Loading story…
Microsoft attributed destructive Azure activity to JADEPUFFER, tracked as Storm-3168, after the actor used two compromised service principals within one tenant to conduct broad reconnaissance and delete Azure Storage accounts and associated application resources. The operation also attempted to delete SQL databases and recovery-protection controls, an attack pattern consistent with impairing an organization’s ability to recover from a ransomware event.
The actor successfully retrieved keys for more than 30 Azure Storage accounts, which could enable data access or exfiltration, though Microsoft observed neither confirmed data theft nor a ransom note. One compromised service principal’s client ID, secret, and tenant ID had been publicly exposed in a GitHub issue, but Microsoft could not verify that it enabled the intrusion. Microsoft assessed that parallel use of identities and tokens indicated automated or scripted execution, and urged organizations to rotate exposed credentials, enforce least privilege for workload identities, and protect backup and recovery resources.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
Sysdig discovered JADEPUFFER in July 2026 and described it as the first documented agentic ransomware operation.
About 30 minutes after the final destructive action, the compromised service principal made more than 30 successful ListKeys requests, including against Azure Site Recovery-related storage accounts. The retrieved keys could potentially enable access to or exfiltration of storage data.
During the destructive sequence, the actor attempted parallel deletion of Azure SQL databases and attempted to remove Azure Site Recovery and Azure Backup protection locks. The SQL deletion attempts failed because the actor used an unsupported API version, and the recovery-lock deletion attempts were unsuccessful.
Less than one second after a failed ListKey request against a nonexistent storage account, the second service principal began destructive activity. It attempted more than 100 Azure Storage account deletions, successfully deleting most targets, and also deleted an Azure Key Vault, Function App, and App Service plan; resource locks and deletion protection blocked some storage-account deletions.
About 90 minutes after the initial enumeration began, a second compromised service principal enumerated virtual machines and resource groups across two subscriptions in five seconds. Sixteen hours later, it enumerated App Service configuration stores and unsuccessfully searched for Azure OpenSearch resources.
In early June 2026, a compromised service principal performed more than 300 successful Azure read operations over about 15 hours and 30 minutes, enumerating virtual machines, subscriptions, resource groups, and other resources.
An employee of the affected organization exposed the client ID, client secret, and tenant ID for one compromised Azure service principal in plaintext in a public GitHub issue. The issue was later edited, but the secret remained available in its public edit history; Microsoft could not confirm that it was used for the intrusion.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reported that **Storm-2949** used social engineering and abuse of Microsoft **Self-Service Password Reset (SSPR)** to compromise multiple **Microsoft Entra ID** accounts, including accounts tied to IT staff and senior leadership, then expanded access across **Microsoft 365** and **Azure**. After the initial identity takeover, the actor conducted tenant discovery through the **Microsoft Graph API**, exfiltrated data from **OneDrive** and **SharePoint**, and sought persistence by re-registering MFA methods and attempting to abuse service principal credentials. The intrusion then moved deeper into Azure, where Storm-2949 relied on legitimate management-plane operations and privileged **Azure RBAC** roles to access **App Services**, **Key Vault**, **SQL databases**, **Storage accounts**, and **virtual machines**. Microsoft said the actor used publish profiles, Key Vault permission changes, SQL firewall rule modifications, storage key listing, **VMAccess**, and **Run Command** to harvest credentials, execute code, deploy **ScreenConnect** on VMs, weaken Microsoft Defender Antivirus, and exfiltrate large volumes of data while blending into normal administrative activity; the group also cleared event logs and deleted artifacts to hinder detection.
Jun 29, 2026
Microsoft said the China-aligned espionage group **Storm-0558** stole a Microsoft consumer signing key and used it to forge authentication tokens that granted unauthorized access to **Exchange Online** and **Outlook.com** mailboxes. The company said the activity began in May and affected email accounts at **25 organizations** as well as related consumer accounts, prompting mitigation and a broader investigation into how the actor obtained and abused the key to access cloud-hosted email. Subsequent analysis indicated the impact may have extended beyond email. Researchers reported the compromised key could potentially authenticate access to additional Microsoft services, including **Azure Active Directory**, **SharePoint**, **Teams**, and **OneDrive**, as well as some customer-managed applications relying on Microsoft authentication. SecurityScorecard later identified **10 IP addresses** in NetFlow data that may have served as attacker proxies linked to the campaign, and said the traffic suggested possible targeting of Microsoft and a Western European government ministry, although the full victim scope remained unconfirmed.
Aug 21, 2026
Embargo, also tracked as **Storm-0501** and G1053, is conducting double-extortion ransomware operations against organizations in technology, healthcare, manufacturing, and other sectors. The group steals data—frequently using Rclone to MEGA—before encrypting systems with ChaCha20 and Curve25519. Researchers assess it as a probable BlackCat/ALPHV successor or rebrand based on Rust-based tooling, leak-site similarities, timing, and reported cryptocurrency-wallet overlap, though direct organizational continuity remains unconfirmed. Its intrusion activity includes exploiting internet-facing vulnerabilities, purchasing or abusing credentials, compromising Active Directory, and using bring-your-own-vulnerable-driver techniques to terminate security products. Microsoft reported that Storm-0501 has expanded beyond on-premises encryption into cloud-focused extortion by pivoting from Active Directory into Microsoft Entra ID and Azure. In one enterprise intrusion, the actor abused an Entra Connect Sync server and an MFA-less synchronized Global Administrator account, established federation-based persistence with AADInternals, exposed Azure Storage, and exfiltrated data with AzCopy. The group then sought to destroy cloud storage and backups by removing locks and immutability controls; where deletion was prevented, it used customer-managed keys and encryption scopes to render blobs inaccessible and attempted to delete the associated keys. Embargo also uses MDeployer and MS4Killer for persistence and defense evasion, including Safe Mode services, scheduled tasks, registry changes, and the vulnerable `probmon.sys` driver before disabling recovery and encrypting victims’ files.
Sep 20, 2026