Unnamed Impacted Tenant Ransomware: Storm-3168 Agentic-driven Cloud Attacks via Compromised Service Principals (June 2026)

Unnamed Impacted Tenant: What Happened

In early June 2026, the threat actor Storm-3168, associated with the JADEPUFFER group, executed a high-impact ransomware campaign against an unnamed impacted tenant’s Azure cloud environment. The adversary gained unauthorized access by leveraging compromised service principal credentials, enabling destructive operations and credential collection at scale. The attack resulted in the deletion of most targeted Azure Storage Accounts, Key Vaults, Function Apps, and App Service Plans, with attempted but unsuccessful deletions of Azure SQL databases due to recovery protection mechanisms. The incident demonstrates a sophisticated use of cloud-native identities to facilitate both resource destruction and persistent access.

Attack Vector & Technical Detail

Storm-3168’s initial access was achieved through the use of compromised service principal client IDs and secrets, which provided programmatic control over the tenant’s Azure environment. The actor’s activity was characterized by the python-requests/2.34.2 user agent, a notable behavioral indicator, and infrastructure previously linked to Storm-3168 operations. MITRE ATT&CK tactics observed include TA0007 (Discovery), TA0040 (Impact), TA0006 (Credential Access), and TA0009 (Collection). No CVEs were directly implicated in this incident; instead, the attack exploited the over-privileged and insufficiently monitored nature of service principals in cloud environments. The adversary’s automation enabled rapid enumeration and deletion of resources, as well as the collection of storage account access keys for further exploitation.

Confirmed Impact

The confirmed impact includes the successful deletion of the majority of targeted Azure Storage Accounts, Azure Key Vaults, Function Apps, and App Service Plans. Attempts to delete Azure SQL databases were mitigated by recovery protection locks, but the attacker’s credential collection efforts enabled persistent access to remaining resources. The global nature of Azure services means the blast radius of such attacks can be extensive, potentially affecting regulatory compliance and business continuity. The exfiltration of storage account access keys raises the risk of ongoing unauthorized access and data leakage beyond the initial destructive phase.

What This Means for Your Organization

This incident underscores the critical risk posed by compromised service principals in cloud environments. Organizations must treat service principals with the same security rigor as human identities, ensuring least-privilege access and continuous monitoring for anomalous activity. Automated credential rotation, robust logging, and the implementation of resource protection mechanisms such as recovery locks are essential. The use of behavioral indicators, such as unusual user agents or access patterns, should be integrated into detection strategies to identify and contain similar threats early.

Detection & Response

• Immediate: Audit all service principal permissions and rotate credentials for any accounts with elevated access, especially those exposed to external automation.
• Hunt: Search for authentication events using python-requests/2.34.2 user agent and activity tied to known Storm-3168 infrastructure or compromised client IDs and secrets.
• Patch: N/A (no CVE directly involved; focus on identity and access management controls).

Source: https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/