{
  "id": 10560641,
  "title": "JadePuffer crims hijacked Azure identities and used them to blow up cloud resources",
  "url": "https://urgent.news/2026/09/28/jadepuffer-crims-hijacked-azure-identities-and-used-them-to-blow-up",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-28T20:30:00.000Z",
  "source": {
    "name": "The Register",
    "slug": "the-register",
    "url": "https://www.theregister.com/security/2026/09/28/jadepuffer-crims-hijacked-azure-identities-and-used-them-to-blow-up-cloud-resources/5299591"
  },
  "original_language": "en",
  "account": "Microsoft has detected a malicious actor, Storm-3168, responsible for stolen Azure identities and destructive attacks on cloud resources. The threat actor, linked to the JadePuffer ransomware, conducted an 18-hour attack over early June, compromising two service principals for extensive Azure-focused resource destruction and credential collection. The compromised service principals were used for reconnaissance, resource discovery, and destructive operations, including the deletion of over 100 Azure Storage accounts and an Azure Key Vault. The attacker also attempted to delete Azure SQL databases, but failed due to unsupported API versions. Despite the extensive damage, no ransom note was sent, and no data exfiltration was confirmed.",
  "summary": "Smells like more agentic ransomware, Redmond warns",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register Science",
        "title": "JadePuffer crims hijacked Azure identities and used them to blow up cloud resources",
        "url": "https://urgent.news/2026/09/28/jadepuffer-crims-hijacked-azure-identities-and-used-them-to-blow-up-10565012",
        "published": "2026-09-28T20:30:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}