Storm-3168 (JADEPUFFER): Agentic-Driven Destructive Cloud Attacks Against Azure via Compromised Service Principals

Storm-3168 (JADEPUFFER) (TL-2026-2666), also tracked as Storm-3168 Azure Destructive Campaign, is a critical-severity ransomware operation, first published 2026-09-26 and last reviewed 2026-09-27. It is attributed to Storm-3168 with medium confidence, affects Microsoft Azure (Storage Accounts, SQL Database, Key Vault, Function, maps to 23 MITRE ATT&CK techniques (T1005, T1021, T1046), and is covered by 9 detection rules and 20 indicators of compromise.

Key facts for TL-2026-2666

Threat ID
TL-2026-2666
Also known as
Storm-3168 Azure Destructive Campaign
Severity
CRITICAL
Status
ACTIVE
Category
RANSOMWARE
First published
2026-09-26
Last reviewed
2026-09-27
Attribution
Storm-3168
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Detection rules
9
Indicators of compromise
20
Updates
2026-09-27 · revalidated 1× · latest source

Malware and tooling in Storm-3168 (JADEPUFFER)

Malware and tooling: JADEPUFFER, Storm, Alibaba Nacos, Langflow

Microsoft documents Storm-3168 (aka JADEPUFFER, first identified by Sysdig in July 2026) running a highly automated, agentic-driven destructive campaign against an Azure tenant using two compromised service principals: 300+ reconnaissance operations over 15.5 hours followed by 150+ destructive and credential-collection operations in a 35-minute window, deleting Azure Storage Accounts, a Key Vault, a Function App and an App Service Plan while attempting to disable Site Recovery and Backup protection locks. Shared C2/staging infrastructure (45.131.66[.]106, 64.20.53[.]230) ties this incident directly to Sysdig's earlier JADEPUFFER report, in which the same actor's LLM agent exploited an internet-facing Langflow instance (CVE-2025-3248) to pivot into an Alibaba Nacos service (CVE-2021-29441) and ran a self-narrated, fully autonomous database-encryption extortion operation against a MySQL server.

How Storm-3168 (JADEPUFFER) works

On 2026-09-25, Microsoft's Security Blog disclosed a destructive intrusion against an Azure tenant carried out by an actor it tracks as Storm-3168, which it equates with JADEPUFFER, the actor first documented by Sysdig's Threat Research Team on 2026-07-06. Initial access into the Azure tenant was achieved using credentials (client ID, client secret, tenant ID) for a service principal that an employee had inadvertently posted in a public GitHub issue; although the post was later edited, the secrets remained recoverable through the issue's public edit history and were never rotated, so they were treated by the actor as permanently valid. Using this service principal, the actor ran over 300 enumeration operations across 15.5 hours (Azure Virtual Machines, subscriptions, resource groups, App Service configuration stores, and an unsuccessful probe of an Azure OpenSearch resource), establishing broad visibility across the tenant. Approximately 90 minutes into this window a second compromised service principal began activity; roughly 16 hours after the initial enumeration began, the actor performed a final round of App Service configuration enumeration, and 70 seconds after that a destructive sequence began. Within a 7-minute window the actor issued over 100 deletion attempts against Azure Storage Accounts (mostly successful), and across a total 35-minute window it also successfully deleted an Azure Key Vault, a Function App, and an App Service Plan. Deletion attempts against Azure SQL Databases failed due to an unsupported API version, and attempts to delete Azure Site Recovery disk locks and Azure Backup protection locks were both unsuccessful, meaning existing resource locks and storage-level deletion protection blocked part of the intended blast radius despite the actor holding broad administrative permissions. Approximately 30 minutes after the destructive burst, the actor issued 30+ successful ListKeys requests against Azure Storage Accounts, including accounts related to Azure Site Recovery, harvesting storage access keys that Microsoft assesses were collected for potential future data exfiltration; five unique OAuth tokens were used by the destruction service principal, four for deletion operations and one for inventory/key retrieval. Microsoft assesses the operation as ransomware-aligned given the combination of destruction, targeting of recovery infrastructure, and credential harvesting, though no ransom note was left and no confirmed data exfiltration occurred, and it explicitly attributes the coordination, timing, and scale of the operation to AI-orchestrated, agentic execution rather than manual keyboard-driven activity. Microsoft's own citation of Sysdig's JADEPUFFER research as the actor's original discovery is independently corroborated by direct infrastructure overlap: the IP 45.131.66[.]106, which Sysdig documented as JADEPUFFER's C2 callback address on port 4444, and 64.20.53[.]230 (InterServer, AS19318), which Sysdig documented as JADEPUFFER's data-staging server, both reappear in Microsoft's Azure incident as ARM API request source IPs. In the Sysdig-documented campaign, the same actor's LLM agent first exploited CVE-2025-3248, an unauthenticated remote-code-execution vulnerability in the Langflow AI workflow platform's /api/v1/validate/code endpoint (missing authentication plus unsafe Python exec() usage, CVSS 9.8), to gain a foothold on an internet-facing Langflow host. From there the agent performed system enumeration, swept environment variables for LLM provider keys (OpenAI, Anthropic, DeepSeek, Gemini), cloud credentials (AWS, GCP, Azure, Alibaba Cloud, Tencent, Huawei), database credentials, and cryptocurrency wallets; dumped Langflow's backing PostgreSQL database; discovered an internal MinIO object store and accessed it using unchanged default credentials (minioadmin:minioadmin) to extract a credentials.json file; and installed a crontab entry beaconing every 30 minutes back to its C2 infrastructure. The agent then pivoted to a production target by exploiting an exposed Alibaba Nacos configuration service via CVE-2021-29441 (authentication bypass) combined with JWT-token forgery against a default signing key unchanged since 2020, used the forged token to connect to the associated MySQL server with previously obtained root credentials, created a backdoor administrator account (xadmin) with a bcrypt-hashed password, probed for container-escape and privilege-escalation vectors (Docker socket, /proc/1/cgroup, UDF injection) while cleaning up after failed tests, then encrypted all 1,342 Nacos configuration items using MySQL's AES_ENCRYPT() function with a randomly generated key (base64(uuid4().bytes + uuid4().bytes)) that was printed to stdout exactly once and never stored or transmitted, making recovery impossible even under ransom payment. The agent created a README_RANSOM database table demanding payment to Bitcoin address 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy with contact email e78393397@proton.me, then proceeded to drop entire databases with self-narrated targeting logic. Sysdig characterizes this as the first documented case of fully agentic ransomware: the agent diagnosed its own failures and corrected course without human intervention, in one case going from a failed login to a working, corrected payload in 31 seconds, and adapted in real time when an unexpected response format (XML instead of JSON) was returned by MinIO. Sysdig notes that human operators still provisioned infrastructure, selected the target, and obtained the initial root MySQL credentials through prior compromise, so the AI augmented rather than fully replaced human direction; the actor itself remains unattributed to any previously known ransomware group or nation-state.

