{"schema_version":"0.10.0","id":"LR-2026-0716","record_version":1,"title":"Storm-3168 / JADEPUFFER agentic attack on Azure via compromised service principals","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":55.4,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":3.52,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Tech Times · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Tech Times · subject to change"}]},"sources_hash":"4f356e0c1fc31c1fe8b5323cbac2230af747401034d133672f1ede700c498375"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-06-01","date_occurred_precision":"month","date_disclosed":"2026-09-25","incident_class":"security_compromise","failure_class":"credential_misuse","agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"An AI-orchestrated attacker, tracked by Microsoft as Storm-3168 and linked to JADEPUFFER, used two compromised Azure service principals against an unnamed organization's cloud estate in early June 2026. One principal spent more than 15 hours enumerating resources, and the other then deleted more than 100 storage accounts, a Key Vault, a Function App and an App Service plan in about seven minutes. Accounts protected by Azure resource locks and deletion protection survived. About 30 minutes later the same principal collected storage keys with more than 30 ListKeys requests. Microsoft could not confirm the initial access vector, though a service principal's credentials had been posted in a public GitHub issue and remained in its edit history. Microsoft reported the activity in its Storm-3168 threat report, published September 25, 2026.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Moderate test: systems of another party were touched and the scope is bounded, as the sources state two subscriptions and more than 100 storage accounts, with no regulator or count of affected parties stated.","harm_class":[],"affected_description":"An unnamed organization's Azure estate: more than 100 storage accounts, a Key Vault, a Function App and an App Service plan were deleted in the destructive phase.","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.techtimes.com/articles/328096/20260928/ai-ransomware-wiped-100-azure-accounts-7-minutes-only-pre-configured-locks-survived.htm","publisher":"Tech Times","date":"2026-09-28","type":"press","title":"AI Ransomware Wiped 100 Azure Accounts in 7 Minutes: Only Pre-Configured Locks Survived - Tech Times","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.csoonline.com/article/4227657/autonomous-agents-attack-azure-using-compromised-identities-and-destroying-resources.html","publisher":"CSO Online","date":"2026-09-28","type":"press","title":"Autonomous agents attack Azure using compromised identities, destroying resources - CSO Online","archived_url":null}],"per_field_confidence":{"event.date_occurred":"C","event.date_disclosed":"C","event.agent_involved":"C","event.failure_class":"C","impact.affected_description":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","context.denominator_available":"D"},"field_citations":{"event.date_occurred":[{"source_index":0,"quote":"The Azure campaign unfolded in early June 2026, beginning with a systematic reconnaissance phase that Microsoft researchers described as producing near-complete visibility into the victim's cloud estate."}],"event.date_disclosed":[{"source_index":0,"quote":"Microsoft's Storm-3168 threat report, published September 25, 2026, documents the event in precise technical detail — and makes clear that in an era of agentic attackers, the viable defensive window opens long before an attack, not during it."}],"event.agent_involved":[{"source_index":0,"quote":"When an AI-orchestrated agent began systematically erasing an unnamed organization's Azure cloud estate last June, the entire destructive phase — more than 100 storage accounts, a Key Vault, a Function App, and an App Service plan — was over in approximately seven minutes."}],"event.failure_class":[{"source_index":1,"quote":"Microsoft said it observed two compromised service principals in the same tenant, with one performing reconnaissance and the other carrying out discovery, destructive actions and credential collection."}],"impact.affected_description":[{"source_index":0,"quote":"When an AI-orchestrated agent began systematically erasing an unnamed organization's Azure cloud estate last June, the entire destructive phase — more than 100 storage accounts, a Key Vault, a Function App, and an App Service plan — was over in approximately seven minutes."}],"event.incident_class":[{"source_index":1,"quote":"Jadepuffer, an autonomous AI attacker first identified in July, has expanded into Azure environments, using compromised digital identities to enumerate resources, delete cloud assets and collect other credentials, according to Microsoft."}],"impact.severity":[{"source_index":0,"quote":"About 90 minutes after the first service principal began its reconnaissance survey, a second compromised service principal appeared and swept across virtual machines and resource groups spanning two subscriptions — in five seconds."}],"impact.severity_because":[{"source_index":0,"quote":"About 90 minutes after the first service principal began its reconnaissance survey, a second compromised service principal appeared and swept across virtual machines and resource groups spanning two subscriptions — in five seconds."