys requests. Some of the targeted accounts were tied to Azure Site Recovery.<\/p>\n Microsoft’s analysis found that the attacker’s actions matched the service principal’s existing Azure RBAC assignments. A group-granted Storage Account Contributor role authorized the storage deletions. Direct Contributor access authorized the Key Vault, Function App, and App Service plan deletions. Direct SQL DB Contributor access authorized the SQL deletion attempts, which failed for the technical reason above rather than a permissions gap.<\/p>\n Microsoft assessed that the combination of destruction, recovery-lock targeting, and credential collection is consistent with tactics that support ransomware and extortion. Several details point in that direction:<\/p>\n Public reporting does not confirm a ransom demand in this campaign. Microsoft also did not confirm data exfiltration in the activity it observed.<\/p>\n Microsoft could not determine exactly how the service principal was first compromised. Here is what investigators did find:<\/p>\n Separately, Microsoft has tracked Storm-3168-linked infrastructure probing Azure App Service instances across multiple customers since the start of the year. That probing targeted paths associated with WordPress administration, PHP-CGI, and LangFlow’s code validation endpoint.<\/p>\n Microsoft found no overlap between those probed App Service targets and the affected subscriptions here, and no credential path from App Service to Azure Resource Manager for this tenant. The two activities appear related to the same actor’s broader operations, but the App Service probing is not confirmed as the entry point for this specific attack.<\/p>\n \n Explore major cybersecurity frameworks and how UEM strengthens compliance, visibility, and endpoint protection across organizations.\n <\/p>\n \n DOWNLOAD\n A seven-minute destructive sequence<\/h2>\n
\n
\n\n
\n Azure Resource<\/strong><\/th>\n Attack Outcome<\/strong><\/th>\n Operational Priority<\/strong><\/th>\n<\/tr>\n<\/thead>\n\n \n Storage accounts (100+)<\/td>\n Most deleted; a smaller number blocked by resource locks and deletion protection<\/td>\n Critical: verify locks, rotate keys<\/td>\n<\/tr>\n \n Key Vault, Function App, App Service plan<\/td>\n Deleted<\/td>\n High: restore from backup, audit secrets<\/td>\n<\/tr>\n \n Azure SQL databases<\/td>\n Deletion attempted, failed due to unsupported API version<\/td>\n Medium: monitor for retry attempts<\/td>\n<\/tr>\n \n Site Recovery locks, Backup protection lock<\/td>\n Deletion attempted, failed<\/td>\n High: protect recovery infrastructure<\/td>\n<\/tr>\n \n Storage account keys<\/td>\n 30+ successful ListKeys requests<\/td>\n Critical: rotate keys immediately<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Why this looks like ransomware, not just a wiper<\/h2>\n
\n
A leaked secret and an unresolved entry point<\/h2>\n
\n
![\"cybersecurity](\"https:\/\/cdn.hexnode.com\/threat-watch\/wp-content\/uploads\/2026\/08\/cybersecurity-framework.png?format=webp\" "\\"cybersecurity")
\n <\/div>\n <\/div>\n \n Featured resource\n <\/h5>\n
\n Building a cybersecurity framework for your enterprise\n <\/h4>\n