# Storm-3168 agentic cloud attacks on Azure > Live situation record from CLSTR: https://clstr.news/situations/storm-3168-agentic-cloud-attacks-on-azure > Updated: 2026-09-29T00:41:13.000Z. Sources: 6. Developments: 2. Microsoft researchers have identified a destructive cyberattack campaign attributed to the threat actor Storm-3168, also known as JADEPUFFER. The campaign is characterized as the first documented instance of an “agentic ransomware operation,” utilizing AI-orchestrated capabilities to execute complex activities with high speed and scale. In observed incidents, attackers utilized compromised Azure service principals to conduct reconnaissance and subsequent resource destruction. One identity spent approximately 15.5 hours enumerating virtual machines, subscriptions, and resource groups, while a second identity initiated a rapid destructive sequence lasting roughly seven minutes. During this window, the actor attempted over 150 destructive or credential-collection actions, including more than 100 attempts to delete Azure Storage accounts. The attacks targeted various Azure resources, including SQL databases, Key Vaults, Function Apps, and Virtual Machines. The attackers also attempted to disable recovery protection locks to maximize impact and performed over 30 successful ListKeys requests to facilitate potential data exfiltration. Security experts emphasize the necessity of enforcing least privilege and full credential revocation to mitigate these risks. ## Timeline ### 2026-09-29: Storm-3168: Agentic-driven cloud attacks target Azure resources Microsoft has identified Storm-3168 (JADEPUFFER), the first documented agentic ransomware operation, which uses compromised service principals to rapidly destroy Azure resources. 2 sources. https://clstr.news/cluster/storm-3168-agentic-driven-cloud-attacks-target-azure-resources ### 2026-09-26: Storm-3168 hackers use compromised Azure identities to destroy cloud resources Microsoft has uncovered a destructive Azure cloud campaign by threat actor Storm-3168, which used compromised service principals to delete storage accounts and target critical cloud resources. 5 sources. https://clstr.news/cluster/storm-3168-hackers-use-compromised-azure-identities-to-destroy-cloud-resources --- Cite as: Storm-3168 agentic cloud attacks on Azure. CLSTR, https://clstr.news/situations/storm-3168-agentic-cloud-attacks-on-azure