Storm-3168: Agentic-driven cloud attacks using compromised service principals

Storm-3168 (JADEPUFFER) leveraged compromised Azure service principals to conduct reconnaissance and destructive operations against storage accounts, databases, and virtual machines — demonstrating how over-privileged cloud identities become high-value attack vectors. The root cause lies in inadequate access control over non-human identities (service principals), which often accumulate excessive permissions and receive less scrutiny than user accounts. This attack marks a dangerous evolution: AI-orchestrated, agentic techniques allow threat actors to automate complex multi-stage cloud attacks at scale and speed that outpaces traditional human-driven defenses. The destructive nature of the campaign — not just data theft but resource obliteration — underscores the catastrophic business impact when cloud identity hygiene is neglected.