JadePuffer used Azure identities to wipe recovery paths
Microsoft says JadePuffer, also tracked as Storm-3168, turned an early-June Azure intrusion into an 18-hour destruction run by abusing two compromised service principals to map the tenant and target recovery controls.
The split identities mattered: one machine identity spent hours reading subscriptions, resource groups, virtual machines, and other resources, while the other carried out the deletion and credential-collection work. Because Azure treated both as approved applications, the attacker could act at machine speed and aim not just at live systems but at the backup and recovery controls meant to bring them back.
For Azure estates that rely on app registrations, service principals, or workload identities, the exposure now sits in the control plane as much as the data plane. Microsoft also ties the broader campaign to CVE-2025-3248 in Langflow, so the same actor still has a separate entry path where that app is in use.
CVSS 9.8 CRITICAL: langflow versions prior to 1.3.0 are susceptible to code injection in
the /api/v1/validate/code endpoint. EPSS 100% (100th percentile).
CISA federal remediation date May 26 · date passed
The JadePuffer ransomware operator is targeting Azure tenants with agent-driven attacks that conduct reconnaissance, steal credentials, and destroy core components.
Microsoft says Jadepuffer, an autonomous agentic AI attacker first reported in July, is now targeting Azure resources; exposed credentials may have provided a way in.
Microsoft details JADEPUFFER-linked Azure reconnaissance, resource deletion, and credential access using compromised service principals, identifying the activity as associated with Storm-3168 and providing guidance for defenders.