JADEPUFFER-Linked Attackers Deploy Compromised Service Principals to Delete Azure Resources

According to Microsoft, the JADEPUFFER threat actor (tracked internally as Storm-3168) conducted destructive operations in a Microsoft Azure environment in early June 2026. The attack lasted approximately 18 hours and involved the use of compromised service principals to execute destructive actions. Microsoft notes that this activity represents an evolution in the threat actor's tradecraft, shifting toward the abuse of cloud identity mechanisms such as service principals to gain elevated privileges and carry out resource deletion. The specific victim organization and the exact volume of deleted resources have not been disclosed. Microsoft attributed the operation to JADEPUFFER based on telemetry and pattern analysis, though details regarding the initial compromise of the service principals remain limited. The company has released guidance on mitigating the risk of similar identity-based attacks in cloud environments.