JadePuffer agentic AI attacks target Azure, destroy cloud resources

The JadePuffer ransomware operator conducts agent-driven attacks targeting Microsoft Azure tenants. These attacks automate reconnaissance, credential theft, lateral movement, and destruction of cloud resources, including storage accounts, Key Vaults, Function Apps, Virtual Machines, and App Services. The attacker used compromised service principals to access and delete resources, removing backup protections to hinder recovery. Attempts to delete Azure SQL databases failed due to unsupported API versions. The threat actor is tracked as Storm-3168. Microsoft recommends activating cloud workload protections, auditing for exposed credentials, and enforcing least-privilege permissions.

• bleepingcomputer.com/news/security/jadepuffer-agentic-ai-attacks-target-azure-destroy-cloud-resources/ (opens in a new tab)

• Key benefits of Zero Trust Network Access over corporate VPN access | Kaspersky official blogAnalysis2026-11-10
• 9th November · Threat Intelligence ReportAnalysis2026-11-09
• CVE-2026-100307: Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administratorHighVulnerability2026-11-11
• CVE-2026-125926: mcp-gateway-registry · Server-side request forgery in the server registration and update APIHighVulnerability2026-11-11
• The global socket: how threat actors are weaponizing GSocket for stealthy C2HighVulnerability2026-11-11