Latest / The Digital Warfare Podcast / EP. 169: JadePuffer Uses AI Agents to Destroy Microsoft Azure Resources
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today, we're looking at an attack that demonstrates what happens when artificial intelligence moves beyond helping attackers write malware and starts helping coordinate the attack itself. The threat actor is known as Jadepuffer. Microsoft tracks it as Storm-3168, and researchers have now documented attacks against Microsoft Azure environments involving compromise service principles, automated reconnaissance, credential collection. And large-scale attempts to destroy cloud infrastructure. Here's what happened. Here's the attackers gained access to two Azure service principles belonging to the same tenant. Service principles are workload identities. They allow applications, automation tools, and hosted services to authenticate to Azure and perform whatever actions their assigned permissions allow. That makes them extremely useful and extremely dangerous when compromised. The first compromised identity was primarily used for reconnaissance. It mapped the Azure environment. It enumerated subscriptions, resource groups, storage infrastructure, and other available cloud resources. The second identity went further: it performed discovery, collected credentials, and launched destructive operations against the environment. The speed is important. Once the destructive phase began, researchers observed attempts against more than 100 Azure storage accounts. That destructive burst lasted approximately seven minutes, but storage was not the only target. The attackers also went after Azure key vaults, function apps, virtual machines, app services, SQL databases, and recovery protections. The attackers even attempted to remove Azure site recovery locks. Think about what that means. This wasn't simply an attempt to compromise production infrastructure. The attackers were also targeting mechanisms that could help the organization recover. Some of those operations failed. Attempts to delete Azure SQL databases failed because the attacker used an unsupported API version. Some storage resources also survived because resource locks and storage level protections prevented their deletion. That gives defenders an important lesson. Security controls that appear inconvenient during normal operations can become extremely valuable during an active compromise. But another part of this campaign deserves attention. Approximately 30 minutes after the destructive activity, the attacker returned and issued more than 30 requests for Azure storage account keys. Most of those requests succeeded. Those keys can provide access to storage resources independently of the identity originally used to obtain them. And there is another important detail Microsoft could not definitively determine the initial access vector. However, credentials associated with one compromise service principle had Previously appeared in a public GitHub issue. Deleting an exposed secret from a repository or issue does not make that credential safe again. If someone has already copied it, the secret remains compromised until it is revoked or rotated. So what should defenders do? First, audit workload identities. Review as your service principles and managed identities. Determine what they can access and whether those permissions are actually necessary. Second, apply least privilege. A compromise service principle should not automatically provide destructive access across an entire cloud environment. Third, protect recovery infrastructure, use resource locks and appropriate protections around critical storage, backups, and recovery services. Fourth, search public repositories for exposed credentials, and if you discover one, do not simply delete the text, rotate the secret immediately. Fifth, monitor unusual cloud management activity. Bulk enumeration, storage key requests, rapid deletion attempts, changes to recovery protections, and destructive actions across multiple Azure services should trigger investigation. The strategic lesson is bigger than Jade Puffer. Artificial intelligence can compress the attack timeline. Reconnaissance, credential discovery, and destructive operations that once required continuous manual interaction can increasingly be coordinated through autonomous tooling. But AI does not eliminate the attacker's need for permissions. The compromised identities still matter, the credentials still matter, and defensive controls still matter. The future of cloud security will not simply be about stopping malicious code, it will be about controlling what machines, identities, and autonomous agents are permitted to do. Because once an attacker controls a trusted cloud identity, automation can turn that access into destruction very quickly. This has been your digital warfare daily brief. Stay secure. We'll see you tomorrow.