JadePuffer is a ransomware operator leveraging AI-driven agents to automate attacks against Azure cloud environments. The attacks involve reconnaissance, credential theft, lateral movement, persistence, and destructive operations targeting core Azure resources such as storage accounts, Key Vaults, Function Apps, VMs, and App Services. Microsoft observed that the attacker used two compromised service principals within the same tenant to perform discovery and destructive actions. The attacker removed Azure Site Recovery locks to prevent restoration. Attempts to delete Azure SQL databases and remove recovery locks failed due to unsupported API usage. Credential exposure on a public GitHub issue likely facilitated initial access. The attacker’s operational pattern suggests potential ransomware extortion, though no financial demands or confirmed data theft were reported. Microsoft recommends cloud workload protection, secret scanning, and least-privilege RBAC enforcement.

The attacks resulted in the deletion of over 100 Azure Storage accounts and destruction of other critical cloud resources, causing significant data loss and service disruption. Backup and recovery protections were disabled, complicating restoration efforts. Although attempts to delete Azure SQL databases failed, the broad targeting of multiple resource types indicates a wide destructive impact. Credential theft and lateral movement within the tenant increased the attacker's control and persistence. No confirmed data theft or ransom demands were reported in the observed incidents.

Microsoft recommends activating cloud workload protections to detect and prevent such attacks. Administrators should audit for exposed credentials, especially in public repositories, and remove any found secrets. Azure Role-Based Access Control (RBAC) permissions should be reviewed and adjusted to follow least-privilege principles to limit the impact of compromised identities. Resource locks and backup protections should be enabled and monitored to prevent unauthorized deletion. Since this is a cloud-hosted service, Microsoft manages platform-level security, but tenant-level security hygiene is critical.