Back to Feed
Nation-stateSep 28, 2026

JadePuffer agentic AI attacks target Azure, destroy cloud resources

JadePuffer ransomware operator targets Azure tenants with agentic AI attacks, destroying cloud resources.

The JadePuffer ransomware operator, tracked as Storm-3168 by Microsoft, is using AI agents to automate attacks against Azure tenants. These attacks involve reconnaissance, credential theft, and the destruction of cloud resources like storage accounts, Key Vaults, and virtual machines. While the attackers aim to make recovery difficult, some protections like Azure resource locks prevented complete data loss in observed incidents.

AI summary of the linked source. Not reviewed by an editor. How this works

Vendor Watch

Run Azure?

Get an email when a new story names Azure, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy

The lesson from this incident

Full lesson

The JadePuffer/Storm-3168 threat actor is leveraging agentic AI to automate the full attack lifecycle — from reconnaissance and credential theft to the deliberate destruction of Azure storage accounts, Key Vaults, and virtual machines — dramatically accelerating the speed and scale of cloud ransomware attacks. This matters because AI-driven automation removes the human bottleneck from attack execution, meaning defenders have far less time to detect and respond before critical resources are wiped. The fact that Azure resource locks prevented complete data loss in some incidents highlights how a single, often-overlooked configuration control can be the difference between recovery and catastrophic loss. Organizations that treat cloud security as a default-secure environment are especially vulnerable to these targeted, high-impact campaigns.

What helps against this

How we list vendors

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

  • mitre_attack — T1078.004
  • mitre_attack — T1531
  • mitre_attack — T1087.004
  • mitre_attack — T1557
  • mitre_attack — T1490

Entities

JadePuffer (threat_actor)Storm-3168 (threat_actor)Azure (product)EncForge (product)AI agents (technology)service principals (technology)