Storm-3168 Used JadePuffer to Delete Azure Resources in Attacks
Summary
Microsoft observed Storm-3168 use compromised service principals to map Azure resources, retrieve storage keys, and delete storage accounts. Some protections limited damage; Microsoft did not confirm data theft or financial demands.
Key points
- Microsoft attributed two observed JadePuffer attacks to Storm-3168.
- Two compromised service principals were used for resource discovery, destructive operations, and credential collection.
- The destructive phase lasted seven minutes and targeted more than 100 storage accounts, as well as Key Vaults, Function Apps, virtual machines, and App Services.
- Most targeted storage accounts were deleted, while resource locks and account-level protections spared some.
- The attacker removed some backup protections and later made more than 30 requests for storage account keys, most of which succeeded.
- Attempts to delete Azure SQL databases failed; Microsoft did not confirm data theft or financial demands, and could not determine initial access.
Article Details
- Victim Organization
- Unknown
- Incident Type
- AI-agent-driven cloud ransomware activity involving reconnaissance, credential collection, and destructive actions against Azure resources
- Operational Impact
- Microsoft observed two attacks in June. The destructive stage lasted seven minutes and targeted more than 100 storage accounts, as well as Key Vaults, Function Apps, Virtual Machines, and App Services. Most targeted Azure Storage accounts were deleted; some were protected by resource locks or storage account-level safeguards. Attempts to delete Azure SQL databases and remove recovery-protection locks failed. The attacker later made more than 30 requests for storage account keys, most of which succeeded. Microsoft did not confirm data theft.
- Ransom Or Extortion
- The activity could support ransomware extortion, but Microsoft reported no financial demands. Data theft was not confirmed.
- Claim Status
- confirmed
Threat Actors
Malware
Vendors
MicrosoftMicrosoft linked the activity to Storm-3168, which used compromised service principals to delete storage accounts, weaken recovery protections, and expand attacks to AI assets such as training data and vector databases.SysdigThe malware emerged in July, with researchers at cloud security company Sysdig highlighting that it uses AI agents to automate the entire attack chain, from reconnaissance, credential theft, and lateral movement to
Products
App ServicesThe attacker targeted Azure Storage, Key Vault, Function Apps, Virtual Machines, and App Services.AzureJadePuffer is a new AI-driven ransomware operator targeting Azure tenants with automated reconnaissance, credential theft, lateral movement, and destructive actions against cloud resources.Azure Site RecoveryThe attacker removed backup and recovery protections (Azure Site Recovery locks), indicating an effort to make restoration more difficult.Azure SQLAccording to the researchers, attempts to delete Azure SQL databases failed because the attacker used an unsupported API version.Azure StorageThe attacker targeted Azure Storage, Key Vault, Function Apps, Virtual Machines, and App Services.Function AppsThe attacker targeted Azure Storage, Key Vault, Function Apps, Virtual Machines, and App Services.Key VaultThe attacker targeted Azure Storage, Key Vault, Function Apps, Virtual Machines, and App Services.Virtual MachinesThe attacker targeted Azure Storage, Key Vault, Function Apps, Virtual Machines, and App Services.