JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources
Summary: Microsoft tracked an intrusion by JADEPUFFER, which it calls Storm-3168, in early June 2026 in which two compromised service principals in one Azure tenant were used over about 18 hours, one for reconnaissance and one for destruction. The destructive sequence lasted about seven minutes and included more than 100 storage account deletion attempts, along with attempts on an Azure Key Vault, Function App, App Service plan, and multiple Azure SQL databases, most of which failed due to an unsupported API version.
What you should know: Microsoft said the service principal's client ID, client secret, and tenant ID had been exposed in plaintext in a public GitHub issue by an employee of the impacted organization, and remained accessible through the public edit history after the secret was removed. Most targeted storage accounts were deleted; only resource locks and storage account-level deletion protection stopped some of them, which Microsoft cited as evidence that independent safeguards hold even when a compromised identity has broad administrative permissions.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Mentions
- CVE-2025-3248
- Related
- CVE-2025-3248: Langflow Missing Authentication Vulnerability Known Exploited Vulnerabilities · May 05, 2025