JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources

The threat actor JADEPUFFER, tracked by Microsoft as Storm-3168, conducted destructive operations within a Microsoft Azure environment using compromised service principals. The attack occurred in early June 2026 over approximately 18 hours. This activity represents an evolution in the threat actor's tradecraft, leveraging legitimate Azure service principals to carry out destructive actions. The compromise of service principals allowed the attackers to operate with elevated privileges within the Azure environment. The incident highlights risks associated with identity and access management in cloud environments, particularly the abuse of service principals for malicious purposes.