Storm-3168 hackers use compromised Azure identities to destroy cloud resources

Microsoft researchers have identified a destructive cyberattack campaign linked to the threat actor Storm-3168, also known as JADEPUFFER. The attackers utilized compromised Azure service principals to conduct extensive reconnaissance and subsequent resource destruction within cloud environments.

According to Microsoft, the attack involved two compromised identities. One identity spent approximately 15.5 hours performing reconnaissance, enumerating virtual machines, subscriptions, and resource groups. A second identity performed rapid discovery before initiating a destructive sequence lasting roughly seven minutes. During this window, the attacker attempted over 150 destructive or credential-collection actions, including more than 100 attempts to delete Azure Storage accounts, many of which were successful.

The campaign also targeted Azure Key Vault, Function Apps, App Service plans, and recovery-related resources. Microsoft noted that some exposed credentials had previously appeared in a public GitHub issue; however, simply editing the issue did not invalidate the secrets, highlighting the necessity of full credential revocation. The incident underscores the risks of overly permissive identities and the speed at which automated, agentic attacks can cause cloud-wide disruption.