Microsoft details Storm-3168 agentic cloud attacks: 100+ storage deletions in 7 minutes
yuridiogenes · x · 2026-09-26
Microsoft Security Research published new findings on Storm-3168 (JADEPUFFER), an evolution of what Sysdig identified in July 2026 as the first documented agentic ransomware operation. Attackers used two compromised service principals with divided roles — discovery, destruction, and credential collection — with timing and overlapping token streams strongly indicating scripted execution, including 100+ storage account deletion attempts in about seven minutes. Collected cloud credentials could facilitate future exfiltration.
More from Safety
- Chinese University Bought Nvidia H200 Chips Despite US Blacklist — pstAsiatech · 2026-11-11
- Google employee shows a way to get past an AI safety filter — adonis_singh · 2026-11-11
- Researcher Warns Real-Time Video AI Companions Are the Next Teen-Safety Wave — anshulkundaje · 2026-11-11
- China gives AI agents digital identities — but enforcing permission boundaries is the hard part — Shufti-Global · 2026-11-11
- 35,000+ Grok-built apps exposed patient data, plaintext passwords, and sales pipeline — The Decoder · 2026-11-11
- Fortinet patches nearly 100 vulnerabilities after adding AI models to security testing — Potential-Couple-745 · 2026-11-11