Executive Summary
Microsoft has identified malicious cloud activity attributed to JADEPUFFER (tracked as Storm-3168), a threat actor involved in agentic ransomware operations. The actor leverages automation to rapidly perform destructive activities in Azure, specifically targeting Storage Accounts, SQL databases, Key Vaults, and Function Apps. This campaign marks a shift toward AI-orchestrated, automated post-compromise operations that significantly accelerate the speed of cloud-based resource destruction.
The attack chain primarily involves the exploitation of compromised service principal credentials, often found exposed in public repositories or configuration files. Once access is gained, the actor conducts extensive reconnaissance before initiating a rapid destructive sequence. In one observed case, over 100 storage account deletion attempts occurred in just seven minutes. The actor also attempts to inhibit recovery by deleting Azure Site Recovery locks and backup protection controls.
This activity is high-urgency as it directly impacts business continuity through bulk data and infrastructure deletion. Organizations using Azure should immediately audit service principal permissions, rotate any secrets exposed in code history, and implement resource locks to prevent unauthorized deletions.