[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9j_lKB2wwZuelBW4IAzACUkgtUl-jzjiTX5cHYzMxGQ":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"c80bdd7d-00e7-471b-8e99-1bbaf9aa46c1","Storm-3168: Agentic-driven cloud attacks using compromised service principals","storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals-8f643c","Microsoft details JADEPUFFER-linked Azure reconnaissance, resource deletion, and credential access using compromised service principals, identifying the activity as associated with Storm-3168 and providing guidance for defenders. The post Storm-3168: Agentic-driven cloud attacks using compromised service principals appeared first on Microsoft Security Blog.","Microsoft has identified malicious cloud activity linked to JADEPUFFER, tracked as Storm-3168, involving extensive Azure resource destruction using compromised service principals. The threat actor conducted reconnaissance and destructive operations targeting storage accounts, databases, and virtual machines, highlighting a shift towards AI-orchestrated attacks.","Storm-3168 actor uses compromised Azure service principals for reconnaissance and resource deletion.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F09\u002F25\u002Fstorm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F03\u002FMS_Actional-Insights_Adversarial-AI.png","2026-09-25T15:35:08+00:00","2026-09-25T20:00:10.512406+00:00",8,[17,20,22,25,28],{"name":18,"type":19},"JADEPUFFER","threat_actor",{"name":21,"type":19},"Storm-3168",{"name":23,"type":24},"Azure","product",{"name":26,"type":27},"service principals","technology",{"name":29,"type":30},"Microsoft","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,57],{"type":43,"value":18,"context":56},"Threat actor associated with the observed malicious cloud activity.",{"type":43,"value":21,"context":58},"Microsoft's tracking name for the threat actor and observed activity.",[29,23],{"controls":61,"vendors":149},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":92,"name":93,"problem":94,"products":95},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":121,"name":122,"problem":123,"products":124},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",[150],{"slug":151,"name":29,"logo_path":152,"roles":153},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[154,155],"reported_by","affected",{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":176},"ai-orchestrated-cloud-attacks-exploit-compromised-service-principals","AI-Orchestrated Cloud Attacks Exploit Compromised Service Principals","Storm-3168 (JADEPUFFER) leveraged compromised Azure service principals to conduct reconnaissance and destructive operations against storage accounts, databases, and virtual machines — demonstrating how over-privileged cloud identities become high-value attack vectors. The root cause lies in inadequate access control over non-human identities (service principals), which often accumulate excessive permissions and receive less scrutiny than user accounts. This attack marks a dangerous evolution: AI-orchestrated, agentic techniques allow threat actors to automate complex multi-stage cloud attacks at scale and speed that outpaces traditional human-driven defenses. The destructive nature of the campaign — not just data theft but resource obliteration — underscores the catastrophic business impact when cloud identity hygiene is neglected.",[161,162,163,164,165,166,167,168,169,170,171,172,173,174,175],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-207 – Zero Trust Architecture","NIST AC-2 – Account Management","NIST AC-6 – Least Privilege","NIST AU-6 – Audit Record Review, Analysis, and Reporting","NIST IR-4 – Incident Handling","NIST SI-4 – System Monitoring","MITRE ATT&CK T1078.004 – Valid Accounts: Cloud Accounts","MITRE ATT&CK T1485 – Data Destruction","MITRE ATT&CK T1580 – Cloud Infrastructure Discovery","Azure Security Benchmark – Identity Management (IM-1, IM-3)","GDPR Article 32 – Security of Processing (where EU data assets are involved)",{}]