Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Storm-3168: Agentic-driven cloud attacks using compromised service principals
Excerpt
In this article Attack overview Technical analysis Mitigation and protection guidance References Learn More Microsoft Security Research has identified malicious cloud activity associated with JADEPUFFER, a threat actor discovered by Sysdig in July 2026 and reported to be the first documented agentic ransomware operation. Our investigation found an extensive Azure-focused resource destruction activity using compromised service principals and cloud credential collection that…
Read the original report →Diamond Model
Adversary
Infrastructure(3)
Capability
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 45.131.66.106 | High | Score 75/100 | First seen |
| IP | 34.153.223.102 | High | Score 63/100 | First seen |
| IP | 64.20.53.230 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…