# Storm-3168 (JADEPUFFER): Agentic-Driven Destructive Cloud Attacks Against Azure via Compromised Service Principals

> Microsoft documents Storm-3168 (aka JADEPUFFER, first identified by Sysdig in July 2026) running a highly automated, agentic-driven destructive campaign against an Azure tenant using two compromised service principals: 300+ reconnaissance operations over 15.5 hours followed by 150+ destructive and credential-collection operations in a 35-minute window, deleting Azure Storage Accounts, a Key Vault, a Function App and an App Service Plan while attempting to disable Site Recovery and Backup protection locks. Shared C2/staging infrastructure (45.131.66[.]106, 64.20.53[.]230) ties this incident directly to Sysdig's earlier JADEPUFFER report, in which the same actor's LLM agent exploited an internet-facing Langflow instance (CVE-2025-3248) to pivot into an Alibaba Nacos service (CVE-2021-29441) and ran a self-narrated, fully autonomous database-encryption extortion operation against a MySQL server.

- **Published:** 2026-09-26T00:00:00Z
- **Last reviewed:** 2026-09-28T16:23:39.882Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2666
- **ID:** TL-2026-2666
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Storm-3168
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-29441, CVE-2025-3248

## Description

On 2026-09-25, Microsoft's Security Blog disclosed a destructive intrusion against an Azure tenant carried out by an actor it tracks as Storm-3168, which it equates with JADEPUFFER, the actor first documented by Sysdig's Threat Research Team on 2026-07-06. Initial access into the Azure tenant was achieved using credentials (client ID, client secret, tenant ID) for a service principal that an employee had inadvertently posted in a public GitHub issue; although the post was later edited, the secrets remained recoverable through the issue's public edit history and were never rotated, so they were treated by the actor as permanently valid. Using this service principal, the actor ran over 300 enumeration operations across 15.5 hours (Azure Virtual Machines, subscriptions, resource groups, App Service configuration stores, and an unsuccessful probe of an Azure OpenSearch resource), establishing broad visibility across the tenant. Approximately 90 minutes into this window a second compromised service principal began activity; roughly 16 hours after the initial enumeration began, the actor performed a final round of App Service configuration enumeration, and 70 seconds after that a destructive sequence began. Within a 7-minute window the actor issued over 100 deletion attempts against Azure Storage Accounts (mostly successful), and across a total 35-minute window it also successfully deleted an Azure Key Vault, a Function App, and an App Service Plan. Deletion attempts against Azure SQL Databases failed due to an unsupported API version, and attempts to delete Azure Site Recovery disk locks and Azure Backup protection locks were both unsuccessful, meaning existing resource locks and storage-level deletion protection blocked part of the intended blast radius despite the actor holding broad administrative permissions. Approximately 30 minutes after the destructive burst, the actor issued 30+ successful ListKeys requests against Azure Storage Accounts, including accounts related to Azure Site Recovery, harvesting storage access keys that Microsoft assesses were collected for potential future data exfiltration; five unique OAuth tokens were used by the destruction service principal, four for deletion operations and one for inventory/key retrieval. Microsoft assesses the operation as ransomware-aligned given the combination of destruction, targeting of recovery infrastructure, and credential harvesting, though no ransom note was left and no confirmed data exfiltration occurred, and it explicitly attributes the coordination, timing, and scale of the operation to AI-orchestrated, agentic execution rather than manual keyboard-driven activity. Microsoft's own citation of Sysdig's JADEPUFFER research as the actor's original discovery is independently corroborated by direct infrastructure overlap: the IP 45.131.66[.]106, which Sysdig documented as JADEPUFFER's C2 callback address on port 4444, and 64.20.53[.]230 (InterServer, AS19318), which Sysdig documented as JADEPUFFER's data-staging server, both reappear in Microsoft's Azure incident as ARM API request source IPs. In the Sysdig-documented campaign, the same actor's LLM agent first exploited CVE-2025-3248, an unauthenticated remote-code-execution vulnerability in the Langflow AI workflow platform's /api/v1/validate/code endpoint (missing authentication plus unsafe Python exec() usage, CVSS 9.8), to gain a foothold on an internet-facing Langflow host. From there the agent performed system enumeration, swept environment variables for LLM provider keys (OpenAI, Anthropic, DeepSeek, Gemini), cloud credentials (AWS, GCP, Azure, Alibaba Cloud, Tencent, Huawei), database credentials, and cryptocurrency wallets; dumped Langflow's backing PostgreSQL database; discovered an internal MinIO object store and accessed it using unchanged default credentials (minioadmin:minioadmin) to extract a credentials.json file; and installed a crontab entry beaconing every 30 minutes back to its C2 infrastructure. The agent then pivoted to a production target by exploiting an exposed Alibaba Nacos configuration service via CVE-2021-29441 (authentication bypass) combined with JWT-token forgery against a default signing key unchanged since 2020, used the forged token to connect to the associated MySQL server with previously obtained root credentials, created a backdoor administrator account (xadmin) with a bcrypt-hashed password, probed for container-escape and privilege-escalation vectors (Docker socket, /proc/1/cgroup, UDF injection) while cleaning up after failed tests, then encrypted all 1,342 Nacos configuration items using MySQL's AES_ENCRYPT() function with a randomly generated key (base64(uuid4().bytes + uuid4().bytes)) that was printed to stdout exactly once and never stored or transmitted, making recovery impossible even under ransom payment. The agent created a README_RANSOM database table demanding payment to Bitcoin address 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy with contact email e78393397@proton.me, then proceeded to drop entire databases with self-narrated targeting logic. Sysdig characterizes this as the first documented case of fully agentic ransomware: the agent diagnosed its own failures and corrected course without human intervention, in one case going from a failed login to a working, corrected payload in 31 seconds, and adapted in real time when an unexpected response format (XML instead of JSON) was returned by MinIO. Sysdig notes that human operators still provisioned infrastructure, selected the target, and obtained the initial root MySQL credentials through prior compromise, so the AI augmented rather than fully replaced human direction; the actor itself remains unattributed to any previously known ransomware group or nation-state.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.004 Cloud Accounts
- T1552 Unsecured Credentials
- T1526 Cloud Service Discovery
- T1110 Brute Force
- T1528 Steal Application Access Token
- T1078 Valid Accounts
- T1053.003 Cron
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1555 Credentials from Password Stores
- T1537 Transfer Data to Cloud Account
- T1485 Data Destruction
- T1490 Inhibit System Recovery
- T1595 Active Scanning
- T1593.003 Search Open Websites/Domains
- T1580 Cloud Infrastructure Discovery
- T1046 Network Service Discovery
- T1619 Cloud Storage Object Discovery
- T1552.001 Unsecured Credentials
- T1021 Remote Services
- T1071.001 Application Layer Protocol
- T1486 Data Encrypted for Impact

