Storm-3168 explained: How compromised service principals deleted Azure resources in seven minutes

Microsoft Security Research reported that Storm-3168, the threat actor also known as JADEPUFFER, used two compromised Azure service principals to conduct more than 15 hours of reconnaissance before deleting most of over 100 targeted storage accounts, a Key Vault, a Function App, and an App Service plan within roughly seven minutes in June 2026. The attackers exploited no Azure vulnerability; instead, they used existing permissions associated with the identities, likely enabled by a client secret that had been publicly posted in a GitHub issue and remained valid in its edit history, though Microsoft could not confirm the exact entry point. The operation also retrieved more than 30 storage account keys and targeted backup and recovery protections, suggesting a ransomware-related objective, but no ransom demand or confirmed data theft was observed. Resource locks, storage deletion protection, and failed attempts to use a supported API version for Azure SQL deletions limited the damage. Microsoft emphasized that publicly exposed secrets must be immediately revoked or rotated, that workload identities require least-privilege access, and that automated safeguards such as deletion locks and monitoring for unusual identity activity are critical because destructive cloud attacks can unfold faster than human responders can act.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.