Storm‑3168: JADEPUFFER Compromised Service Principals Destroy Azure Resources

What Happened

In June 2026, the threat actor JADEPUFFER, tracked by Microsoft as Storm‑3168, compromised two service principals in a single Azure tenant. One principal performed reconnaissance, enumerating VMs, subscriptions, and resource groups for over 15 hours. The other carried out destructive operations—deleting storage accounts, SQL databases, Key Vaults, Function Apps, recovery protection locks, VMs, and App Services—and collected credentials for future exfiltration.

Impact

The attacks caused widespread resource deletion and credential theft across the tenant’s Azure environment. Publicly exposed credentials remained active until revoked or rotated, allowing the actor to maintain persistence and expand the damage.

Publicly exposed credentials remain usable until revoked or rotated.

Mitigation

Defenders should:

• Secure workload identities and secrets, enforcing least privilege for service principals.
• Rotate or revoke exposed credentials immediately and audit for lingering secrets.
• Protect recovery resources such as protection locks and backups.
• Enable Microsoft Defender for Cloud protections and monitor for anomalous read/write activity.

AI‑Driven Defense

Storm‑3168 demonstrates AI‑orchestrated attacks that coordinate large‑scale post‑compromise actions. To keep pace, defenders should adopt AI‑assisted investigation tools (e.g., Project Perception, MDASH) to automate detection and response across complex cloud environments.