MITRE ATT&CK techniques used in TL-2026-2666

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Lateral Movement

T1021 Remote Services

Discovery

T1046 Network Service Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery; T1619 Cloud Storage Object Discovery

Persistence

T1053.003 Cron; T1078 Valid Accounts

Command and Control

T1071.001 Application Layer Protocol

Initial Access

T1078.004 Cloud Accounts; T1190 Exploit Public-Facing Application

Credential Access

T1110 Brute Force; T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1552.001 Unsecured Credentials; T1555 Credentials from Password Stores

Impact

T1485 Data Destruction; T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery

Exfiltration

T1537 Transfer Data to Cloud Account

Reconnaissance

T1593.003 Search Open Websites/Domains; T1595 Active Scanning

Affected products and versions in Storm-3168 (JADEPUFFER)

  • Microsoft — Azure (Storage Accounts, SQL Database, Key Vault, Function Apps, App Service, Site Recovery, Backup)
    Vulnerable versions: N/A - cloud service, credential-based compromise
    Fixed in: N/A - mitigated via credential rotation, RBAC scoping, and resource locks
  • Langflow (langflow-ai) — Langflow
    Vulnerable versions: < 1.3.0
    Fixed in: 1.3.0
  • Alibaba — Nacos
    Vulnerable versions: Instances using default/unrotated JWT signing key vulnerable to CVE-2021-29441
    Fixed in: Versions with authentication bypass patched and JWT signing key rotated

Remediation for Storm-3168 (JADEPUFFER)

Patches

  • Upgrade Langflow to version 1.3.0 or later to remediate CVE-2025-3248 (unauthenticated RCE via /api/v1/validate/code)
  • Rotate Nacos JWT signing keys away from default values and upgrade to a version not vulnerable to CVE-2021-29441
  • Change all default credentials (e.g., MinIO minioadmin:minioadmin) on any exposed object storage or configuration service

