Threat actors use ARTEX AI to steal Azure Key Vault secrets
Microsoft says one agent went from GitHub searches to Key Vault access in five minutes, using stolen service principals.
Stories per day · 30 days
2 RSS
Relatedartex1azure1cloud-backup1cloud-credentials1connectwise1entra-id1github1key-vault1microsoft-3651oauth1skykick1supply-chain1
10 stories, newest first · one card per story
Stories tagged #service-principal
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
Hackers abused ConnectWise Cloud Backup identities to access at least 162 Microsoft 365 tenants.
7
Storm-3168 Deletes Azure Resources in 7-Minute Destructive Cloud Attack
Microsoft says Storm-3168 used stolen Azure identities to delete cloud resources within about seven minutes.
3
Hackers Use Compromised Service Principals to Delete Azure Storage and Steal Cloud Credentials
Microsoft links destructive Azure Storage deletions and storage key theft by Storm-3168 (JADEPUFFER) to compromised service principals with credentials leaked on GitHub.
1
JadePuffer crims hijacked Azure identities and used them to blow up cloud resources
Microsoft attributes Azure cloud destruction attacks to Storm-3168, the actor behind JadePuffer agentic ransomware, after hijacked service principals deleted 100+ storage accounts.
4
Autonomous agents attack Azure using compromised identities and destroying resources
Microsoft says Storm-3168, or Jadepuffer, used compromised Azure service principals to delete cloud resources and collect credentials.
3
Storm-3168, Linked to JADEPUFFER, Abused Stolen Azure Identities
Microsoft details Storm-3168 (JADEPUFFER) using two stolen Azure service principals to rapidly delete 100+ storage accounts and harvest keys for extortion.
4
JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources
JADEPUFFER-linked Storm-3168 deleted Azure storage, databases, and recovery resources with stolen service principals.
5
Storm-3168 Hackers Abuse Compromised Service Principals to Destroy Azure Cloud Resources
Microsoft says Storm-3168 used compromised Azure service principals to delete cloud resources and collect storage keys.
4
Storm-3168: Agentic-driven cloud attacks using compromised service principals
Microsoft details Storm-3168 (JADEPUFFER) destroying Azure resources via compromised service principals in the first documented agentic ransomware operation's Azure activity.
1