JadePuffer attacks reportedly deleted most targeted Azure Storage accounts

Two compromised service principals reportedly used

According to the report, Microsoft tracked the actor as Storm-3168 and linked two compromised Azure service principals from the same tenant to the attacks. One principal was reportedly used for reconnaissance, while the other performed discovery, credential collection, and destructive operations. The actor reportedly targeted Azure Storage accounts, Key Vaults, Function Apps, Virtual Machines, and App Services.

Some storage accounts were not affected because of resource locks and storage-account protections. Attempts to delete Azure SQL databases and remove recovery-protection locks reportedly failed. Microsoft reportedly could not determine the initial-access method, though credentials for one service principal had appeared in a public GitHub issue before the attacks.

The report does not provide a comparable before-and-after baseline for Azure tenants or the affected resources.

The reported incidents add a detailed account of destructive Azure activity attributed to JadePuffer/Storm-3168: compromised service principals were reportedly used to discover resources, retrieve storage-account keys, and delete most targeted Azure Storage accounts.

Protected resources and failed deletion attempts

The account describes automated, agent-driven destructive actions across several Azure resource types, including reported efforts to weaken backup and recovery protections. It also documents limits on the operation: certain protections remained effective and some deletion attempts failed.