Storm-3168 Deletes Azure Resources in 7-Minute Destructive Cloud Attack
Microsoft says Storm-3168 used stolen Azure identities to delete cloud resources within about seven minutes.
74
Threat actor
Storm-3168
- Mentions · 7d0
- Mentions · 30d0
- All mentions10
- First seenSep 25, 2026
- Last mentionedSep 29, 2026
Timeline
10 articles · newest firstHackers Use Compromised Service Principals to Delete Azure Storage and Steal Cloud Credentials
Microsoft links destructive Azure Storage deletions and storage key theft by Storm-3168 (JADEPUFFER) to compromised service principals with credentials leaked on GitHub.
66
JadePuffer crims hijacked Azure identities and used them to blow up cloud resources
Microsoft attributes Azure cloud destruction attacks to Storm-3168, the actor behind JadePuffer agentic ransomware, after hijacked service principals deleted 100+ storage accounts.
68
JadePuffer agentic AI attacks target Azure, destroy cloud resources
JadePuffer, tracked as Storm-3168, used AI-driven attacks to wipe Azure storage and other cloud resources.
78
Autonomous agents attack Azure using compromised identities and destroying resources
Microsoft says Storm-3168, or Jadepuffer, used compromised Azure service principals to delete cloud resources and collect credentials.
82
28th September – Threat Intelligence Report
Check Point's weekly report covers ShinyHunters' FBI jobs-site breach, Bitget's $351.6M wallet theft, and actively exploited critical RCEs in Check Point and F5 products.
80
Storm-3168, Linked to JADEPUFFER, Abused Stolen Azure Identities
Microsoft details Storm-3168 (JADEPUFFER) using two stolen Azure service principals to rapidly delete 100+ storage accounts and harvest keys for extortion.
72
JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources
JADEPUFFER-linked Storm-3168 deleted Azure storage, databases, and recovery resources with stolen service principals.
78
Storm-3168 Hackers Abuse Compromised Service Principals to Destroy Azure Cloud Resources
Microsoft says Storm-3168 used compromised Azure service principals to delete cloud resources and collect storage keys.
76
Storm-3168: Agentic-driven cloud attacks using compromised service principals
Microsoft details Storm-3168 (JADEPUFFER) destroying Azure resources via compromised service principals in the first documented agentic ransomware operation's Azure activity.
78
Related CVEs
by mentions- CVE-2026-8510254%9.8Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw
- CVE-2025-3248100%9.8Unauthenticated RCE in Langflow /api/v1/validate/code
- CVE-2026-9361692%9.8Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload
- CVE-2026-9412727%9.3Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile
- CVE-2026-8790296%8.1Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2)
Appears with
- Microsoftorganization · 9
- Sysdigorganization · 7
- Microsoftvendor · 5
- Jadepufferthreat actor · 4
- Azure Key Vaultproduct · 4
- Azure Storageproduct · 4
- Azure SQLproduct · 4
- JadePufferorganization · 4
- Microsoft Azureproduct · 3
- Azureorganization · 3
- Azure Site Recoveryproduct · 3
- Azure App Serviceproduct · 2
- JadePuffermalware · 2
- Azure Backupproduct · 2
- EncForgemalware · 2
- Azureproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.