A ransomware operation called JadePuffer is using AI agents to automate attacks on Microsoft Azure environments, compressing the destructive phase of an intrusion into about seven minutes, BleepingComputer reported Monday, citing research Microsoft published last week. Microsoft tracks the operator as Storm-3168.

What Happened

Microsoft said it observed two JadePuffer attacks in June. The ransomware operation itself emerged in July, according to BleepingComputer.

In each case the attacker worked through two compromised service principals, the non-human identities applications use to access Azure resources, both in the same tenant. One handled reconnaissance and discovery. The other carried out further discovery, the destructive operations and credential collection.

RelatedJPMorgan Bars Outside AI Agents From Customer Accounts as Dimon Warns of 'Rogue Agents'

The destructive stage targeted more than 100 storage accounts along with Key Vaults, Function Apps, virtual machines and App Services. Before deleting resources, the attacker removed Azure Site Recovery locks, a step Microsoft said pointed to an effort to make restoration harder. Microsoft also noted the parallel targeting of Azure SQL databases and storage accounts, which it read as an attempt to widen the damage.

About half an hour after the wipe attempts, Storm-3168 came back and made more than 30 requests for storage account keys, most of which succeeded.

Not everything worked. Attempts to delete Azure SQL databases failed because the attacker used an unsupported API version, and resource-level locks on some storage accounts stopped deletions.

How the Attacker Got In

Credentials for one of the service principals had been posted publicly in a GitHub issue before the attacks. Microsoft said it could not confirm definitively that this was the initial access route.

According to BleepingComputer, JadePuffer uses AI agents across the chain, from reconnaissance, credential theft and lateral movement to persistence and data encryption. The group has also turned its attention to AI assets, including training datasets and vector databases, using a tool called EncForge.

Why It Matters

The attacks never needed to compromise a virtual machine or plant malware on an endpoint. Everything happened through Azure's management interfaces using identities that already had broad permissions. For defenders, that shifts the priority from host monitoring to controlling what service principals are allowed to do and how their secrets are stored.

The seven-minute window is the other lesson. A human operator working through a list of storage accounts, vaults and function apps would take far longer, leaving more time for alerts to fire and responders to cut off access. Automation removes that margin, so preventive controls such as resource locks, which did block some deletions here, matter more than detection alone.

The failures also carry a warning. The Azure SQL deletions broke because of an unsupported API version, a mistake that would be simple to correct in a later attempt.

What to Watch

Microsoft recommends turning on cloud workload protection, scanning public code repositories for leaked secrets, and reviewing Azure role-based access control assignments against least-privilege principles. Organizations should audit which service principals can delete resources or list storage keys, rotate any credentials that may have appeared in public issues or commits, and apply delete locks to critical storage. Further reports will show whether JadePuffer extends the same approach to other cloud platforms.