Storm-3168: Agentic-driven cloud attacks using compromised service principals
Microsoft has linked a threat actor tracked as Storm-3168 to a series of Azure cloud attacks involving compromised service principals, including reconnaissance, credential theft, and resource deletion. The activity is also associated with a cluster Microsoft calls JADEPUFFER, and the company has published defensive guidance alongside its findings.
Why this matters: Service principals are the machine identities that automated systems use to access cloud resources. When attackers compromise one, they are not breaking down a front door — they are walking in with a badge that looks legitimate. Cloud environments often grant these identities broad access because they need it to function. That makes a single compromised principal a fast path to serious damage: deleted resources, stolen credentials, lateral movement. If you run anything on Azure, the question is not whether your human accounts are protected. It is whether your automated identities are treated with the same care.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.