👩‍💻 Storm-3168: Agentic-driven cloud attacks using compromised service principals

Storm-3168 (JADEPUFFER) used compromised Azure service principals to conduct automated reconnaissance, bulk deletion of Storage Accounts, Key Vaults, and Function Apps, and credential harvesting via ListKeys, consistent with ransomware-aligned objectives. Mitigations include least privilege, secret rotation, and resource locks.

https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals

#azure