Storm-3168: cloud attacks detected via compromised service principals
Microsoft reports malicious activities linked to the Storm-3168 group, characterized by reconnaissance on Azure and resource deletion.
Microsoft has detailed a series of malicious activities linked to the group identified as Storm-3168, associated with JADEPUFFER.
The attacks, driven by actors, exploit compromised service principals to target cloud environments. Among the detected actions are reconnaissance on Azure, credential access, and resource deletion.
The company has provided specific guidance for defenders in order to counter these threats.