{"data":{"id":"ad47b23d-8789-4c1f-9948-78af5446855a","title":"Storm-3168: Agentic-driven cloud attacks using compromised service principals","summary":"Microsoft Security Research reports Azure-focused destructive activity by the threat actor JADEPUFFER, tracked as Storm-3168, using two compromised service principals in a single tenant. The attacker enumerated resources for about 15 hours and 30 minutes, then ran a roughly seven-minute destructive sequence with 100+ storage account deletion attempts, most of which succeeded. Azure resource locks and storage account-level deletion protection blocked a few deletions.","solution":"Organizations can reduce exposure by protecting workload identities and secrets, enforcing least privilege, safeguarding recovery resources, and enabling relevant Microsoft Defender for Cloud protections. Publicly exposed credentials remain usable until revoked or rotated; removing the original disclosure alone does not remediate the exposure.","labels":["security","industry"],"sourceUrl":"https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/","publishedAt":"2026-09-25T15:35:08.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Microsoft"],"affectedVendorsRaw":["Microsoft Azure","Azure OpenSearch","Sysdig"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-09-25T15:35:08.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.75,"researchCategory":null,"atlasIds":null}}