Storm-3168 Deletes Azure Resources in 7-Minute Destructive Cloud Attack
Microsoft says Storm-3168 used stolen Azure identities to delete cloud resources within about seven minutes.
Microsoft says Storm-3168 used two compromised service principals in one Azure tenant for reconnaissance and rapid destruction. In early June 2026 one identity completed more than 300 successful reads over about 15 hours 30 minutes; a second identity then spent roughly seven minutes making more than 100 storage-account deletion attempts, most successful, and deleted a Key Vault, Function App, and App Service plan. Azure SQL deletions failed on an unsupported API version, while locks and deletion protection blocked some attempts; about 30 minutes later the actor made more than 30 successful ListKeys calls, including Site Recovery accounts. Researchers link the case to earlier JADEPUFFER agentic ransomware activity but did not confirm a ransom note, successful theft, or direct AI control.
- Two stolen service principals mapped one Azure tenant, then destroyed resources.
- More than 100 storage-account deletions in about seven minutes mostly succeeded.
- A Key Vault, Function App, and App Service plan in the same group were removed.
- SQL deletions failed; locks and deletion protection blocked some attempts.
- The actor later made 30-plus successful storage ListKeys calls.
- ATT&CK
- T1078.004 Valid Accounts: Cloud AccountsT1580 Cloud Infrastructure DiscoveryT1485 Data DestructionT1490 Inhibit System Recovery
- Vendors
- Microsoft
- Products
- AzureAzure StorageAzure SQLAzure Key VaultAzure BackupAzure Site RecoveryAzure FunctionsAzure App Service
- Threat actors
- Storm-3168
- Malware
- JADEPUFFER
- Organizations
- Microsoft
From the original article
3 min read at cybersecuritynews.com
Storm-3168 used compromised cloud identities to carry out a destructive attack against an Azure environment in minutes. The operation shows how a stolen application credential can give an intruder broad control over hosted data, services, and recovery protections. It also highlights the growing threat from automated cloud attacks.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.