Operators behind the JadePuffer ransomware campaign are conducting coordinated assaults on Azure infrastructure using AI-driven automation to execute the full spectrum of attack operations. The threat emerged publicly in July, when Sysdig researchers documented how the malware employs autonomous agents to chain together reconnaissance activities, credential exfiltration, lateral movement across systems, establishment of persistence mechanisms, and ultimately encryption of data.
The campaign subsequently evolved to target machine learning assets specifically. Sysdig noted that JadePuffer expanded its scope to include AI training datasets and vector databases, deploying a utility called EncForge as part of this expansion.
Microsoft Security Research documented two distinct JadePuffer incidents occurring in June. During these attacks, the threat actor enumerated cloud resources, obtained storage account credentials, and proceeded to delete Azure Storage accounts. The destructive phase compressed into a seven-minute window targeted over 100 storage accounts alongside Key Vaults, Function Apps, Virtual Machines, and App Services.
While the attacker successfully removed most targeted Azure Storage accounts, some resources remained intact due to Azure resource locks and protections configured at the storage account level. Microsoft designates this threat actor as Storm-3168 and determined that two compromised service principals—authentication identities permitting applications, hosted services, and automation tools to access Azure resources—drove the campaign. Both principals originated from a single tenant, with one focused on discovery operations and the other executing destructive actions and credential acquisition.
The attacker deliberately disabled backup and recovery safeguards by removing Azure Site Recovery locks, a tactic suggesting intent to obstruct restoration efforts. Although this operational approach aligns with ransomware extortion patterns, Microsoft did not identify ransom communications or confirm data exfiltration in the analyzed incidents.
Deletion attempts targeting Azure SQL databases failed because the attacker invoked an unsupported API version. Similarly, efforts to strip recovery protection locks proved unsuccessful. Microsoft observed that "the parallel targeting of Azure SQL databases and storage accounts suggests an effort to broaden the destructive impact across different data services rather than concentrating on a single resource type."
Approximately 30 minutes following the destruction attempts, Storm-3168 returned to issue more than 30 requests retrieving storage account keys, with the majority succeeding. Microsoft could not pinpoint the precise entry vector, though researchers noted that credentials belonging to one service principal had surfaced in a public GitHub issue prior to the attacks.
Recommended defenses
Microsoft guidance for system administrators includes:
- Enabling cloud workload protections
- Scanning public repositories for exposed secrets
- Auditing Azure RBAC permissions to enforce least-privilege access models