JadePuffer crims hijacked Azure identities and used them to blow up cloud resources

{
  "signal_id": "d31b0786-d8f1-4bc7-07c6-416bf53cfb43",
  "signal_type": "news",
  "signal_subtype": "security_incident",
  "detected_at": "2026-09-28T20:30:00+00:00",
  "company": {
    "name": "Microsoft",
    "domain": "microsoft.com"
  },
  "data": {
    "url": "https://www.theregister.com/security/2026/09/28/jadepuffer-crims-hijacked-azure-identities-and-used-them-to-blow-up-cloud-resources/5299591",
    "title": "JadePuffer crims hijacked Azure identities and used them to blow up cloud resources",
    "excerpt": "security Smells like more agentic ransomware, Redmond warns The cyber criminal behind JadePuffer, the first known agentic ransomware infection reported over the summer, has also used stolen Azure identities to conduct destructive attacks on cloud storage and other resources, according to Microsoft. In July, Sysdig threat hunters uncovered JadePuffer , the first-ever documented agentic ransomware infection in which an LLM drove the entire extortion operation, from gaining initial access to compromising a production database server and destroying data. Now Redmond says that it has detected the same attacker, which it tracks as Storm-3168, up to new mischief. Over an 18-hour period in early June, Storm-3168 compromised two service principals and used these machine identities for “extensive Azure-focused resource destruction” and “cloud credential collection that could be used to facilitate future exfiltration,” researchers Yossi Weizman and Tushar Mudi wrote on Friday. The two compromised service principals belonged to the same cloud tenant. The crims used one of them to conduct reconnaissance and resource discovery, and the other to carry out destructive operations and credential collection. The Redmond researchers don’t know how Storm-3168 initially hijacked the service principals, but noted that an employee of the same organization previously exposed client IDs, client...",
    "summary": "Microsoft reported that the cybercriminal group Storm-3168 (also known as JadePuffer) hijacked two Azure service principals within a single customer's cloud tenant to destroy over 100 Azure Storage accounts and other cloud resources in a destructive attack.",
    "planning": false,
    "image_url": "https://image.theregister.com/5299599.jpg?imageId=5299599&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=1200&height=683",
    "confidence": 0.9,
    "published_at": "2026-09-28T20:30:00Z",
    "vulnerability": "Cybercriminal group Storm-3168 compromised two service principals and used them for extensive Azure-focused resource destruction, deleting over 100 Azure Storage accounts, an Azure Key Vault, a Function App, and an App service plan.",
    "article_sentence": "The cyber criminal behind JadePuffer, the first known agentic ransomware infection reported over the summer, has also used stolen Azure identities to conduct destructive attacks on cloud storage and other resources, according to Microsoft."
  }
}

curl https://signals.autobound.ai/v1/signals/d31b0786-d8f1-4bc7-07c6-416bf53cfb43 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"microsoft.com","limit":20}'