Skip to content

Image: securityaffairs.com · rights & removal

Storm-3168, Linked to JADEPUFFER, Abused Stolen Azure Identities

Reporting by Security Affairs (Pierluigi Paganini)Read the original at securityaffairs.com

Objectivity score: 59 out of 100.
Difficulty 59 out of 100 (Graduate)— Read Analysis

Executive Summary

An automated operation was identified involving two compromised service principals that acted in distinct phases: reconnaissance and subsequent destructive actions within the Azure environment. The activity began with one identity enumerating virtual machines and resources over 15 hours, followed by another identity performing rapid discovery and credential theft across multiple subscriptions. This second identity subsequently attempted to enumerate App Service configuration stores and unsuccessfully sought Azure OpenSearch resources, culminating in attempts to delete storage accounts and associated resources. Despite protection mechanisms like resource locks, the attackers successfully deleted numerous storage accounts and other assets within a short timeframe. The compromise vector was traced to exposed credentials posted publicly on GitHub, which were found in an issue that was later edited. The activity also included probing of external infrastructure unrelated to the affected subscriptions.

Facts Only

* Two compromised service principals were involved in the activity.
* Reconnaissance began in early June 2026.
* One identity spent 15 hours and 30 minutes listing virtual machines, subscriptions, resource groups, and other resources, completing over 300 read operations.
* A second identity performed similar activity across two subscriptions in five seconds.
* Both identities used Storm-3168 infrastructure, the same network fingerprint, and the user agent python-requests/2.34.2.
* The second service principal enumerated Azure App Service configuration stores and attempted to find Azure OpenSearch resources.
* The second identity successfully initiated deletion operations, attempting to delete over 100 storage accounts, a Key Vault, a Function App, and an App Service plan from the same resource group.
* Resource locks prevented some storage account deletions.
* Attempts to delete Azure SQL databases failed due to unsupported API versions.
* The compromise source included client ID, client secret, and tenant ID posted in plaintext on a public GitHub issue.
* Three IP addresses tied to probing were 45.131.66[.]106, 34.153.223[.]102, and 64.20.53[.]230.
* The activity showed the use of group-granted Storage Account Contributor role and Direct Contributor access for deletions.

Full Take

The narrative strongly suggests a high degree of automation driven by overlapping token streams, which allows for segmented tasks—reconnaissance followed immediately by destructive operations—signaling an adversarial methodology focused on speed and stealth rather than manual intrusion. The focus on collecting keys following destruction indicates a secondary objective aligned with data exfiltration planning, even without confirming actual data theft or ransom demands. The failure to achieve full deletion due to in-place security controls reveals the ongoing tension between identity permissions and infrastructural defenses; this implies that granting broad administrative rights alone is insufficient against layered defense mechanisms. The mechanism of credential exposure via public repositories highlights a systemic failure in secure secrets management, suggesting that access control failures are often less about technical exploits and more about human process vulnerabilities. This points to a pattern where the persistence and impact of compromise hinge not just on vulnerability exploitation but on the chain of custody for credentials and operational context.
* Patterns detected: ARC-0024 Ambiguity, ARC-0043 Motte-and-Bailey

From the original · Security Affairs (Pierluigi Paganini)

Microsoft just published the first detailed look at what JADEPUFFER does inside Azure. Sysdig first spotted the group’s activity in July 2026 and called it the first documented agentic ransomware operation.
Read the full story at securityaffairs.com

Sentinel — Human

Confidence

The text reads like a detailed, well-sourced report heavily reliant on internal technical data and established reporting protocols, suggesting a high degree of human authorship or rigorous machine verification of human input.

Signals Detected
low severity: Moderate sentence length variance; the text flows well but contains specific, dense technical reporting.
low severity: High logical flow in presenting a complex chain of events and technical findings without overt emotional bias.
medium severity: The dense, specific referencing of timelines, specific API calls, and internal system names suggests deep sourcing, though the structure is report-like rather than purely journalistic narrative.
low severity: Claims are strongly attributed to 'Microsoft' reports and specific technical findings, suggesting reliance on official documentation, lowering risk of simple fabrication.
Human Indicators
Use of precise, layered reporting structure typical of technical security journalism.
The inclusion of nuanced caveats (e.g., 'didn’t see a ransom note') alongside direct findings points toward human analytical synthesis.
Storm-3168, Linked to JADEPUFFER, Abused Stolen Azure Identities | Huntaegis