Compromised service identities enable destructive Azure activity

Microsoft reported on 25 September destructive Azure activity associated with Storm-3168, which it links to the previously reported JADEPUFFER operation. The account describes compromised service principals used against storage, databases, key stores, applications and recovery-related controls. Researchers also identified credential collection.

The report notes that exposed credentials remain usable until revoked or rotated. Deleting the location where a secret appeared does not invalidate the credential already taken. The case therefore concerns workload identity and recovery permissions as much as a particular resource type. Microsoft’s analysis expands the publicly described activity around this cluster; its account of agentic tooling should be read with that investigation’s evidence and attribution boundaries.