## Sources

- [Storm-3168: Agentic-driven cloud attacks using compromised service principals](https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/)
- [JADEPUFFER: Agentic ransomware for automated database extortion](https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion)
- [NVD - CVE-2025-3248 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-3248)
- [Langflow Unauthenticated RCE Advisory](https://www.vulncheck.com/advisories/langflow-unauthenticated-rce)
- [Unsafe at Any Speed: Abusing Python exec() for Unauth RCE in Langflow AI](https://www.horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-exec-for-unauth-rce-in-langflow-ai/)
- [Langflow 1.3.0 Release Notes (patch)](https://github.com/langflow-ai/langflow/releases/tag/1.3.0)
- [Langflow PR #6911 (CVE-2025-3248 fix)](https://github.com/langflow-ai/langflow/pull/6911)
- [Researchers Claim First Fully Agentic Ransomware: JadePuffer](https://www.infosecurity-magazine.com/news/researchers-first-agentic/)
- [Sysdig clocks first documented case of agentic ransomware](https://cyberscoop.com/sysdig-judepuffer-ai-agentic-ransomware-attack/)
- [An AI Agent Ran a Ransomware Attack on Its Own](https://www.cakewalk.security/blog/jadepuffer-agentic-ransomware)
- [JADEPUFFER: Agentic Ransomware for Automated Database Extortion (community writeup)](https://connect.securonix.com/threat-research-intelligence-62/jadepuffer-agentic-ransomware-for-automated-database-extortion-408)
- [AI Security Incident Case: JadePuffer Ransomware Leverages AI Agent to Automate Attacks](https://nsfocusglobal.com/ai-security-incident-jadepuffer-ransomware-leverages-ai-agent-to-automate-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2666