{
 "id": "TR-2026-015",
 "status": "published",
 "title": "Storm-3168 (JADEPUFFER): Agentic-driven cloud attacks using compromised service principals",
 "date": "2026-06-01",
 "window": "Early June 2026",
 "ai_role": "attacker",
 "category": "incident",
 "summary": "Microsoft Security Research reported that JADEPUFFER (tracked as Storm-3168), previously described by Sysdig as the first documented agentic ransomware operation, used two compromised service principals in one Azure tenant. One performed reconnaissance and the other performed discovery, bulk resource deletion and storage key collection. Microsoft said the timing and division of work strongly indicated automated or scripted execution. Resource locks and deletion protection blocked some deletions, and SQL database deletions failed because of an unsupported API version.",
 "attacker": {
  "description": "JADEPUFFER / Storm-3168, a threat actor reported as an agentic ransomware operation using compromised service principals and automated tooling"
 },
 "defender": {
  "description": "An unnamed organization's Azure tenant, with Microsoft Security Research investigating"
 },
 "scale": "Two compromised service principals; 300+ read operations over about 15.5 hours; 150+ destructive or credential-collection operations in 35 minutes; destructive sequence of about 7 minutes; 100+ storage account deletion attempts; 30+ successful ListKeys requests; five tokens for the destruction service principal",
 "impact": "Most targeted Azure Storage accounts were deleted, along with one Key Vault, one Function App and one App Service plan. Some storage accounts were protected by resource locks and deletion protection. SQL database deletions and attempts to remove Site Recovery and Backup locks failed. Storage account keys were retrieved, which could enable later data access. No ransom note or confirmed exfiltration was observed.",
 "tactics": [
  "TA0006",
  "TA0007",
  "TA0009",
  "TA0040",
  "TA0043"
 ],
 "timeline": [
  {
   "date": "2026-07",
   "text": "Sysdig discovered JADEPUFFER and reported it as the first documented agentic ransomware operation.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-06",
   "text": "One compromised service principal enumerated VMs, subscriptions, resource groups and resources for about 15.5 hours.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-06",
   "text": "About 90 minutes later, a second service principal enumerated VMs and resource groups across two subscriptions in five seconds.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-06",
   "text": "About 16 hours later, the second service principal enumerated App Service configuration stores, then began a roughly seven-minute destructive sequence.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-06",
   "text": "About 30 minutes after the final destructive activity, the same service principal made 30+ successful storage key retrieval requests.",
   "tier": null,
   "source": "1"
  }
 ],
 "lessons": [],
 "models_named": [],
 "related_agents": [],
 "vendor_response": "Microsoft published findings and mitigation guidance: enable Defender for Cloud plans, protect and rotate exposed credentials, apply least privilege to service principals, protect backup and recovery infrastructure, and use agentic defenses such as Project Perception and MDASH. It also listed Defender XDR detections.",
 "sources": [
  {
   "title": "JadePuffer AI Actor Compromises Azure Tenant in Destructive Cloud Attack",
   "url": "https://www.darkreading.com/cloud-security/jadepuffer-ai-actor-azure-tenant-destructive-cloud-attack",
   "outlet": "Dark Reading",
   "date": "2026-09-28"
  },
  {
   "title": "Storm-3168: agentic-driven cloud attacks using compromised service principals",
   "url": "https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/",
   "outlet": "Microsoft Security",
   "date": "2026-09-25"
  },
  {
   "title": "JADEPUFFER: agentic ransomware for automated database extortion",
   "url": "https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion",
   "outlet": "Sysdig",
   "date": "2026-07"
  },
  {
   "title": "This AI agent autonomously hacked a network, adapted on the fly, and demanded a ransom",
   "url": "https://www.csoonline.com/article/4193195/this-ai-agent-autonomously-hacked-a-network-adapted-on-the-fly-and-demanded-a-ransom.html",
   "outlet": "CSO Online",
   "date": "2026-07-06"
  }
 ],
 "reviewer": "model: claude-sonnet-5-5 (automated review)",
 "checked_on": "2026-10-25"
}