Microsoft details Storm-3168, the JADEPUFFER-linked actor that used stolen service principals to delete Azure storage in minutes and harvest keys. Microsoft just published the first detailed look at what JADEPUFFER does inside Azure. Sysdig first spotted the group’s activity in July 2026 and called it the first documented agentic ransomware operation.
Storm-3168, Linked to JADEPUFFER, Abused Stolen Azure Identities
About this summary. This is a short, independently written summary of an article first published by Security Affairs. Cyber Security News did not report or verify the underlying story. Read the original: https://securityaffairs.com/199905/cyber-crime/storm-3168-linked-to-jadepuffer-abused-stolen-azure-identities.html
Source attribution: headline and facts are from Security Affairs (securityaffairs.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Storm-3168: Agentic-driven cloud attacks using compromised service principals
Attack overview Technical analysis Mitigation and protection guidance References Learn More Microsoft Security Research has identified malicious cloud activity…
Simplify Threat Intelligence Procurement with SOCRadar and Microsoft Marketplace
Simplify Threat Intelligence Procurement with SOCRadar and Microsoft Marketplace Your security team has already made the case for external threat intelligence. The…
JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources
The threat actor known as JADEPUFFER has been observed orchestrating destructive actions within a Microsoft Azure environment using compromised service principals…
Security Affairs newsletter Round 597 by Pierluigi Paganini – INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new…
USN-8729-5: Linux kernel (AWS FIPS) vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.
Dark Web Profile: Blue Locker Ransomware
Threat Actor Profile: Blue Locker Ransomware Blue Locker Ransomware, first detected in late 2021, the group stayed low-profile for years before making global headlines…