Microsoft Links Storm-3168 to Agentic Azure Destruction Using Compromised Service Principals

Microsoft said it observed JADEPUFFER-linked cloud activity in which compromised Azure service principals were used to run reconnaissance, delete resources and collect credentials, expanding a previously reported agentic ransomware campaign into Azure infrastructure. The company tracks the actor as Storm-3168 and described the case as evidence that AI-orchestrated attacks can coordinate post-compromise cloud operations with unusual speed and scale.