Storm-3168: Rapid Azure Resource Deletion Campaign Targeting Microsoft Azure Subscriptions
Threat actor JADEPUFFER (Storm-3168) conducted a highly automated, destructive campaign against Microsoft Azure tenants using compromised service principals. Initial access was achieved through service principal secrets exposed in public GitHub issue histories. Following a 15-hour reconnaissance phase involving ~300 read-only API calls, the actor executed a seven-minute burst of over 150 destructive operations. This included deleting >100 storage accounts, Azure Key Vaults, SQL databases, and removing Azure Site Recovery and backup protection locks. Post-destruction, the actor attempted credential harvesting via storageAccount/listKeys calls. The attack pattern—combining rapid resource destruction with recovery-impairment tactics—suggests an extortion-focused methodology designed to pressure victims through immediate operational paralysis.