Threat Intel
JadePuffer AI‑Driven Attacks Target Azure Tenants, Destroy Storage and Key Vaults
The JadePuffer ransomware operator has been using AI agents to automate attacks against Azure tenants, mapping resources, stealing credentials, and deleting critical storage and key vaults. Over 100 storage accounts were wiped in a seven‑minute window, though some survived due to resource locks. Defenders should enable resource locks, audit service principals, and monitor for anomalous API activity.
What happened
The JadePuffer ransomware group launched agent‑driven attacks against Azure tenants, using AI agents to automate reconnaissance, credential theft, lateral movement, and destruction of critical resources.
Impact
In June, two attacks mapped cloud assets, extracted storage account keys, and deleted more than 100 Azure Storage accounts, Key Vaults, Function Apps, VMs, and App Services. The deletion phase lasted roughly seven minutes. Some accounts survived due to Azure resource locks and account‑level protections.
Defender actions
- Verify that resource locks are enabled on critical storage accounts and Key Vaults.
- Audit service principal permissions and revoke any that are excessive or unused.
- Enable Azure Defender for Cloud and monitor for anomalous API calls such as GetKeys or DeleteStorageAccount.
- Apply the latest Azure security patches and review network segmentation to limit lateral movement.
- Consider disabling or hardening the use of Azure Functions and App Services that are not required.
Mitigation guidance
Microsoft recommends applying the “Azure Storage account lock” feature and enabling “soft delete” for blobs to recover accidentally deleted data. Additionally, enforce least‑privilege for service principals and enable multi‑factor authentication for privileged accounts.
Related articles
Storm‑3168: JADEPUFFER Compromised Service Principals Destroy Azure Resources
JADEPUFFER used compromised Azure service principals to enumerate, delete, and steal credentials from multiple resource types. Defenders must secure identities, enforce least privilege, rotate secrets, protect recovery resources, and enable Defender for Cloud to mitigate similar attacks.
Read briefing
CrowdStrike & Anthropic Join Forces to Strengthen AI‑Powered Defense for Critical Infrastructure
CrowdStrike has partnered with Anthropic to provide AI‑driven continuous authorization and threat detection for critical infrastructure. The collaboration expands Falcon’s capabilities into OT environments and offers defenders new tools to detect AI‑generated attacks. SecOps teams should evaluate integration options and update monitoring for AI‑driven anomalies.
Read briefing
AI in Cybersecurity: Current Trends, Challenges, and How Defenders Can Respond
AI is accelerating the evolution of cyber threats and defensive capabilities. This briefing outlines how security teams can leverage AI-driven platforms, the emerging trends in threat intelligence, and the key challenges to overcome. Defenders should prioritize integration, continuous monitoring, and skill development to stay ahead.
Read briefing
AI-Enhanced OSINT Enables Mass Targeted Fraud – Defenders Must Act
AI has turned public‑data gathering into a rapid, low‑skill activity, letting fraudsters build detailed victim profiles in seconds. This shift means anyone can become a target, increasing phishing and BEC attacks. Defenders need to treat public data as a threat vector and adopt specific mitigations.
Read briefing