Cases › security breach › LR-2026-0716
Storm-3168 / JADEPUFFER agentic attack on Azure via compromised service principals
Preliminary Why: 1 report: Tech Times · subject to change · 1 independent report
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity moderate: test: systems of another party were touched and the scope is bounded, as the sources state two subscriptions and more than 100 storage accounts, with no regulator or count of affected parties stated.
An AI-orchestrated attacker, tracked by Microsoft as Storm-3168 and linked to JADEPUFFER, used two compromised Azure service principals against an unnamed organization's cloud estate in early June 2026. One principal spent more than 15 hours enumerating resources, and the other then deleted more than 100 storage accounts, a Key Vault, a Function App and an App Service plan in about seven minutes. Accounts protected by Azure resource locks and deletion protection survived. About 30 minutes later the same principal collected storage keys with more than 30 ListKeys requests. Microsoft could not confirm the initial access vector, though a service principal's credentials had been posted in a public GitHub issue and remained in its edit history. Microsoft reported the activity in its Storm-3168 threat report, published September 25, 2026.
What happened
No source tells the story step by step yet.
What was done
No source states an action or fix.
Risks
Also96 incidents
Rising: 24 vs 4.0 a week
Sorted by rule from the case's fields; not yet read from the sources.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ApplicationShort-lived, scoped credentials · Secrets kept out of the model's context · Separate identity for each agent · Least-privilege access for the agent · Alerts on unusual tool use · Activity logs · Sensitive-data checks on outbound data
Infrastructure / targetSimilar incidents
Evidence
No source states: a step-by-step account, when it was found, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 6 items from the primary sources
What happened, in order
- early June 2026 Campaign begins with reconnaissance of the victim's Azure estate.
- September 25, 2026 Microsoft publishes the Storm-3168 threat report documenting the campaign.
Not dated in the sources:
- First service principal enumerates resources over more than 15 hours.
- About 90 minutes later a second service principal appears and sweeps two subscriptions.
- Main destructive sequence lasts about seven minutes.
- About 30 minutes after destruction, the same principal harvests storage account keys.
Show every field, with its source and grade
What happened
Impact
Notes on gaps
CSO Online notes the Azure evidence shows coordinated automation rather than proving AI directed each step, so the AI-agent characterisation rests on press and Microsoft's framing. The Azure SQL deletion failure came from an unsupported API version, not a designed control, so it is not linked. Earlier JADEPUFFER campaigns named in the sources are separate incidents and are excluded.
LR-2026-0716 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON