Microsoft reported that the JadePuffer ransomware actor, tracked as Storm-3168, compromised two Azure service principals and used them over an 18-hour period to conduct reconnaissance, collect credentials, and destroy over 100 Azure Storage accounts plus a Key Vault, Function App, and App service plan, likely in preparation for a ransomware/extortion operation. No ransom note was sent and no data exfiltration was confirmed.
Occurred 1 June 2026 · Disclosed 28 September 2026 · Record updated 1 October 2026
Attacker used two compromised Azure service principals to perform reconnaissance across a tenant's Azure environment, then deleted over 100 Azure Storage accounts, a Key Vault, Function App, and App service plan, and attempted to interfere with backup and recovery mechanisms.
IncidentsThe actor behind the first documented agentic ransomware case used two hijacked Azure machine identities for an 18-hour destructive spree in early June, Microsoft said.
28 Sept 2026
