Storm-3168: Agentic-driven cloud attacks target Azure resources

Microsoft Security Research has identified a new wave of agentic-driven cloud attacks attributed to the threat actor JADEPUFFER, now tracked as Storm-3168. This represents the first documented instance of an agentic ransomware operation, characterized by the use of AI-orchestrated capabilities to coordinate complex post-compromise activities with high speed and scale.

In a recent observed incident, the attacker utilized two compromised service principals within a single Azure tenant to perform reconnaissance and mass destruction. The destructive phase lasted approximately seven minutes, during which the actor targeted Azure Storage Accounts, SQL databases, Key Vaults, Function Apps, and Virtual Machines. The investigation confirmed that the attacker attempted to disable recovery protection locks to maximize impact.

Following the destruction, the actor performed over 30 successful ListKeys requests to facilitate potential data exfiltration. Security experts recommend that organizations mitigate these risks by enforcing least privilege, protecting workload identities and secrets, and utilizing Microsoft Defender for Cloud protections.