Microsoft says JadePuffer crew wiped 100+ Azure storage accounts

Microsoft has published details of a destructive cloud attack in which the criminal behind the JadePuffer ransomware compromised two Azure service principals and deleted more than 100 Azure Storage accounts. The findings were reported on 28 September 2026 by Microsoft researchers Yossi Weizman and Tushar Mudi, and cover activity over roughly 18 hours in early June. Microsoft tracks the actor as Storm-3168. No ransom note was observed and Microsoft did not confirm any data exfiltration.

According to The Register, JadePuffer was uncovered in July by Sysdig threat hunters and was described as the first documented agentic ransomware infection, in which a large language model drove the whole extortion operation, from initial access through to compromising a production database server and destroying data. Microsoft says the same attacker has now turned to stolen Azure identities.

The two compromised service principals, which are machine identities used by applications to access Azure resources, belonged to the same cloud tenant. One was used for reconnaissance and resource discovery; the other carried out the destruction and credential collection. Microsoft's researchers said they do not know how the identities were initially hijacked, but noted that an employee at the same organisation had previously exposed client IDs, client secrets and tenant IDs in plaintext in a public GitHub issue. The researchers added that since the start of the year they had seen repeated probing from Storm-3168-linked infrastructure against multiple Azure App Services belonging to different customers.

The discovery phase alone ran for about 15 hours and 30 minutes. In that time the first service principal completed more than 300 successful read operations, gathering details on Azure virtual machines, subscriptions, resource groups and resources. Microsoft said this breadth of activity would have given the attacker visibility across the organisation's Azure environment. Around 90 minutes in, the second service principal began reading virtual machines and resource groups across two subscriptions in five seconds. Both identities used Storm-3168-linked infrastructure, the same network fingerprint and the user agent python-requests/2.34.2.

Roughly 16 hours after the first reads, the second identity found Azure App Service configuration stores, which Microsoft said was likely a hunt for exposed credentials, and failed in an attempt to locate Azure OpenSearch resources. Seventy seconds later it tried a ListKey operation against a storage account that did not exist.

The destructive stage involved more than 150 destructive or credential-stealing attempts in 35 minutes, with the deletions themselves compressed into about seven minutes. Most of the attempts to remove more than 100 storage accounts succeeded, though Azure resource locks and storage account-level deletion protection blocked a few. The attacker also deleted an Azure Key Vault, a Function App and an App Service plan, all in the same resource group. Parallel attempts to delete multiple Azure SQL databases all failed because the attacker used an unsupported API version for that resource type.

About 28 minutes after the deletions stopped, the same identity requested an inventory of storage accounts and made more than 30 successful ListKeys requests to retrieve access keys, including for Azure Site Recovery storage accounts. Several attempts to remove Azure Site Recovery and Azure Backup protection locks failed.

Microsoft said the combination of resource destruction, interference with recovery mechanisms and credential collection is consistent with tactics that support ransomware and extortion operations.