Microsoft Tracks JADEPUFFER Azure Attack Using Compromised Service Principals

September 28, 2026 at 02:08 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Microsoft tracked a JADEPUFFER attack that used two compromised service principals to delete Azure resources in early June 2026. The destructive operations targeted storage accounts, SQL databases, key vaults, and virtual machines over about 18 hours. The attack marks an evolution in the threat actor's tradecraft, according to Microsoft.

Key Facts

Microsoft tracked the JADEPUFFER attack under the name Storm-3168 and observed it over about 18 hours in early June 2026.
The attackers used two compromised service principals from the same tenant: one for reconnaissance and one for destructive operations and credential collection.
The reconnaissance service principal performed over 300 read operations across Azure Virtual Machines, subscriptions, resource groups, and resources for nearly 16 hours.
The destructive service principal enumerated Azure App Service configuration stores after 16 hours, likely seeking exposed credentials.
JADEPUFFER was first documented by Sysdig as the first end-to-end ransomware operation driven by a large language model, exploiting CVE-2025-3248 in Langflow.

Attack Timeline

Microsoft observed the destructive operations in early June 2026 over a period of about 18 hours. The first compromised service principal conducted reconnaissance and resource discovery for close to 16 hours, performing over 300 read operations. Ninety minutes after the first principal began, the second compromised service principal enumerated virtual machines and resource groups across two subscriptions within five seconds. After 16 hours, the second service principal successfully enumerated Azure App Service configuration stores, likely to find exposed credentials.

Targeted Azure Resources

The destructive operations targeted Azure Storage Accounts, SQL databases, Key Vaults, Function Apps, recovery protection locks, Virtual Machines, and App Services. Microsoft researchers Yossi Weizman and Tushar Mudi, along with the Microsoft Security Research team, described the attack as facilitated by compromising service principals. The attackers used one service principal for reconnaissance and resource discovery, and the second for destructive operations and credential collection.

JADEPUFFER Background

Sysdig first documented JADEPUFFER as the first-ever ransomware operation run end-to-end with the help of a large language model. The agentic attack exploited a known security flaw in Langflow, CVE-2025-3248, to gain initial access. The same Langflow instance was later targeted a second time using a compiled Go-based ransomware strain codenamed ENCFORGE. ENCFORGE scans for nearly 180 file extensions spanning model checkpoints, vector databases, training datasets, and embedding indices, along with macOS-centric files.