Microsoft has issued a warning regarding a sophisticated AI attacker, Jadepuffer, which has infiltrated Azure environments since its identification in July. This malicious entity utilizes compromised digital identities to systematically enumerate resources, delete cloud assets, and harvest credentials.
In their latest blog post on Storm-3168, Microsoft detailed the ongoing destructive operations facilitated by these compromises. “Extensive Azure-focused resource destruction activity using compromised service principals and cloud credential collection could support future exfiltration,” they stated. Service principals, unique identities assigned to applications within Azure, were at the center of this assault.
The attack was initially reported by Sysdig in July, where Jadepuffer was portrayed as an AI-driven adversary capable of executing steps autonomously, encompassing actions from exploitation to credential access and resource destruction.
Two Distinct Identities, Distinct Roles
Analysis by Microsoft uncovered that two compromised service principals operated within the same tenant. One focused on reconnaissance while the other executed destructive actions and collected credentials. The first identity was particularly active, spending over 15 hours enumerating virtual machines, subscriptions, and resource groups, executing more than 300 successful read operations. Meanwhile, the secondary agent quickly enumerated resources across multiple subscriptions and followed up with additional discovery efforts.
This division of roles and the timing of actions strongly suggest automated execution. Nick Tausek, the lead security automation architect at Swimlane, noted the campaign aligns with earlier observed behaviors, indicating that Jadepuffer had mapped out resources in Azure prior to a rapid, chaotic phase of destruction.
Destruction in Minutes
Once the reconnaissance phase concluded, Jadepuffer initiated a frenzy of destructive actions, conducting over 150 operations linked to destruction or credential-related tasks in just 35 minutes. The peak of this destruction spanned approximately seven minutes, culminating in more than 100 attempts to delete storage accounts—most of which were executed successfully.
The attackers also managed to delete an Azure Key Vault, Function App, and an App Service plan connected to the targeted resource group. Additionally, attempts were made to eliminate Azure SQL databases and interfere with backup-related protections such as Azure Site Recovery locks.
Tausek remarked on the speed of these coordinated actions, suggesting that traditional response models may struggle to keep pace. “An AI SOC needs to connect identity activity with cloud changes rapidly to contain the damage,” he stated.
Credential Access After Destruction
About half an hour post-destructive operations, one compromised principal made requests for storage account access keys, successfully conducting more than 30 ListKeys requests. These requests targeted storage accounts associated with recovery services.
Microsoft indicated that this combination of resource deletion, interference with backup mechanisms, and credential harvesting aligns with tactics that could enable ransomware operations. No ransom note or confirmed data exfiltration was observed during the incident.
Ross Filipek, CISO of Corsica Technologies, emphasized that the sequence of destruction followed by credential access presents additional response challenges. “The recovery process involves more than just restoring what was deleted; it’s about assessing the extent of credential compromise,” he noted.
The Risk of Credential Exposure
While Microsoft couldn't pinpoint the initial access vector, it was revealed that credentials for a compromised service principal were exposed in plaintext on a public GitHub issue. Although this secret was subsequently removed, its edit history rendered it accessible.
Microsoft stressed that publicly exposed credentials remain effective until they are revoked or rotated, with simply removing the disclosure not sufficing for remediation. Filipek remarked on the relevance of this incident, highlighting the persistent risk of cloud credentials in public forums. “Just because something is scrubbed from view doesn’t mean it’s gone,” he added.
Emphasizing Automation and Accountability
Microsoft acknowledged that this attack reflects a broader trend toward AI-coordinated assaults, suggesting that threat actors can execute operations across cloud platforms with unprecedented speed. While this specific incident exhibits signs of coordinated automation, Tausek cautioned against assuming that AI directed every step of the operation.
Tausek noted that agentic AI could assist analysts in reconstructing event sequences to facilitate swift containment actions. “Having AI in the process can help analysts focus on critical containment while awaiting human approval for actions,” he explained.
Focus on Security Controls
To mitigate risks stemming from similar attacks, Microsoft advises organizations to prioritize protecting workload identities, enforcing least-privilege access, and securing backup and recovery resources. Tausek recommended rotating exposed credentials and limiting service principal permissions.
Filipek emphasized the necessity for a coordinated response strategy across IT teams. “Proper preparation requires collaboration among development, cloud operations, and incident response teams,” he said. “Waiting until a crisis emerges to figure out credential ownership can lead to detrimental delays.”
