JADEPUFFER-Linked Attackers Wiped Azure Resources via Compromised Service Principals

Microsoft has reported a destructive attack inside an Azure environment, which it tracks as Storm-3168 and links to the threat actor known as JADEPUFFER. The incident took place in early June 2026 and ran for roughly 18 hours. According to researchers Yossi Weizman, Tushar Mudi and the Microsoft Security Research team, the attackers leveraged compromised service principals and targeted Azure Storage Accounts, SQL databases, Key Vaults, Function Apps, recovery protection locks, virtual machines and App Services.

Reconnaissance and destruction

Microsoft observed two compromised service principals belonging to the same tenant: one used for reconnaissance and resource discovery, the other for destructive operations and credential collection. The first identity spent nearly 16 hours enumerating virtual machines, subscriptions and resource groups, performing more than 300 read operations. The second one, 90 minutes later, enumerated virtual machines and resource groups across two subscriptions in just five seconds.

After 16 hours, the second principal reached App Service configuration stores — likely hunting for exposed credentials — and then carried out over 150 destructive or credential-collection operations in 35 minutes. The actual destruction lasted about seven minutes and involved more than 100 attempts to delete storage accounts.

What helped and what didn't

Most of the Azure Storage accounts were successfully deleted. However, resource locks and account-level deletion protection blocked several attempts — Microsoft stresses the value of independent safeguards that hold up even when a compromised identity wields broad administrative permissions. Attempts to delete Azure SQL databases failed because the actor used an unsupported API version.

Exactly how the service principal was compromised remains unclear. But Microsoft noted that its client ID, client secret and tenant ID had earlier been exposed in plaintext: an employee of the affected organization posted them in a public GitHub issue. The secret was removed, yet it stayed accessible through the public edit history.

AI-orchestrated attacks

JADEPUFFER was first documented by Sysdig as the first-ever ransomware operation run end-to-end by a large language model: an autonomous agent broke in through a Langflow flaw, harvested credentials, moved laterally and destroyed databases while narrating its own intent. The same Langflow instance was later hit again with a Go-based strain dubbed ENCFORGE, purpose-built for AI infrastructure.

Microsoft assesses the campaign's end goal as ransomware-aligned: backups and recovery resources were among the deleted assets, apparently to cripple the victim's ability to recover. No ransom note or successful data exfiltration was observed. The company sees this as a broader shift toward AI-orchestrated attacks and urges defenders to likewise use AI to investigate and respond.

Source: The Hacker News