JadePuffer agentic AI attacks target Azure, destroy cloud resources
JadePuffer, tracked as Storm-3168, used AI-driven attacks to wipe Azure storage and other cloud resources.
Microsoft observed two June attacks by JadePuffer, tracked as Storm-3168, against an Azure tenant using compromised service principals. The actor mapped resources, retrieved storage account keys, removed backup protections, and deleted more than 100 storage accounts plus Key Vaults, Function Apps, VMs, and App Services in about seven minutes. Sysdig says the operator, active since July, uses AI agents and EncForge across reconnaissance, credential theft, lateral movement, persistence, and encryption, and has targeted AI datasets. Microsoft did not confirm extortion or data theft; some deletions failed because of resource locks, protections, or an unsupported SQL API.
- Storm-3168 used two compromised service principals in one Azure tenant.
- Attackers deleted more than 100 storage accounts in about seven minutes.
- Resource locks and account protections left some storage accounts intact.
- A service principal credential had appeared in a public GitHub issue.
- SQL deletion and recovery-lock removal attempts failed.
- ATT&CK
- T1580 Cloud Infrastructure DiscoveryT1078.004 Valid Accounts: Cloud AccountsT1552.001 Credentials In FilesT1485 Data DestructionT1490 Inhibit System Recovery
- Vendors
- Microsoft
- Threat actors
- JadePufferStorm-3168
- Malware
- JadePufferEncForge
From the original article
2 min read at bleepingcomputer.com
The JadePuffer ransomware operator is targeting Azure tenants with agent-driven attacks that conduct reconnaissance, steal credentials, and destroy core components. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.