Storm-3168 Azure Attacks Target Service Principals

Introduction

Microsoft has published new research on Storm-3168, a threat actor linked to JADEPUFFER, showing how compromised service principals can be used to rapidly damage Azure environments. For IT and security teams, this is an important reminder that workload identities are now a high-value target and can enable large-scale destructive operations when overprivileged or exposed.

What Microsoft found

According to Microsoft Security Research, Storm-3168 used two compromised service principals in the same tenant to carry out Azure reconnaissance, resource destruction, and credential collection.

Key findings

• One service principal performed broad discovery of subscriptions, resource groups, virtual machines, and other resources.
• A second service principal carried out destructive activity and later collected storage account keys.
• The destructive sequence began shortly after reconnaissance and included more than 100 storage account deletion attempts.
• Attackers also deleted an Azure Key Vault, Function App, and App Service plan.
• Attempts to delete Azure SQL databases failed because the actor used an unsupported API version.
• The actor also targeted recovery-related protections, including Azure Site Recovery and backup locks.

Microsoft said the activity strongly suggests automated or scripted execution, with overlapping token use and tightly timed operations. This aligns with a broader trend toward AI-orchestrated or agentic cloud attacks.

Why this matters for administrators

The most important lesson is that exposed credentials remain dangerous until they are revoked or rotated. In this case, Microsoft noted that a client ID, client secret, and tenant ID had previously been exposed in a public GitHub issue. Even if the secret is later removed from view, public edit history can still preserve it.

This incident also shows how existing Azure role assignments can be abused if a service principal is compromised. If the identity has contributor-level access, an attacker may be able to delete business-critical resources, collect storage keys, and interfere with recovery operations.

Recommended next steps

Admins should review Microsoft’s mitigation guidance and prioritize these actions:

• Audit service principals and other workload identities for excessive permissions.
• Rotate or revoke any secrets that may have been exposed publicly.
• Enforce least privilege for app registrations and service principals.
• Protect backup, recovery, and lock configurations with independent safeguards.
• Enable Microsoft Defender for Cloud protections and alerts for suspicious identity and resource activity.
• Monitor for unusual ARM operations such as bulk enumeration, ListKeys requests, and rapid deletion attempts.

Bottom line

Storm-3168 demonstrates how quickly attackers can move from cloud discovery to destructive impact when service principals are compromised. Organizations using Azure should treat workload identity security, secret hygiene, and recovery protection as core parts of their cloud defense strategy.