JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources

The threat actor known as JADEPUFFER has been observed orchestrating destructive actions within a Microsoft Azure environment using compromised service principals. Microsoft, which is tracking the activity under the name Storm-3168 , has called it an evolution of the threat actor's tradecraft. Th...

Storm-3168: Agentic-driven cloud attacks using compromised service principals

In this article 1. Attack overview 2. Technical analysis 3. Mitigation and protection guidance 4. References 5. Learn More Microsoft Security Research has identified malicious cloud activity associated with JADEPUFFER, a threat actor discovered by Sysdig in July 2026 and reported to be the first...

Storm-3168: Agentic-driven cloud attacks using compromised service principals

In this article 1. Attack overview 2. Technical analysis 3. Mitigation and protection guidance 4. References 5. Learn More Microsoft Security Research has identified malicious cloud activity associated with JADEPUFFER, a threat actor discovered by Sysdig in July 2026 and reported to be the first...