Date: September 28, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Cloud Security / AI-Driven Threats / Microsoft Azure / Incident Response
Tags: JADEPUFFER, Storm-3168, Microsoft Azure, Service Principals, Cloud Sabotage, AI Agents, Entra ID, Langflow
Executive Summary
The transition from theoretical AI threats to weaponized, autonomous cloud sabotage has become reality. On September 28, 2026, The Hacker News reported on an urgent investigation published by Microsoft Security detailing a destructive cloud intrusion orchestrated by threat actor JADEPUFFER (tracked by Microsoft as Storm-3168).
JADEPUFFER previously made cybersecurity history when researchers at Sysdig identified it as the first threat group operating an end-to-end, LLM-powered ransomware agent that autonomously weaponized vulnerabilities in AI pipeline frameworks like Langflow (CVE-2025-3248). In this latest campaign, Microsoft revealed that Storm-3168 has evolved its tradecraft into ruthless cloud infrastructure sabotage, abusing compromised Service Principals in Microsoft Entra ID (formerly Azure Active Directory).
Over a concentrated 18-hour operational window, the agentic attack framework methodically enumerated enterprise Azure environments, systematically dismantled recovery locks, and wiped out production cloud assets—including Azure Storage Accounts, Azure SQL databases, Key Vaults, Function Apps, and Virtual Machines. The incident stands as a landmark case study demonstrating how autonomous AI agents, when paired with overprivileged Non-Human Identities (NHIs), can inflict catastrophic operational damage faster than human security operations centers (SOCs) can detect and respond.
Technical Deep-Dive: Deconstructing the Storm-3168 Attack Chain
To understand how Storm-3168 achieved automated tenant-wide devastation, we dissect the progression from initial credential access to Azure Resource Manager (ARM) sabotage.+-----------------------------------------------------------------------------------+
| STORM-3168 (JADEPUFFER) AGENTIC AZURE SABOTAGE PIPELINE |
|---|
Autonomous AI Agent (Storm-3168) Microsoft Entra ID (Identity Plane) Azure Resource Manager (Control Plane)
| | |
| 1. Ingests compromised Service Principal | |
| credentials (Client ID + Client Secret) | |
|------------------------------------------------>| |
| 2. Requests OAuth 2.0 Client Credentials token | |
| Scope: `https://management.azure.com/` | |
|------------------------------------------------>| |
| 3. Entra ID issues ARM Bearer Token | |
|<------------------------------------------------| |
| |
| 4. Autonomous Enumeration Loop: |
| Queries subscriptions, resource groups, and RBAC role assignments |
|--------------------------------------------------------------------------------------------------->|
| 5. ARM returns high-privilege `Owner` / `Contributor` role scopes |
|<---------------------------------------------------------------------------------------------------|
| |
| 6. Defense Evasion - Stripping Recovery Locks: |
| Dispatches `DELETE /subscriptions/.../providers/Microsoft.Authorization/locks/{lockName}` |
|--------------------------------------------------------------------------------------------------->|
| 7. Azure Management Locks REMOVED! (Protection dismantled) |
|<---------------------------------------------------------------------------------------------------|
| |
| 8. High-Velocity Destruction Campaign (Executed over 18 Hours): |
| - `DELETE /subscriptions/.../providers/Microsoft.Storage/storageAccounts/...` |
| - `DELETE /subscriptions/.../providers/Microsoft.Sql/servers/.../databases/...` |
| - `DELETE /subscriptions/.../providers/Microsoft.KeyVault/vaults/...` |
| - `DELETE /subscriptions/.../providers/Microsoft.Compute/virtualMachines/...` |
|--------------------------------------------------------------------------------------------------->|
| 9. Target Azure Infrastructure WIPED OUT! |
| Storage blobs gone, SQL databases purged, crypto keys destroyed, VMs terminated. |
|<===================================================================================================|
1. Compromise of Non-Human Identities (NHIs)
Unlike standard human user accounts, Service Principals represent machine identities utilized by CI/CD pipelines, automated scripts, and cloud management tools:
* The Vulnerability: The targeted organization had configured several Service Principals with static, long-lived client secrets.
* Overprivileged RBAC Assignments: These Service Principals had been assigned high-privilege Owner or Contributor roles directly at the Azure Subscription root level rather than scoped to specific resource groups.
* Credential Siphoning: Storm-3168 obtained these credentials from exposed developer configurations and hardcoded secrets within compromised orchestration environments.
