Storm-3168 Cloud Attack Campaign

Microsoft researchers have identified a sophisticated cloud-focused campaign orchestrated by the threat actor Storm-3168, also known as JADEPUFFER. This activity represents an evolution in cloud-native threats, characterized by the use of agentic-driven automation to perform high-speed reconnaissance, resource destruction, and credential harvesting within Azure environments. By leveraging compromised service principals, the actor executes multi-threaded API operations to delete storage accounts, databases, and key vaults. The actor exhibits a deep understanding of cloud infrastructure, evidenced by the use of distinct service principals for specific tasks, such as reconnaissance versus destructive operations. This coordinated effort allows for rapid, large-scale impact on cloud resources, often bypassing traditional manual intervention speeds. Defenders should prioritize auditing workload identities, as the actor specifically targets service principals exposed in public repositories.

Attack Chain

1. Initial access is gained through compromised service principal credentials, often harvested from public version control systems like GitHub issue histories.
2. The actor deploys automated scripts using the 'python-requests/2.34.2' user-agent to interact with the Azure Resource Manager (ARM) API.
3. Reconnaissance is conducted using one service principal to enumerate virtual machines, resource groups, and subscriptions for over 15 hours.
4. A second service principal performs rapid discovery of configuration stores and storage accounts to identify high-value targets.
5. The actor executes a highly coordinated, 7-minute destructive sequence, initiating over 100 parallel requests to delete Azure Storage accounts, Key Vaults, and Function Apps.
6. Simultaneously, the actor attempts to delete SQL databases and backup protection locks to disable recovery capabilities.
7. Final credential exfiltration is performed by issuing 'ListKeys' requests against surviving storage accounts to harvest access keys.

Impact

Successful attacks result in the bulk deletion of business-critical cloud infrastructure, including Azure Storage Accounts, Key Vaults, and Function Apps. The harvesting of access keys provides persistent, unauthorized access to data stored within those accounts, even after the initial compromise is identified. This activity threatens business continuity and data confidentiality, particularly for organizations with improperly secured workload identities.

Recommendation

• Immediately audit Azure AD and GitHub for exposed Service Principal secrets; rotate any found in public history.
• Implement and enforce Azure resource locks and storage account-level deletion protections to mitigate the impact of rogue API calls.
• Use Microsoft Defender for Cloud to monitor for unusual API activity associated with workload identities.
• Enforce the principle of least privilege for all Service Principals to ensure they cannot perform destructive operations outside of their required scope.
• Deploy detections for unusual User-Agent strings (e.g., 'python-requests/2.34.2') originating from non-authorized infrastructure.