A threat actor tracked as Storm-3168 has been conducting JadePuffer Azure tenant attacks that map cloud environments, harvest credentials, and then erase core infrastructure at speed, in two observed incidents, the destructive phase lasted just seven minutes. The group operates a ransomware campaign that Dark Reading describes as the first documented large language model (LLM)-driven ransomware operation, according to identification work carried out by cloud security company Sysdig.
How JadePuffer Azure Tenant Attacks Unfold
Microsoft Security Research observed the two attacks in June, publishing its findings on 25 September 2026. In both cases, Storm-3168 used two compromised service principals belonging to the same tenant. Service principals are security identities that allow applications, hosted services, and automated tools to authenticate to Azure and access assigned resources. One principal handled reconnaissance and resource discovery; the other, in Microsoft’s words, ‘performed discovery, destructive operations, and credential collection.’
The reconnaissance phase was anything but rushed. According to a research note from the Cloud Security Alliance Lab Space, the actor mapped a victim’s environment in a single continuous 15-hour-30-minute pass before triggering destructive operations. That kind of sustained, methodical surveying (presumably automated across the full attack chain) is a departure from the more opportunistic smash-and-grab pattern typical of commodity ransomware crews.
When the destructive stage did arrive, it moved fast. The attacks targeted more than 100 storage accounts, along with Key Vaults, Function Apps, Virtual Machines, and App Services. The attacker also removed Azure Site Recovery locks, an explicit attempt to hamper restoration. Some storage accounts survived, thanks to Azure resource locks and storage account-level protections, a small but real illustration of why those controls exist.
Attempts to delete Azure SQL databases failed because the attacker used an unsupported API version. Attempts to remove certain recovery protection locks also failed. Even so, the scope of what did succeed was substantial.
Credential Theft and Expanded Targeting
Roughly half an hour after the wipe attempts, Storm-3168 returned to make more than 30 requests for storage account keys, the majority of which succeeded. That post-destruction credential sweep fits a ransomware extortion pattern: gather proof of access and leverage before making demands. Microsoft did not report any financial demands in the observed cases and did not confirm data theft.
‘The parallel targeting of Azure SQL databases and storage accounts suggests an effort to broaden the destructive impact across different data services rather than concentrating on a single resource type,’ Microsoft said.
Sysdig’s earlier research placed JadePuffer Azure tenant attacks in a broader context. The group emerged in July, with Sysdig researchers highlighting that it uses AI agents to automate the entire attack chain, from reconnaissance and credential theft through lateral movement, persistence, and data encryption. Shortly after, the company noted that JadePuffer had expanded its focus to AI assets, training datasets, and vector databases, deploying a tool called EncForge for that purpose. Being identified as the first documented LLM-driven ransomware operation puts Storm-3168 in a category of its own, at least for now.
Microsoft could not determine exactly how initial access occurred in the two June incidents, but noted that credentials for one service principal had appeared in a public GitHub issue before the attacks. The exposure of secrets in public repositories remains a persistent and underestimated risk for organisations running cloud workloads.
What Defenders Should Do
Microsoft’s researchers set out several mitigation steps for system administrators. These include activating cloud workload protections, auditing public repositories for exposed secrets, and evaluating Azure role-based access control (RBAC) permissions against least-privilege principles. The survival of some storage accounts because of resource locks and account-level protections in the observed attacks reinforces the practical value of those controls: they demonstrably slowed Storm-3168 down.
Credentials for one of the compromised service principals were publicly visible in a GitHub issue before the attack sequence began, making secret hygiene, not just perimeter hardening, the immediate first step for any team reviewing their Azure posture after reading Microsoft’s findings.