2. Autonomous Reconnaissance via ARM REST APIs
Once armed with valid Bearer tokens obtained via Entra ID’s OAuth 2.0 token endpoint (https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token), the autonomous agent initiated a systematic discovery loop:
* Polled Azure Resource Manager REST endpoints:GET /subscriptions/{subscriptionId}/resources?api-version=2021-04-01 HTTP/1.1
Host: management.azure.com
Authorization: Bearer
* Evaluated resource dependencies, pinpointing production databases, data lakes, and cryptographic key vaults.
* Queried Microsoft.Authorization/roleAssignmentScheduleRequests to determine the exact boundaries of its administrative privileges.
3. Neutralizing Safeguards: Stripping Azure Resource Locks
To prevent accidental deletion, enterprise Azure architectures implement Resource Locks (CanNotDelete or ReadOnly).
* Storm-3168’s agentic workflow was explicitly programmed to detect and bypass this safeguard.
* The agent queried for all active locks:GET /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/locks?api-version=2020-05-01 HTTP/1.1
* Because the compromised Service Principal held Owner permissions, the agent sent targeted HTTP DELETE requests to remove the locks:DELETE /subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Authorization/locks/{lockName}?api-version=2020-05-01 HTTP/1.1
* Once locks were purged, all target resources were rendered completely unprotected.
4. Systematic Cloud Sabotage Across Six Core Services
In rapid succession over an 18-hour window, the agent dispatched parallel deletion commands across the enterprise tenant:
1. Azure Storage Accounts: Deleted primary data stores containing unstructured blob data, customer backups, and machine snapshots.
2. Azure SQL Databases: Dropped relational databases and deleted parent logical SQL servers.
3. Azure Key Vaults: Deleted key vaults and triggered immediate purge operations to permanently eradicate TLS certificates and encryption keys.
4. Compute & Serverless: Terminated Azure Virtual Machines and deleted Azure Function Apps and App Service plans, causing an immediate total outage of customer-facing applications.
Strategic Threat Impact: The Rise of Agentic Sabotage
The Storm-3168 campaign highlights three seismic shifts in cloud cybersecurity:
* Machine-Speed Destruction: By removing human decision-making, an AI agent can identify, evaluate, and delete hundreds of cloud resources in minutes—drastically outrunning traditional SOC alert triaging.
* The Non-Human Identity Blindspot: Enterprise security has spent years hardening human identity (MFA, Passkeys, FIDO2). Meanwhile, Service Principals, API keys, and managed identities frequently operate with zero MFA, long-lived credentials, and excessive permissions.
* From Ransom to Annihilation: While early iterations of JADEPUFFER focused on extortion, this attack demonstrated unrecoverable operational destruction aimed at crippling business continuity.
Defensive Hardening & Mitigation Blueprint for Azure Environments
Security teams must immediately implement zero-trust identity and governance controls across Azure estates:
1. Enforce Entra Privileged Identity Management (PIM) for Service Principals
Machine identities must not hold permanent administrative privileges:
* Integrate PIM for Service Principals and Workload Identities.
* Require just-in-time (JIT) activation for high-privilege roles (Owner, User Access Administrator, Contributor).
* Replace static client secrets with Workload Identity Federation (OIDC), eliminating stored secrets entirely.
2. Prevent Lock Removal via Azure Deny Assignments & Immutable Policies
Protect resource locks from unauthorized deletion:
* Deploy Azure Policy definitions enforcing DenyAction on critical infrastructure.
* Configure Azure Resource Guard to require multi-party approval (MupA) from an independent security administrator before any resource lock or Key Vault purge can be authorized.
3. Enable Soft-Delete and Purge Protection on All Key Vaults
Ensure Key Vaults cannot be permanently erased even if an administrative identity is compromised:# Enable Purge Protection and Soft-Delete on Key Vault via Azure CLI
az keyvault update --name "ProductionVault" --resource-group "ProdRG" --enable-purge-protection true --enable-soft-delete true
4. Configure Automated Anomaly Alerts on Bulk ARM Deletions
Set up Azure Monitor and Microsoft Sentinel detection rules to trigger immediate identity revocation upon mass deletion activity:// KQL query to detect anomalous spikes in Azure Resource deletion
AzureActivity
| where OperationNameValue endswith "delete"
| where ActivityStatusValue == "Success"
| summarize DeletionCount = count() by Caller, CallerIpAddress, bin(TimeGenerated, 15m)
| where DeletionCount > 10
For cloud architecture threat analysis, identity security intelligence, and enterprise hardening guides, follow Digital Spying.