Microsoft Tracks Storm-3168 Cloud Destruction Activity

New research from our team on the Microsoft Security Blog: the first detailed look at Storm-3168s Azure activity. Compromised service principals, a seven-minute destructive sequence across storage, Key Vault and Function Apps, attempts against backup and recovery locks, and storage key collection, all pointing to automated execution. The practical takeaways for defenders: protect workload identities, apply least privilege, guard your recovery infrastructure, and treat any publicly exposed credential as compromised even after it has been deleted. Link - https://lnkd.in/eBiepAhi

Seven minutes. That's how long it took to delete most of 100+ Azure storage accounts. Microsoft published its analysis of Storm-3168 - the group Sysdig called JADEPUFFER, the first documented agentic ransomware operation. In an early-June attack, two compromised service principals in one tenant split the work. One spent about 15 hours mapping the environment. The other ran 150+ destructive and credential operations in 35 minutes: storage accounts, a Key Vault, a Function App. Then, half an hour later, 30+ successful key retrievals - including storage tied to Azure Site Recovery. The service principal's client ID, secret and tenant ID had previously been exposed in plaintext in a public GitHub issue by an employee. The part worth remembering: what survived. Not the resources protected by permissions - the attacker had enough of those. What survived were resources with Azure resource locks and deletion protection. Attempts to remove locks on Site Recovery and Backup failed. When an identity with broad rights gets compromised, only controls that sit outside that identity still work. For Azure environments: * CanNotDelete locks on storage, Key Vault, backup and recovery resources * Least-privilege service principals - no subscription-wide Contributor * Managed identities or federated credentials instead of client secrets * Secret scanning across repos and issue trackers * Alerts on mass Delete and ListKeys operations from service principals Sources: Microsoft Security Blog, Sept 25; The Hacker News, Security Affairs, Sept 28, 2026. https://lnkd.in/dQr3d-rs #cybersecurity #Azure #cloudsecurity

A deleted secret is still a live secret. Microsoft Security Research's September 25 investigation of Storm-3168 describes two compromised Azure service principals. In one tenant, one identity mapped resources; another attempted more than 100 storage-account deletions in a roughly seven-minute destructive sequence. Some attempts were blocked by resource locks or deletion protection. The initial access path was not confirmed. Microsoft did find that a client secret had previously appeared in a public GitHub issue and remained visible in its edit history after removal. Editing a page does not invalidate the credential it exposed. A practical review for cloud teams: 1. Search repositories, issues, logs, and configuration files for workload secrets. 2. Revoke or rotate any exposed credential immediately, then investigate its use. 3. Reduce service-principal permissions to the resources and operations each application needs. 4. Protect backup and recovery resources with independent safeguards. 5. Alert on bursts of resource deletion and storage-key retrieval by workload identities. Microsoft did not confirm data exfiltration or a ransom note in this case. The confirmed lesson is speed: broad permissions can turn compromised workload identities into material cloud impact within minutes. Source: https://lnkd.in/dYQMid4e #CloudSecurity #IdentitySecurity #CyberSecurity

Rash – Cyber Threat Intelligence Advisory Storm-3168: Azure Cloud Resource Destruction Threat Title: Storm-3168 Abuses Compromised Service Principals to Delete Azure Resources Threat Type: Azure Cloud Identity Compromise / Destructive Cloud Attack Severity: High Overview: Microsoft identified Storm-3168 activity involving compromised Azure service principals to conduct reconnaissance, delete cloud resources, and collect storage account keys. The campaign reportedly resulted in the deletion of numerous Azure Storage accounts and other resources, while also targeting backup and recovery protections. Technical Analysis: * Compromised service principals were used to enumerate Azure subscriptions, VMs, and resource groups. * Attackers attempted 100+ Storage Account deletions, with most reportedly successful. * Azure Key Vault, Function App, and App Service resources were also deleted. * Attackers retrieved storage account keys and attempted to interfere with recovery controls. * Exposed credentials and excessive Azure RBAC permissions increase the risk of destructive activity. Preventive Recommendations: * Immediately revoke and rotate exposed service principal secrets; investigate public repositories and edit history. * Enforce least-privilege Azure RBAC and regularly audit service principal permissions. * Prefer managed identities or federated credentials over long-lived client secrets. * Apply resource locks and storage deletion protection to critical resources. * Secure Azure Backup and Site Recovery; monitor attempts to modify or remove protections. * Enable Microsoft Defender for Cloud protections and alert on mass deletions, unusual ListKeys activity, and suspicious service principal behavior. References: Microsoft Security Research: https://lnkd.in/gHJfhHNW Windows Forum: https://lnkd.in/gZge8GB7

