Storm-3168 (JADEPUFFER): Agentic-driven cloud attacks using compromised service principals

Microsoft Security Research reported that JADEPUFFER (tracked as Storm-3168), previously described by Sysdig as the first documented agentic ransomware operation, used two compromised service principals in one Azure tenant. One performed reconnaissance and the other performed discovery, bulk resource deletion and storage key collection. Microsoft said the timing and division of work strongly indicated automated or scripted execution. Resource locks and deletion protection blocked some deletions, and SQL database deletions failed because of an unsupported API version.

Export STIX 2.1 Export JSON Request a correction (GitHub issue)

Timeline

2026-07 Sysdig discovered JADEPUFFER and reported it as the first documented agentic ransomware operation. · Dark Reading

2026-06 One compromised service principal enumerated VMs, subscriptions, resource groups and resources for about 15.5 hours. · Dark Reading

2026-06 About 90 minutes later, a second service principal enumerated VMs and resource groups across two subscriptions in five seconds. · Dark Reading

2026-06 About 16 hours later, the second service principal enumerated App Service configuration stores, then began a roughly seven-minute destructive sequence. · Dark Reading

2026-06 About 30 minutes after the final destructive activity, the same service principal made 30+ successful storage key retrieval requests. · Dark Reading

Sources · 4

JadePuffer AI Actor Compromises Azure Tenant in Destructive Cloud Attack — Dark Reading, 2026-09-28 ○ On 2026-10-26, this link could not be verified (bot wall).
Storm-3168: agentic-driven cloud attacks using compromised service principals — Microsoft Security, 2026-09-25
JADEPUFFER: agentic ransomware for automated database extortion — Sysdig, 2026-07
This AI agent autonomously hacked a network, adapted on the fly, and demanded a ransom — CSO Online, 2026-07-06

Links re-checked 2026-10-26 by the weekly refresh. A link that moved or stopped answering is flagged above; it is not a change to the record.

At a glance · as reported

Window	Early June 2026
Attacker	JADEPUFFER / Storm-3168, a threat actor reported as an agentic ransomware operation using compromised service principals and automated tooling
Scale	Two compromised service principals; 300+ read operations over about 15.5 hours; 150+ destructive or credential-collection operations in 35 minutes; destructive sequence of about 7 minutes; 100+ storage account deletion attempts; 30+ successful ListKeys requests; five tokens for the destruction service principal
Impact	Most targeted Azure Storage accounts were deleted, along with one Key Vault, one Function App and one App Service plan. Some storage accounts were protected by resource locks and deletion protection. SQL database deletions and attempts to remove Site Recovery and Backup locks failed. Storage account keys were retrieved, which could enable later data access. No ransom note or confirmed exfiltration was observed.
Defender	An unnamed organization's Azure tenant, with Microsoft Security Research investigating
Response	Microsoft published findings and mitigation guidance: enable Defender for Cloud plans, protect and rotate exposed credentials, apply least privilege to service principals, protect backup and recovery infrastructure, and use agentic defenses such as Project Perception and MDASH. It also listed Defender XDR detections.

Tactics (MITRE ATT&CK)

TA0006 Credential Access
TA0007 Discovery
TA0009 Collection
TA0040 Impact
TA0043 Reconnaissance

Mapped by the maintainer from the reports.

Published by the weekly machine review (claude-sonnet-5-5 (automated review)) from the sources above on 2026-10-25: every field is as the sources state it, or empty. Compiled from the public sources above, as reported. Not an attribution, a finding of fault or a legal conclusion; figures are those stated by the sources. One event, as of its sources' dates.