GoKawiilMicrosoft says AI-driven actor JadePuffer wiped Azure cloud resources in minutes
Microsoft Security Research reported that a threat actor it tracks as Storm-3168, also known as JadePuffer, compromised two legitimate Azure service principals belonging to one tenant and used them to map the victim's environment before launching an automated destruction campaign against storage, applications, databases and backup controls. The attack, which occurred in early June, involved one account spending over 15 hours on reconnaissance while a second executed rapid, wide-ranging discovery and destructive operations within seconds. Microsoft said the pattern matches ransomware or extortion tactics but noted it did not observe a ransom note or confirm data theft.
GoKawiil's interpretation of the reporting above, not reported fact.
Sysdig researchers had already flagged JadePuffer in July as the first documented case of an LLM-driven ransomware operation, suggesting attackers may increasingly use AI agents to automate reconnaissance and destruction at speeds humans cannot match. The speed and coordination described - full environment mapping followed by rapid resource wiping - could make traditional incident response windows far shorter than defenders currently plan for. Because no ransom note or exfiltration was confirmed, the true motive remains uncertain, leaving open whether this was extortion, sabotage, or an incomplete attack chain.
- Microsoft attributes a destructive Azure attack to Storm-3168/JadePuffer, an AI-driven threat actor
- Two compromised service principals split reconnaissance and destruction roles, with one mapping resources for over 15 hours before rapid automated wiping
- No ransom note or confirmed data exfiltration was observed, despite tactics resembling ransomware/extortion operations
Source: darkreading.com — Elizabeth Montalbano, 2026-09-28
Published there as: “JadePuffer AI Actor Compromises Azure Tenant in Destructive Cloud Attack”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.