JadePuffer used a service principal leaked in a GitHub issue to wipe Azure resources in seven minutes
Microsoft says the operator it tracks as Storm-3168 used two compromised service principals and an AI-driven toolchain to map an Azure tenant, pull storage keys, delete recovery locks and destroy resources in a seven-minute window.
Microsoft and Sysdig have detailed JadePuffer, a ransomware operator Microsoft tracks as Storm-3168, running agent-driven attacks against Azure tenants. In two attacks observed in June, the operation used two compromised service principals in the same tenant: one for reconnaissance and resource discovery, the second for further discovery, credential collection and destruction. It targeted more than 100 storage accounts along with Key Vaults, Function Apps, virtual machines and App Services, made more than 30 requests for storage account keys, most of which succeeded, and removed Azure Site Recovery locks to block recovery. The destructive phase took seven minutes; parallel attempts to delete Azure SQL resources failed on an unsupported API version. Microsoft could not determine the initial access, but credentials for one of the service principals had appeared in a public GitHub issue before the attacks.
Why it matters
Every step here ran on permissions the service principals already had. Listing storage keys, deleting resource locks and destroying production resources are separate rights, and a principal that holds all three at once is standing destructive privilege waiting for its secret to leak. The review to run is which of your service principals can both read secrets and delete locks, and why; almost none should need both, and lock deletion in particular belongs behind a human approval. See zero standing privileges and least privilege.
The initial access is the older lesson. A client secret is a password for a workload, and it ended up in a GitHub issue the way passwords end up in chat. Workload identity federation and managed identities remove the secret entirely, which removes this whole class of leak. The AI agent matters mainly for speed: seven minutes from start to finish means a response process measured in hours only ever gets to investigate. See secrets in repositories and CI and client credentials.
Source: BleepingComputer
Related on Start with Identity
- BlogAn encrypted web page tricked GitHub Copilot CLI into leaking a .env file
Adversa AI showed GitHub Copilot CLI in autopilot mode reading a local .env.prod file and sending its contents to an attacker URL after fetching a page with enc
- BlogLiteLLM traces its poisoned release to an admin key leaked in May and never revoked
LiteLLM's October 23 attack-chain report says an Agent Platform admin key committed to a public repo on May 27 was deleted but never revoked. On October 10 it r
- Blog26,400 working cloud and AI credentials found in public Gitee repositories
A researcher scanned 7.25 million public repositories on Gitee, China's largest Git platform, and found 26,400 unique credentials that still worked, led by Alib
- CVEOver-scoped CodeBuild GitHub token let an attacker ship code in Amazon Q Developer 1.84.0
An inappropriately scoped GitHub token in the CodeBuild configuration for the Amazon Q Developer VS Code extension let an attacker commit code that shipped auto
- CVETrivy release and GitHub Action tags hijacked to steal CI secrets
With credentials left valid by a non-atomic rotation, an attacker shipped a malicious Trivy v0.69.4 and repointed 76 of 77 trivy-action tags to code that dumped
- CVECommvault Web Server zero-day that exposed Metallic Microsoft 365 app secrets
An authenticated webshell flaw in Commvault Web Server, used as a zero-day in Commvault's Azure environment, where the actor may have reached client secrets cus