Storm-3168. The access path.
Two Azure service principals wiped over 100 storage accounts. Microsoft names no vulnerability. A group-granted role authorised every destructive call.
The record
Entry point. public github issue, client id, client secret and tenant id in plaintext.
The identity in the middle. Two service principals in the same tenant, whose client id, secret and tenant id sat in plaintext in a public GitHub issue.
What was reached. account keys, 30+ successful ListKeys requests after the wipe.
Two Azure service principals wiped over 100 storage accounts.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| public github issue | Entry | client id, client secret and tenant id in plaintext |
| edit history | Step | secret edited out later, still readable |
| service principal | Step | two principals in the same tenant |
| role assignments | Step | Storage Account Contributor via a group, plus Contributor |
| storage accounts | Step | 100+ deletion attempts, most succeeded |
| account keys | Reached | 30+ successful ListKeys requests after the wipe |
Where a breakpoint would have been
The role assignment, not the leaked secret. Revoking the secret ends this instance; the next leak reaches just as far while Storage Account Contributor is granted through a group and Contributor sits on the same principal. A principal that can delete storage and then list account keys is the step worth narrowing.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page. The full narrative is in the teardown.
6 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Microsoft Security Blog, Storm-3168 · BleepingComputer · Cyber Press
Questions, answered.
The two questions this record answers.
What was the entry point in the Storm-3168 incident?
The published path starts at public github issue, client id, client secret and tenant id in plaintext.
What did it reach?
The last step in the published path is account keys, 30+ successful ListKeys requests after the wipe.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.