JADEPUFFER Attackers Delete Azure Resources via Compromised Service Principals

Microsoft has identified a new wave of activity from an attacker group known as JADEPUFFER, who used compromised service principals—automated accounts with broad permissions—to delete resources within its Microsoft Azure environment. The attack occurred in early June 2026 and spanned roughly 18 hours, during which attackers removed significant amounts of data and infrastructure components across multiple subscriptions. Microsoft is tracking the activity under the internal designation Storm‑3168, indicating it considers the operation part of a broader threat actor’s tradecraft.¹

Compromising service principals is a particularly insidious attack vector because these identities appear legitimate to standard security controls, bypassing many authentication checks that normally flag suspicious interactive logins. By leveraging them, attackers can move laterally inside trusted networks without raising immediate alarms. This technique echoes past supply‑chain compromises such as SolarWinds’ 2019/2020 breach, where adversaries maintained long‑term access for months before detection. Similar persistence mechanisms are likely at play here, suggesting an advanced persistent threat (APT) group capable of sophisticated operations and possibly insider knowledge or zero‑day exploits targeting specific cloud providers.

Experts note that this event highlights ongoing risks associated with privileged access in cloud environments. Even highly secure organizations struggle to protect automated accounts effectively; similar incidents surfaced in 2024 when LAPSID compromised SolarWinds and used stolen domain administrator passwords. The fact that Microsoft itself had to track the incident underscores how even major vendors can be targets of sophisticated attacks that exploit internal credentials. Experts advise continuous monitoring of service principal activity, enforcing least privilege principles, and implementing rapid response plans for anomalous deletions or modifications. They caution that while patching and procedural changes help, attackers will continue probing new vulnerabilities across platforms, so vigilance must remain a priority.

In practice, the deletion of Azure resources not only disrupts services but potentially erases customer data if backups were insufficient or misconfigured. Organizations should verify backup integrity, enforce role‑based access controls on service principals, and consider multi‑factor authentication where possible—even for automated identities—to mitigate such threats. Continuous threat intelligence sharing among cloud operators is essential to detect emerging patterns like JADEPUFFER’s tradecraft early next year.