Azure Security Architect: 2026-09-25

1. Storm-3168: Agentic-driven cloud attacks using compromised service principals

   Microsoft Security, 2026-09-25. Read, 13 min.

   Microsoft reports that Storm-3168, its name for the actor Sysdig discovered as JADEPUFFER, used two compromised service principals in one Azure tenant for discovery and then attempted more than 150 destructive or credential collection operations in 35 minutes, deleting most of the targeted storage accounts along with a Key Vault, a Function App, and an App Service plan. Microsoft says it is unclear how the service principal was first compromised and that its secret had earlier been exposed in a public GitHub issue's edit history, though it could not confirm that secret was used.

   Why it matters for this role: Resource locks and deletion protection on recovery-critical storage held up here even though the identity had rights to delete, which makes them worth checking across your subscriptions.

Azure Security Architect