Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Storm-3168 Targets Azure Storage, Key Vaults and Backups in Destructive Cloud Attacks
Excerpt
In an incident observed in early June 2026, attackers used two compromised service principals application identities used to access cloud resources to map a victim’s environment, delete storage accounts and collect access keys. They also tried to remove protections tied to backup and recovery. Sysdig first reported JADEPUFFER in July 2026, describing a separate database-extortion attack that it assessed as the first documented agentic ransomware operation . Microsoft’s…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 45.131.66.106 | High | Score 75/100 | First seen |
| IP | 34.153.223.102 | High | Score 63/100 | First seen |
IOC Relationship Graph
Building graph…