JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources

Microsoft disclosed that the ransomware-linked group it tracks as Storm-3168 — associated with the previously documented JADEPUFFER crew — abused two compromised Azure service principals to carry out a destructive attack in early June 2026, lasting roughly 18 hours. The attackers reportedly obtained the credentials after a client ID, client secret, and tenant ID belonging to the targeted organization were briefly exposed in a public GitHub issue and remained retrievable via edit history even after removal. One service principal spent nearly 16 hours enumerating virtual machines, subscriptions, and resource groups with over 300 read operations, while the second performed credential-hunting and over 150 destructive actions in just 35 minutes, deleting most targeted Azure Storage Accounts along with a Key Vault, Function App, and App Service plan. Attempts to delete Azure SQL databases failed due to an unsupported API version, and resource locks blocked some storage deletions, showing how layered protections can limit damage even when an identity has broad admin rights. Microsoft notes this fits JADEPUFFER's pattern of AI-assisted, agentic operations — previously seen exploiting a Langflow flaw (CVE-2025-3248) and deploying the ENCFORGE ransomware — though no ransom note or data theft was confirmed in this specific intrusion.