Storm-3168 Uses Two Compromised Service Principals for 300+ Azure Recon Ops and 100+ Storage Deletions
JADEPUFFER actors compromised Azure service principals to conduct reconnaissance and deletion operations against storage and database resources. Microsoft data shows resource locks mitigated some damage while the entry vector remains unidentified. The incident extends prior LLM-driven tradecraft into cloud identity abuse.
Microsoft observed one principal limited to reconnaissance against VMs, subscriptions, and resource groups while the second performed both discovery and destruction. The second principal enumerated App Service configs for credentials then issued deletion calls against Storage Accounts, Key Vaults, SQL databases, and Function Apps. Deletion protection and resource locks blocked several attempts despite broad permissions on the tenant.
JADEPUFFER previously demonstrated LLM-orchestrated ransomware via Langflow CVE-2025-3248 and later ENCFORGE targeting AI model files. The Azure operation shows the same pattern of credential reuse and lateral movement now applied to cloud control planes. The original coverage notes the compromise but omits how client secrets likely leaked from exposed App Service configs or prior Langflow footholds.
Resource locks proved effective independent controls even after identity compromise. No technical attribution evidence links the activity to a state actor despite the Microsoft naming convention. Follow-on operations will likely target additional tenants via similar service principal abuse within the next 90 days.
Storm-3168: At least two additional Azure tenants experience service-principal-driven deletions exceeding 50 resources within 90 days.
Sources (2)
- [1]The Hacker News(https://thehackernews.com/2026/09/jadepuffer-linked-attackers-used.html)
- [2]Sysdig JADEPUFFER Report(https://sysdig.com/blog/jadepuffer-ransomware/)