---
title: Hunt: Storm-3350 resets passwords through self-service reset, passes the victim's SMS MFA, registers its own Authenticator, then mass-pulls SharePoint and Azure keys | ctxsec
url: https://ctxsec.com/items/hunt-ms-storm-3350-sspr-reset-mfa-method-registration-graph-azure-key-theft
description: "Microsoft is tracking Storm-3350, a Brazil-focused financially motivated cluster active since October that mostly hits financial services, payments, banking and digital-asset firms, with some healthcare, transportation and logistics victims. It starts with vishing or identity impersonation. In confirmed cases the actor reset a password through Microsoft's legitimate self-service password reset, signed in within minutes, completed the account's existing SMS or voice MFA, and registered an actor-controlled Microsoft Authenticator method for persistence. Then it runs Graph, Microsoft 365 and Azure reconnaissance and bulk data collection."
status: "official (Microsoft Threat Intelligence, Nov 10, 2026); Microsoft says no single IP, domain or lure should be treated as conclusive attribution"
published: 2026-11-10
---

> Microsoft is tracking Storm-3350, a Brazil-focused financially motivated cluster active since October that mostly hits financial services, payments, banking and digital-asset firms, with some healthcare, transportation and logistics victims. It starts with vishing or identity impersonation. In confirmed cases the actor reset a password through Microsoft's legitimate self-service password reset, signed in within minutes, completed the account's existing SMS or voice MFA, and registered an actor-controlled Microsoft Authenticator method for persistence. Then it runs Graph, Microsoft 365 and Azure reconnaissance and bulk data collection.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-ms-storm-3350-sspr-reset-mfa-method-registration-graph-azure-key-theft.md)

official (Microsoft Threat Intelligence, Nov 10, 2026); Microsoft says no single IP, domain or lure should be treated as conclusive attribution

2026-11-10

### Hunt: Storm-3350 resets passwords through self-service reset, passes the victim's SMS MFA, registers its own Authenticator, then mass-pulls SharePoint and Azure keys

- **Hunt the sequence, not single events:** SSPR password reset, then an immediate sign-in satisfying existing SMS/voice MFA, then a new authentication method registered, then anomalous token acquisition and Graph/Azure control-plane enumeration, then SharePoint, OneDrive and mailbox discovery and high-volume download.
- **Tooling seen:** browser access mixed with Python- and Node-style automation, OAuth-authenticated curl, and Azure CLI enumeration; Microsoft lists mass SharePoint/OneDrive access via `python-httpx` as a detection.
- **Secret hunting:** SharePoint searches for `AKIA` (AWS access key prefix), access to `.key`, `.pem` and `.ppk` files, and Azure requests for storage-account keys (List Keys) and app publishing profiles.
- **Microsoft detections named:** suspicious Azure List Keys activity; anomalous token acquisition followed by high-volume SharePoint file activity; Graph API activity from a Microsoft threat-intelligence IP; mass SharePoint or OneDrive file access after an MFA method change; suspicious mass download from a risky or unusual session.
- See the tip on hardening SSPR and security-info registration.

Sources: [Microsoft Threat Intelligence on X: Storm-3350 (Nov 10, 2026)](https://x.com/MsftSecIntel/status/2120290394869006572)