Storm-3168 Hackers Abuse Compromised Service Principals to Destroy Azure Cloud Resources
Microsoft says Storm-3168 used compromised Azure service principals to delete cloud resources and collect storage keys.
Microsoft reported a destructive Azure campaign by Storm-3168, also known as JADEPUFFER, that abused two compromised service principals in one tenant. One identity spent about 15.5 hours on more than 300 read operations, enumerating virtual machines, subscriptions, and resource groups. A second identity then attempted more than 150 destructive or credential actions in roughly 35 minutes, deleting most targeted storage accounts plus a Key Vault, Function App, and App Service plan, and trying to strip backup and Site Recovery locks. About 30 minutes later it made more than 30 successful ListKeys calls; Microsoft saw no ransom note or confirmed theft, but said the pattern fits extortion, and the credentials had been published in a public GitHub issue.
- Two stolen service principals in one Azure tenant ran the operation.
- Most targeted storage accounts were deleted, plus Key Vault and App Service resources.
- Attackers tried to remove Azure Backup and Site Recovery protection locks.
- More than 30 ListKeys calls returned storage keys, including Site Recovery keys.
- Tenant ID, client ID, and secret had remained in a public GitHub issue history.
- ATT&CK
- T1078.004 Valid Accounts: Cloud AccountsT1580 Cloud Infrastructure DiscoveryT1485 Data DestructionT1490 Inhibit System RecoveryT1552.001 Unsecured Credentials: Credentials In Files
- Vendors
- Microsoft
- Threat actors
- Storm-3168JADEPUFFER
- Organizations
- Microsoft
From the original article
3 min read at gbhackers.com
Microsoft has uncovered a destructive Azure campaign linked to Storm-3168, also known as JADEPUFFER, in which attackers abused compromised service principals to map cloud environments, delete critical resources, target recovery safeguards, and obtain storage-account credentials. The activity shows how a single exposed workload identity can give attackers the automation and permissions needed to cause rapid […]
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.