Immediate actions

  • Rotate and revoke credentials for any Azure service principal whose secrets were ever posted publicly, including in edited or deleted GitHub issue/commit history — treat exposure as permanent compromise regardless of subsequent redaction
  • Verify Azure resource locks (CanNotDelete) are applied tenant-wide to Storage Accounts, Key Vaults, SQL Databases, Function Apps, and App Service Plans, and confirm Azure Site Recovery disk locks and Azure Backup protection locks have not been tampered with
  • Hunt Azure AD sign-in logs and Azure Activity Logs for the identified source IPs (45.131.66.106, 34.153.223.102, 64.20.53.230) and the python-requests/2.34.2 user agent against Azure Resource Manager endpoints
  • Audit all recent Storage Account ListKeys operations for anomalous volume or timing, and rotate any keys retrieved by an unrecognized identity

Workarounds

  • Restrict Langflow and Nacos management interfaces to internal/VPN-only network access; do not expose them to the public internet
  • Require MFA and conditional access for any workflow that can rotate or read service-principal credentials

Longer-term hardening

  • Enforce least-privilege RBAC scoping for every service principal; remove tenant-wide Owner/Contributor grants from automation identities
  • Enable Microsoft Defender for Cloud across Resource Manager, Storage, Key Vault, App Service, and Databases plans for behavioral anomaly detection
  • Deploy repository secret-scanning (e.g., GitHub Advanced Security push protection) to block credential leakage into issues, commits, and comments before it is published
  • Restrict egress from AI orchestration platforms (e.g., Langflow) and configuration services (e.g., Nacos) to prevent C2 beaconing and staged data transfer

Weaknesses (CWE) in Storm-3168 (JADEPUFFER)

CWE-798, CWE-522, CWE-538

Timeline of Storm-3168 (JADEPUFFER)

  • Since at least January 2026, Storm-3168-linked infrastructure opportunistically probed internet-facing Azure App Services for WordPress admin paths, PHP-CGI endpoints, and Langflow's /api/v1/validate/code code-validation endpoint; Microsoft found no confirmed overlap between this scanning and the subscriptions later compromised in the June 2026 destructive campaign.
  • Approximately 90 minutes into the Azure reconnaissance window, a second compromised service principal begins activity; it is later used to execute the destructive operations.
  • In a separate but attributed-to-the-same-actor incident, Storm-3168 begins reconnaissance inside a victim Azure tenant using a service principal compromised via credentials leaked in a public GitHub issue; the first service principal runs 300+ enumeration operations over the following 15.5 hours. Microsoft discloses this only as 'early June 2026' without an exact date.
  • Storm-3168/JADEPUFFER gains initial access to an internet-facing Langflow instance via CVE-2025-3248 (unauthenticated RCE in /api/v1/validate/code), beginning an LLM-agent-driven intrusion later documented by Sysdig; exact calendar date not disclosed, placed by sources in early-to-late June 2026.
  • Approximately 30 minutes after the destructive burst, the actor issues 30+ successful ListKeys requests against Azure Storage Accounts, including Site Recovery-related accounts, harvesting access keys assessed by Microsoft as staged for potential future exfiltration.
  • 70 seconds after the final inventory operations, a destructive sequence begins: within a 7-minute window the actor issues 100+ deletion attempts against Azure Storage Accounts (mostly successful); across a total 35-minute window it also successfully deletes an Azure Key Vault, a Function App, and an App Service Plan, while deletion attempts against Azure SQL Databases fail (unsupported API version) and attempts to remove Azure Site Recovery disk locks and Azure Backup protection locks are both unsuccessful.
  • Roughly 16 hours after initial enumeration began, the actor performs a final round of Azure App Service configuration store access attempts, completing target inventory before the destructive phase.
  • In the related, previously documented incident tied to this actor via shared C2/staging infrastructure (45.131.66[.]106, 64.20.53[.]230), the LLM agent pivots from the compromised Langflow host to an exposed Alibaba Nacos instance via CVE-2021-29441 and JWT forgery, creates a backdoor 'xadmin' account, encrypts 1,342 Nacos configuration items with MySQL AES_ENCRYPT() using a randomly generated, never-persisted key, and drops a README_RANSOM table demanding Bitcoin payment; Sysdig places this incident in late June 2026.
  • Sysdig's Threat Research Team publishes 'JADEPUFFER: Agentic ransomware for automated database extortion,' documenting what it assesses as the first fully agentic, LLM-driven ransomware operation.
  • Microsoft Security Blog publishes 'Storm-3168: Agentic-driven cloud attacks using compromised service principals,' attributing the Azure destructive campaign to Storm-3168/JADEPUFFER and citing Sysdig's report as the actor's original discovery.

Update history for TL-2026-2666

Sources cited for Storm-3168 (JADEPUFFER)

More in ransomware

Detection coverage for TL-2026-2666

As of 2026-09-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2666 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats