search
Storm-3168
Trends
- 1Storm-3168 Wiped Azure Resources Using Stolen Service Principals●🤖 Storm-3168/JADEPUFFER abused compromised Azure service principals to run destructive operations — deleting resources o
The threat actor tracked as Storm-3168, associated with the JADEPUFFER campaign, abused compromised Azure service principals to carry out destructive operations, deleting cloud resources over roughly 18 hours in early June 2026. Microsoft assesses the activity as an evolution of the actor's tradecraft, and security teams are being urged to review service principal permissions.