Arquitecto de Seguridad de Azure: 2026-09-25

1. Storm-3168: Agentic-driven cloud attacks using compromised service principals

   Microsoft Security, 2026-09-25. Leer, 13 min.

   Microsoft reports that Storm-3168, its name for the actor Sysdig discovered as JADEPUFFER, used two compromised service principals in one Azure tenant for discovery and then attempted more than 150 destructive or credential collection operations in 35 minutes, deleting most of the targeted storage accounts along with a Key Vault, a Function App, and an App Service plan. Microsoft says it is unclear how the service principal was first compromised and that its secret had earlier been exposed in a public GitHub issue's edit history, though it could not confirm that secret was used.

   Por qué importa para este rol: Resource locks and deletion protection on recovery-critical storage held up here even though the identity had rights to delete, which makes them worth checking across your subscriptions.

Arquitecto de Seguridad de Azure