Cybercriminals use hijacked identities to destroy Azure cloud resources

Microsoft has identified a cybercriminal group, tracked as Storm-3168, conducting destructive operations within Azure environments. This actor, previously linked to the JadePuffer agentic ransomware infection discovered in July, targeted a single cloud tenant during an 18-hour window in early June. By hijacking two specific service principals, the attackers performed reconnaissance and gathered credentials while simultaneously deleting various cloud-based applications, databases, and storage resources.

This incident highlights the growing danger of agentic threats, where large language models may drive automated extortion and infiltration processes. Because the attackers utilized machine identities to facilitate both resource destruction and data exfiltration, the breach poses significant risks to organizational continuity. To mitigate such vulnerabilities, technical departments must prioritize auditing cloud costs, verifying identity safety, and establishing robust disaster recovery protocols to manage potential service outages.