vendor
JADEPUFFER used compromised service principals to destroy Azure resources
The first documented agentic ransomware operation shows what happens when workload identities become the attack path, and most orgs still treat them as plumbing, not a threat surface.
Microsoft detailed Storm-3168's Azure operations, two compromised service principals from the same tenant ran reconnaissance for 15+ hours, then executed a seven-minute destructive sequence of 100+ storage account deletion attempts, most succeeding. The same principals also enumerated App Service configuration stores and attempted credential collection, consistent with prior JADEPUFFER patterns Sysdig documented in July. The activity used python-requests/2.34.2 and infrastructure already linked to the actor. Microsoft calls it an evolution: agentic orchestration compressing post-compromise operations that would normally require manual coordination.