Storm-3168: Agentic-driven cloud attacks using compromised service principals

In this article Attack overview Technical analysis Mitigation and protection guidance References Learn More Microsoft Security Research has identified malicious cloud activity associated with JADEPUFFER, a threat actor discovered by Sysdig in July 2026 and reported to be the first documented agentic ransomware operation. Our investigation found an extensive Azure-focused resource destruction activity using compromised service principals and cloud credential collection that could be used to facil