❗ 𝘊𝘭𝘰𝘶𝘥 𝘪𝘥𝘦𝘯𝘵𝘪𝘵𝘪𝘦𝘴 𝘢𝘳𝘦 𝘣𝘦𝘤𝘰𝘮𝘪𝘯𝘨 𝘢𝘯 𝘢𝘶𝘵𝘰𝘮𝘢𝘵𝘪𝘰𝘯-𝘳𝘦𝘢𝘥𝘺 𝘢𝘵𝘵𝘢𝘤𝘬 𝘴𝘶𝘳𝘧𝘢𝘤𝘦. Microsoft Security Research documented Storm-3168 activity associated with 𝗝𝗔𝗗𝗘𝗣𝗨𝗙𝗙𝗘𝗥, where compromised Azure service principals were used for reconnaissance, resource destruction and credential collection. (https://lnkd.in/eidsc_3z) The security concern is significant that service principals operate without normal interactive user behaviour. Once compromised, they can provide persistent, automation-friendly access across cloud resources. Agentic tooling can further accelerate discovery and destructive actions. QSECS helps enterprises improve their security posture and compliance readiness through AI-guided vulnerability testing, automated compliance documentation and secure development training. 𝗜𝗻 𝘁𝗵𝗲 𝗮𝗴𝗲𝗻𝘁𝗶𝗰 𝗲𝗿𝗮, 𝗺𝗮𝗰𝗵𝗶𝗻𝗲 𝗶𝗱𝗲𝗻𝘁𝗶𝘁𝗶𝗲𝘀 𝗿𝗲𝗾𝘂𝗶𝗿𝗲 𝘁𝗵𝗲 𝘀𝗮𝗺𝗲 𝘀𝗰𝗿𝘂𝘁𝗶𝗻𝘆 𝗮𝘀 𝗽𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲𝗱 𝗵𝘂𝗺𝗮𝗻 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀. #CloudSecurity #AzureSecurity #IdentitySecurity #NonHumanIdentity #AgenticAI #IAM #ZeroTrust #CyberSecurity #CISO

Interesting security research from Microsoft on Storm-3168 — an example of how compromised cloud identities can enable highly automated attacks. A few details that stood out to me: 🔹 Two Azure Service Principals were compromised in the affected tenant. 🔹 One Service Principal spent around 15.5 hours performing reconnaissance, carrying out 300+ successful read operations to understand subscriptions, VMs, resource groups and other Azure resources. 🔹 Then the attack changed from reconnaissance to rapid destruction. 🔹 In roughly 7 minutes, the attackers attempted to delete 100+ Azure Storage Accounts, with many deletions succeeding. 🔹 They also targeted resources such as Key Vault, Function Apps and App Service Plans, while attempting to interfere with backup/recovery mechanisms. 🔹 Later, more than 30 successful "ListKeys" operations were observed, potentially providing access to Storage Account keys. What stands out to me most is the speed gap between defenders and attackers: 15.5 hours of reconnaissance → environment mapped → ~7 minutes of destructive activity For a SOC, even a P1 incident requires time to detect → generate/understand the alert → validate → investigate → decide → contain. The threat actor, however, may need only seconds or minutes to execute a malicious cloud operation at scale. This creates an important challenge for modern SOCs: Can our detection and automated containment operate faster than the attacker's execution? For cloud environments, monitoring should therefore go beyond human accounts. Service Principals and workload identities need behavioral monitoring and, where appropriate, automated response. A useful detection chain could be: Service Principal → Cloud Discovery → Secret/Key Access → Abnormal Activity → Mass Resource Deletion → Recovery Disruption This is a good reminder that in cloud security, identity, permissions, automation, detection speed and recovery controls are all part of the attack surface. #CyberSecurity #CloudSecurity #Azure #MicrosoftSecurity #SOC #SIEM #MicrosoftSentinel #EntraID #IdentitySecurity #ThreatDetection #AutonomousSOC https://lnkd.in/dk7-dF2a

Storm-3168 used compromised cloud identities to carry out a destructive attack against an Azure environment in minutes. The operation shows how a stolen application credential can give an intruder broad control over hosted data, services, and recovery protections. Microsoft said in a report shared with Cyber Security News (CSN) that the campaign targeted Azure Storage accounts, SQL databases, Key Vaults, Function Apps, App Services, and recovery controls. https://lnkd.in/gVpdm3za

Agentic AI's Jadepuffer malware is wreaking havoc on Microsoft Azure by destroying cloud resources. This sophisticated cyberattack uses AI-driven tactics to access Azure accounts, disable security features, and delete data. The campaign is part of a broader trend where AI is weaponized to automate and accelerate malicious activities. The main takeaway is the urgent need for cloud users to enhance security measures and stay informed about emerging threats. This scenario underscores the importance of robust defense strategies in cloud environments to combat such advanced threats. #CloudSecurity #AIThreats #CyberDefense

Agentic AI's Jadepuffer malware is wreaking havoc on Microsoft Azure by destroying cloud resources. This sophisticated cyberattack uses AI-driven tactics to access Azure accounts, disable security features, and delete data. The campaign is part of a broader trend where AI is weaponized to automate and accelerate malicious activities. The main takeaway is the urgent need for cloud users to enhance security measures and stay informed about emerging threats. This scenario underscores the importance of robust defense strategies in cloud environments to combat such advanced threats. #CloudSecurity #AIThreats #CyberDefense

Storm-3168 Deletes Azure Resources in 7-Minute Destructive Cloud Attack Storm-3168 used compromised cloud identities to carry out a destructive attack against an Azure environment in minutes. The operation shows how a stolen application credential can give an intruder broad control over hosted data, services, and recovery protections. It also highlights the growing threat from automated cloud attacks. The activity is linked to JADEPUFFER agentic ransomware operations, documented earlier in a different intrusion....