Attackers Leverage Compromised Azure Service Principals for Destructive Operations

The threat actor JADEPUFFER (tracked as Storm-3168) utilized compromised Service Principals within a Microsoft Azure environment to execute destructive operations and delete cloud resources over an 18-hour window. This campaign highlights a dangerous evolution in cloud-targeted attack tradecraft, necessitating strict monitoring and credential hygiene for privileged cloud identities.