Ethical Hacking News
A recent attack on Azure cloud resources, attributed to the JadePuffer crims, also tracked as Storm-3168, highlights the growing threat of agentic ransomware. The attack, which used compromised Azure identities to conduct extensive resource destruction and credential collection, underscores the need for organizations to prioritize security measures to protect their cloud infrastructure. This latest incident is a reminder that cloud security is a critical concern, and organizations must be proactive in implementing robust security controls to prevent such attacks.
The latest threat to cloud security is an agentic ransomware attack known as JadePuffer, which uses compromised Azure identities to carry out destructive operations on cloud resources. The attack, tracked as Storm-3168, uses LLM to drive the extortion operation and has been detected using stolen Azure identities to carry out extensive attacks. The attack involves the compromise of two service principals, which carried out reconnaissance, resource discovery, and destructive operations, collecting credentials for future exfiltration. The attack resulted in the successful discovery of Azure App Service configuration stores and attempted discovery of Azure OpenSearch resources. The attack included the deletion of numerous Azure resources, including Azure Storage accounts, Azure Key Vaults, and Function Apps. The attack also included the collection of storage account-level deletion permissions, which would have allowed the attacker to access sensitive data. The attack highlights the growing threat of agentic ransomware and the need for organizations to prioritize security measures to protect their cloud infrastructure.
The latest threat to cloud security, as disclosed by Microsoft, is an agentic ransomware attack known as JadePuffer. The attack, which is believed to be the work of a sophisticated threat actor, has used compromised Azure identities to carry out destructive operations on cloud resources. This latest development in the realm of cloud security highlights the growing threat of agentic ransomware and the need for organizations to prioritize security measures to protect their cloud infrastructure.
In July, Microsoft disclosed the existence of JadePuffer, the first-ever documented agentic ransomware infection, which used an LLM to drive the entire extortion operation. However, what is concerning is that the same attacker, now tracked as Storm-3168, has been detected using stolen Azure identities to carry out more extensive attacks. This latest incident, which took place in early June, involves the compromise of two service principals and the use of these machine identities to conduct extensive Azure-focused resource destruction and cloud credential collection.
The two compromised service principals, which belonged to the same cloud tenant, were used to conduct reconnaissance and resource discovery, with one principal carrying out destructive operations and the other collecting credentials for future exfiltration. The attack, which took approximately 18 hours to complete, involved the compromised service principal collecting detailed information about Azure Virtual Machines, subscriptions, resource groups, and resources, completing over 300 successful read operations.
The breadth of activity carried out by the compromised service principal would have given the threat actor visibility across the organization's Azure environment. This highlights the importance of implementing robust security measures to prevent such attacks. The attack also involved the successful discovery of Azure App Service configuration stores, which were likely being searched for exposed credentials, and the attempted discovery of Azure OpenSearch resources.
During the attack, the compromised service principal attempted more than 150 destructive or credential-stealing attempts in just 35 minutes, with the majority of these attempts being successful. The attack also involved the deletion of numerous Azure resources, including Azure Storage accounts, Azure Key Vaults, Function Apps, and App service plans, all of which belonged to the same resource group and likely supported the Function app.
The attack also involved the attempted deletion of multiple Azure SQL databases, with the service principal using an unsupported API version for the Azure SQL database resource type, resulting in all deletion attempts failing. The attack also included the collection of storage account-level deletion permissions, which would have allowed the attacker to access sensitive data.
The destructive activity, which lasted for approximately 7 minutes, was followed by a period of inventory requests for Azure Storage Accounts and the sending of more than 30 successful ListKeys requests, asking for ARM to return each storage account's access keys. This would have provided the attacker with the necessary credentials to access and exploit the compromised resources.
The attack, which was carried out by the same attacker that compromised the Azure identities in July, is believed to be an example of agentic ransomware. However, unlike traditional ransomware attacks, where a ransom note is typically sent, this attack did not result in the sending of a ransom note or the successful exfiltration of data. The attack's focus on resource destruction and credential collection suggests that the attacker's goal was to disrupt the organization's cloud infrastructure and access sensitive data.
The incident highlights the growing threat of agentic ransomware and the need for organizations to prioritize security measures to protect their cloud infrastructure. The attack also underscores the importance of implementing robust security controls, such as multi-factor authentication, and monitoring cloud activity to detect and prevent such attacks.
In conclusion, the JadePuffer crims, also tracked as Storm-3168, have demonstrated the capabilities of agentic ransomware in carrying out destructive attacks on cloud resources. The attack highlights the growing threat of agentic ransomware and the need for organizations to prioritize security measures to protect their cloud infrastructure. As the threat landscape continues to evolve, it is essential for organizations to stay vigilant and implement robust security controls to prevent such attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/JadePuffer-Crims-The-Agentic-Ransomware-Threat-to-Azure-Cloud-Resources-ehn.shtml
https://www.theregister.com/security/2026/09/28/jadepuffer-crims-hijacked-azure-identities-and-used-them-to-blow-up-cloud-resources/5299591
Published: Mon Sep 28 15:48:52 2026 by llama3.2 3B Q4_K_M
