JadePuffer Uses Proxy Attacks to Destroy Azure Resources in Seven Minutes

Event Overview

In June 2026, the Microsoft security team published a detailed report on the official Microsoft Security Blog describing two separate Azure attacks that both involved the use of compromised service principal credentials. The attackers were identified internally by the codename JadePuffer, and the incidents were tracked under the internal reference Storm‑3168. These two incidents occurred in distinct Azure tenants, meaning that the malicious actors were able to obtain valid service principal tokens in more than one customer environment. After acquiring the credentials, the attackers acted as a proxy for the compromised identities, issuing a large volume of read, write, and destructive commands against the cloud resources that were accessible to those service principals. The report emphasizes that the proxy‑style operation allowed the threat actors to operate with the same permissions as the legitimate service principals, effectively bypassing many traditional perimeter defenses.

Attack Methodology and Timeline

In the first of the two incidents, the compromised service principal was used for an extended reconnaissance phase lasting roughly fifteen hours and thirty minutes. During that period, the attacker performed more than three hundred read operations, systematically enumerating storage accounts, key vaults, and other Azure resources to map the target environment. By contrast, the second incident was far more rapid. Within a window of only thirty‑five minutes, the threat actor launched over one hundred and fifty destructive or credential‑gathering actions. The core destructive sequence of that second incident lasted approximately seven minutes, during which the attacker attempted to delete more than one hundred storage accounts. This stark difference in timing illustrates both a prolonged information‑gathering phase and a short, high‑velocity destruction phase.

During the seven‑minute destruction window, the attacker first enumerated the target resources to identify which storage accounts and ancillary services were eligible for deletion. The malicious script then called the Azure Delete API repeatedly, attempting to remove each identified storage account as well as other associated services. Some of the targeted resources had been protected beforehand with Azure resource locks or delete protection settings, which successfully blocked the delete requests for those items. Nevertheless, a large number of delete attempts were still issued, demonstrating that the attacker’s automated script was capable of generating a high frequency of API calls in a very short period of time.

• 100+ storage account delete attempts
• 150+ destructive or credential‑gathering operations
• 300+ read reconnaissance requests (first incident)
• 30+ ListKeys calls (approximately 30 minutes after the initial activity)

Evidence and Sources

Microsoft classifies these activities under the Storm‑3168 threat label and notes that the attackers used the stolen service principal credentials to perform proxy‑style operations on behalf of the legitimate identities. An independent report from iThome also mentioned that some of the compromised service principal credentials had previously appeared in a public GitHub issue, although Microsoft has not confirmed that the exposed credential was the direct source of the intrusion. The correlation between the public exposure and the subsequent abuse remains unverified, but the observation underscores the risk of credential leakage in public repositories.

Throughout the investigation, Microsoft did not observe any ransom notes or explicit indications of data exfiltration. The only post‑attack activity documented was a burst of more than thirty ListKeys requests roughly thirty minutes after the initial destructive phase. These requests suggest that the attacker continued to seek additional key material, possibly to expand their foothold or to prepare for future operations, even though the primary deletion attempts had already been largely mitigated by existing protections.

Impact and Defense Effectiveness

Resource locks and delete protection mechanisms played a critical defensive role in this incident. By preventing the actual removal of most storage accounts, these controls limited the immediate impact of the attack. Additionally, attempts to delete Azure SQL resources failed because the API version used by the attacker was not supported for delete operations, further reducing the potential damage. These built‑in safeguards demonstrate how version‑specific API validation and resource‑level protection can act as effective barriers against rapid, automated destruction attempts.

Despite the partial success of the defensive measures, the attackers were still able to enumerate resources and retrieve key material, indicating that resource locks alone are insufficient to fully prevent proxy‑style compromises. Microsoft therefore advises affected tenants to immediately audit the usage of all service principal credentials, enforce conditional access policies, and apply the principle of least privilege to limit the permissions granted to each service principal. Such steps reduce the attack surface and make it harder for stolen credentials to be leveraged for large‑scale destructive actions.

Looking ahead, Microsoft plans to enhance Azure monitoring services with real‑time alerts for anomalous service principal behavior, providing quicker detection of suspicious activity. The company also intends to strengthen API version compatibility checks to block attempts that rely on outdated or unsupported API calls, thereby shrinking the attack surface that can be exploited through version mismatches. Enterprises are reminded to rotate service principal keys on a regular schedule and to extend delete protection policies to cover especially sensitive resources, ensuring that multiple layers of defense are in place to mitigate both current and future threats.