JadePuffer Leverages AI Agents in Automated Attacks on Azure Environments
The JadePuffer ransomware operator, tracked by Microsoft as Storm-3168, has been observed conducting agent-driven attacks against Azure tenants, utilizing AI agents to automate the full attack lifecycle. According to findings from cloud security firm Sysdig, the malware emerged in July 2026 and employs artificial intelligence to streamline reconnaissance, credential theft, lateral movement, persistence, and data encryption.
Researchers noted that JadePuffer initially focused on cloud infrastructure but later expanded its scope to include AI-specific assets such as training datasets and vector databases, leveraging a tool named EncForge to support these operations.
Destructive Phase Targets Storage, Key Vaults, and Compute Resources
In two separate incidents observed in June 2026, Microsoft Security Research detected Storm-3168 conducting extensive mapping of Azure resources, extracting storage account keys, and initiating widespread deletion of cloud assets. The destructive phase lasted approximately seven minutes and targeted more than 100 Azure Storage accounts, alongside Azure Key Vaults, Function Apps, Virtual Machines, and App Services.
Despite the scale of the assault, not all targeted storage accounts were successfully deleted. Some remained intact due to Azure resource locks and storage account-level protections, which mitigated the impact of the wiper-like activity.
Attackers Use Compromised Service Principals for Privileged Access
Microsoft identified that the threat actor leveraged two compromised service principals — security identities used by applications and automated tools to authenticate to Azure — both belonging to the same tenant. One service principal was primarily used for reconnaissance and resource discovery, while the second was employed to perform discovery, execute destructive operations, and collect credentials.
The actor attempted to weaken recovery capabilities by removing Azure Site Recovery locks, which are designed to protect backup and disaster recovery configurations. This effort suggests an intent to impede restoration, potentially supporting future ransomware extortion, although Microsoft did not observe ransom notes or confirm data theft in these incidents.
Failed Attempts Highlight Limitations in Attacker’s Tactics
Not all destructive actions succeeded. Attempts to delete Azure SQL databases failed due to the use of an unsupported API version. Similarly, efforts to remove recovery protection locks were unsuccessful, indicating that certain Azure defenses remained effective under attack.
Microsoft highlighted that the parallel targeting of storage accounts and SQL databases reflects a strategy aimed at maximizing damage across multiple data services rather than focusing on a single resource type.
Post-Attack Behavior Reveals Continued Reconnaissance
Approximately thirty minutes after the initial destructive wave, Storm-3168 resumed activity, issuing more than 30 requests for storage account keys. The majority of these requests succeeded, suggesting sustained access and ongoing interest in maintaining or re-exploiting privileged access to storage resources.
Although the exact initial access vector remains undetermined, Microsoft noted that credentials for one of the compromised service principals had been exposed in a public GitHub issue prior to the attacks, underscoring the risk of secret leakage in developer environments.
Mitigation Guidance Focuses on Detection and Least Privilege
Sysdig researchers and Microsoft recommend several defensive measures for organizations using Azure: enabling cloud workload protection platforms, auditing public repositories for exposed secrets, and reviewing Role-Based Access Control (RBAC) assignments to enforce least-privilege principles.
These steps are intended to reduce the attack surface and improve detection of anomalous behavior associated with AI-driven automation in cloud environments.
Source: BleepingComputer