Storm-3168: stolen application credentials used to destroy Azure resources

What Microsoft has uncovered

Microsoft has published new details about Azure attacks linked to Storm-3168, a threat actor also associated with the name JADEPUFFER. The research extends what was previously known about the group, showing how it used compromised application identities to explore a business’s cloud environment, destroy resources and collect credentials.

The attackers used two service principals. These are identities that allow applications and automated processes to access cloud services without a person signing in each time. Like staff accounts, they have permissions; if their credentials are stolen, attackers can act within those permissions.

One compromised identity carried out more than 300 successful discovery operations over roughly 15 and a half hours. The other was involved in discovery, deletion and credential collection. During a destructive burst lasting around seven minutes, it attempted to delete more than 100 storage accounts. Most of those targeted were deleted.

What succeeded — and what did not

The attackers also deleted an Azure Key Vault, a Function App and an App Service plan: resources used to hold secrets and support applications. Attempts to delete SQL databases failed because the attackers used an unsupported version of the relevant interface.

Some storage accounts survived because resource locks or deletion protection blocked the attempts. Efforts to remove certain backup and recovery protection locks also failed. These results show the value of safeguards beyond an application identity’s access permissions.

Later, the compromised identity successfully requested storage account access keys more than 30 times. Those keys could enable access to data. However, Microsoft did not confirm that data was stolen and did not observe a ransom note. The activity was consistent with tactics that could support ransomware or extortion, rather than proof of a completed ransomware incident.

Why this matters to a smaller business

If your business relies on Azure-hosted applications or data, compromised application credentials could put availability and recovery at risk. The concern is not limited to someone reading files: sufficiently powerful permissions can allow an attacker to delete the resources your services depend on.

Microsoft found that one identity’s credentials had previously appeared in a public GitHub issue. The visible text was later edited, but the secret remained in the issue’s edit history. Microsoft could not establish whether this exposure caused the compromise. Nevertheless, deleting a published password or secret does not make it unusable.

The report also places the activity in the context of AI-orchestrated attacks. In this incident, the timing and overlapping operations strongly indicated automated or scripted execution. For business owners, the practical point is speed: damaging actions can happen much faster than a manual response.

What to ask your IT provider to do next

Review application identities and their permissions. Each should have only the access needed for its task. Check both directly assigned permissions and access inherited through groups, since both authorised operations in this incident.

Replace exposed credentials immediately. Treat anything published online as compromised, even if the original post has been removed. Revoke or rotate it, investigate its previous use and favour supported approaches that reduce reliance on long-lived secrets.

Protect recovery resources separately. Restrict access to backups and recovery infrastructure, assess deletion protections and monitor attempts to change or remove those safeguards.

Finally, review which Microsoft Defender for Cloud protections are appropriate for your Azure services, including storage, databases, application hosting and resource management. Ask your provider to explain what is covered, what alerts are monitored and how suspicious activity would be investigated.