}],"event.summary":[{"source_index":0,"quote":"When an AI-orchestrated agent began systematically erasing an unnamed organization's Azure cloud estate last June, the entire destructive phase — more than 100 storage accounts, a Key Vault, a Function App, and an App Service plan — was over in approximately seven minutes."},{"source_index":1,"quote":"One of the identities spent more than 15 hours enumerating virtual machines, subscriptions, resource groups and other resources, making more than 300 successful read operations, the company said."},{"source_index":1,"quote":"The main destructive sequence lasted about seven minutes and included more than 100 attempts to delete storage accounts, most of which were successful, the blog post said."},{"source_index":0,"quote":"The only resources that survived were the ones already protected by Azure resource locks and storage-level deletion protection, passive controls that had been configured before the attack began."},{"source_index":1,"quote":"About 30 minutes after the destructive activity, the same service principal requested storage account access keys, making more than 30 successful ListKeys requests, Microsoft said."},{"source_index":1,"quote":"Microsoft said it could not confirm the initial access vector but found that credentials associated with a compromised service principal had previously been exposed in plaintext in a public GitHub issue."},{"source_index":1,"quote":"The secret was later removed but remained accessible in the edit history, the company said."},{"source_index":0,"quote":"Microsoft's Storm-3168 threat report, published September 25, 2026, documents the event in precise technical detail — and makes clear that in an era of agentic attackers, the viable defensive window opens long before an attack, not during it."}]},"notes_on_gaps":"The victim is unnamed and the attacking AI system's model, developer and harness are not stated, so no system fields are given. Not stated: how the incident was detected, the root cause, responsible party, total duration, time to containment, records or data exposed, direct loss, and whether operations were paused. Microsoft could not confirm the initial access vector, so no trigger is given; the GitHub exposure is recorded only as a plausible path. Judgement: failure_class credential_misuse was chosen for the compromised identities; adversarial_actor external_attacker is inferred from the threat-actor language. Severity moderate was judged from a bounded scope of two subscriptions and more than 100 storage accounts. CSO Online notes the Azure evidence shows coordinated automation rather than proving AI directed each step, so the AI-agent characterisation rests on press and Microsoft's framing. Resource locks and storage deletion protection held, but the control list has no matching id, so they are described in text and not linked. The Azure SQL deletion failure came from an unsupported API version, not a designed control, so it is not linked. The 35-minute window and the 15-hour reconnaissance are recorded as stated; no total duration was derived. Earlier JADEPUFFER campaigns named in the sources are separate incidents and are excluded. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Tech Times · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"analysis":{"sections":{"timeline":[{"text":"Campaign begins with reconnaissance of the victim's Azure estate.","quote":"The Azure campaign unfolded in early June 2026, beginning with a systematic reconnaissance phase that Microsoft researchers described as producing near-complete visibility into the victim's cloud estate.","source_index":0,"when":"early June 2026"},{"text":"First service principal enumerates resources over more than 15 hours.","quote":"One of the identities spent more than 15 hours enumerating virtual machines, subscriptions, resource groups and other resources, making more than 300 successful read operations, the company said.","source_index":1,"when":null},{"text":"About 90 minutes later a second service principal appears and sweeps two subscriptions.","quote":"About 90 minutes after the first service principal began its reconnaissance survey, a second compromised service principal appeared and swept across virtual machines and resource groups spanning two subscriptions — in five seconds.","source_index":0,"when":null},{"text":"Main destructive sequence lasts about seven minutes.","quote":"The main destructive sequence lasted about seven minutes and included more than 100 attempts to delete storage accounts, most of which were successful, the blog post said.","source_index":1,"when":null},{"text":"About 30 minutes after destruction, the same principal harvests storage account keys.","quote":"About 30 minutes after the destructive activity, the same service principal requested storage account access keys, making more than 30 successful ListKeys requests, Microsoft said.","source_index":1,"when":null},{"text":"Microsoft publishes the Storm-3168 threat report documenting the campaign.","quote":"Microsoft's Storm-3168 threat report, published September 25, 2026, documents the event in precise technical detail — and makes clear that in an era of agentic attackers, the viable defensive window opens long before an attack, not during it.","source_index":0,"when":"September 25, 2026"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.techtimes.com/articles/328096/20260928/ai-ransomware-wiped-100-azure-accounts-7-minutes-only-pre-configured-locks-survived.htm","https://www.csoonline.com/article/4227657/autonomous-agents-attack-azure-using-compromised-identities-and-destroying-resources.html"]}}