Threat Actor
Storm-3168
- First Reported
- Sep 25, 2026
- Latest Reported
- Oct 12, 2026
Reported Context (4)
- Tracked cluster reported to abuse Azure tenants through compromised service principals and automated destructive operations; the article identifies JADEPUFFER as its alternate name. Ransomware Disclosures Fell to 862 in September as Affiliates Continued Evolving Their Tactics
- Microsoft's tracking name for JADEPUFFER. Cybersecurity Roundup: Cribl Launches SIEM, NVIDIA Adds AI Agent Controls, and Island Raises $400M
- Microsoft's tracking name for JadePuffer. JadePuffer Uses Compromised Azure Credentials in Destructive Cloud Attack
- Microsoft's tracking name for JADEPUFFER; linked infrastructure was used for App Service probing and malicious ARM requests. Storm-3168 Used Compromised Azure Service Principals to Destroy Cloud Resources
CVE (8)
Malware (1)
People (7)
Threat Actors (33)
MITRE ATT&CK (5)
Vendors (18)
Products (40)
Tools (16)
Industries (10)
Countries (9)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.