Microsoft details Storm-3168, the JADEPUFFER-linked actor that used stolen service principals to delete Azure storage and harvest keys.

JadePuffer is a new AI-driven ransomware operator targeting Azure tenants with automated reconnaissance, credential theft, lateral movement, and destructive actions against cloud resources. Microsoft linked the activity to Storm-3168, which used compromised service principals to delete storage accounts, weaken recovery protections, and expand attacks to AI assets such as training data and vector databases. #JadePuffer #Storm3168 #Azure #EncForge #Microsoft

Two stolen Azure identities gave one attacker control over an entire cloud tenant in June 2026. According to new research from Microsoft Security, the JADEPUFFER Azure attack wiped most of the storage accounts it targeted in about seven minutes. Microsoft tracks the agentic ransomware actor behind it as Storm-3168. At a Glance Actor