Storm-3168: Rapid Azure Resource Deletion Campaign Targeting Microsoft Azure Subscriptions

Threat actor JADEPUFFER (Storm-3168) conducted a highly automated, destructive campaign against Microsoft Azure tenants using compromised service principals. Initial access was achieved through service principal secrets exposed in public GitHub issue histories. Following a 15-hour reconnaissance phase involving ~300 read-only API calls, the actor executed a seven-minute burst of over 150 destructive operations. This included deleting >100 storage accounts, Azure Key Vaults, SQL databases, and removing Azure Site Recovery and backup protection locks. Post-destruction, the actor attempted credential harvesting via storageAccount/listKeys calls. The attack pattern—combining rapid resource destruction with recovery-impairment tactics—suggests an extortion-focused methodology designed to pressure victims through immediate operational paralysis.

• Attack Vector & Initial Access
• Exploitation of compromised Azure service principals via leaked client secrets.
• Credentials were recovered from plaintext entries within public GitHub issue edit histories.

• Attackers leveraged valid identities (T1078) to bypass traditional perimeter defenses and perform discovery.

• Reconnaissance & Automated Discovery

• First principal performed ~15 hours of stealthy reconnaissance via ~300 successful GET requests.
• Enumerated subscriptions, resource groups, virtual machines, and other critical Azure assets.

• A second principal performed rapid, multi-subscription discovery within seconds, indicating high automation.

• Destructive Payload & Impact

• Executed a seven-minute burst of >150 destructive actions (T1485).
• Deleted >100 storage accounts, Key Vaults, Function Apps, App Service plans, and SQL databases.

• Systematically removed Azure Site Recovery and backup protection locks to prevent rapid resource restoration.

• Post-Exploitation & Credential Harvesting

• Performed >30 storageAccount/listKeys calls approximately 30 minutes after the destruction wave.
• Targeted storage account access keys to facilitate potential data exfiltration or secondary extortion.

• The sequence—reconnaissance, destruction, and subsequent harvesting—aligns with advanced extortion-driven tactics.

• Detection & Mitigation Strategies

• Implement real-time Azure Activity Log alerts for bulk DELETE and listKeys operations.
• Enforce least-privilege principles for service principals and mandate frequent secret rotation.
• Utilize Azure Policy to enforce immutable backup storage and prevent deletion of critical resource locks.
• Conduct periodic credential exposure scans to identify secrets leaked in public repositories or version histories.