Storm-3168 Abuses Compromised Azure Service Principals to Destroy Cloud Resources

Severity

Medium

Microsoft has identified a destructive Azure campaign linked to Storm-3168, also known as JADEPUFFER, in which attackers abused compromised service principals to conduct cloud reconnaissance, delete Azure resources, target backup and recovery protections, and collect storage credentials.

The activity involved two compromised service principals belonging to the same Azure tenant. One identity spent approximately 15 hours and 30 minutes mapping the victim’s cloud environment through more than 300 successful read operations, while the second performed rapid discovery before shifting to destructive activity.

How?

The attackers used the compromised service principals to enumerate virtual machines, subscriptions, resource groups, and other Azure resources. The second identity also inspected Azure App Service configuration stores, potentially searching for exposed application credentials or secrets. Both identities communicated with infrastructure associated with Storm-3168 and used the python-requests/2.34.2 user agent.

The activity then shifted from reconnaissance to destruction. Less than one second after an unsuccessful ListKeys request against a non-existent storage account, the second service principal began a destructive sequence lasting approximately seven minutes.

During a 35-minute period, the compromised identity attempted more than 150 destructive or credential-collection operations, including over 100 attempts to delete Azure Storage accounts. Most of the targeted storage accounts were successfully deleted.

The attackers also deleted an Azure Key Vault, Function App, and App Service plan within the same resource group. They attempted to delete multiple Azure SQL databases as well, although those operations failed because the attacker used an unsupported API version for the Azure SQL resource type.

The attackers also attempted to remove Azure Site Recovery locks and Azure Backup protection locks, suggesting an effort to weaken recovery mechanisms and make restoration more difficult.

Some deletion attempts were blocked by existing Azure resource locks and storage-account deletion protection, showing that independent recovery safeguards can remain effective even when a compromised identity has broad permissions.

Approximately 30 minutes after the destructive activity ended, the compromised service principal began collecting storage-account information and successfully issued more than 30 ListKeys requests. Some of the targeted storage accounts were associated with Azure Site Recovery, potentially providing access to sensitive cloud data.

The initial compromise method remains unconfirmed. However, Microsoft found that the affected tenant’s tenant ID, client ID, and client secret had previously been exposed in plaintext in a public GitHub issue. Although the issue was later edited to remove the secret, the credential remained accessible through the public edit history.

The timing and coordination of the activity indicate a high degree of automation. Multiple tokens associated with the compromised service principal operated simultaneously, allowing the attackers to target different Azure resource types in parallel.

The combination of large-scale resource deletion, attempts to disable recovery protections, and collection of storage credentials is consistent with activity that could support ransomware or extortion operations. Microsoft did not observe a ransom note or confirm successful data exfiltration in this incident.

Conclusion

The activity shows how compromised Azure service principals can be abused to conduct extensive cloud reconnaissance and destructive operations at high speed. Storm-3168 used legitimate Azure permissions to delete storage and other resources, target backup protections, and collect storage credentials.

The initial compromise method remains unknown, although Microsoft identified previously exposed service principal credentials in a public GitHub issue. The incident highlights the risk of exposed cloud credentials and overly permissive workload identities, particularly when they can be used to perform destructive actions across multiple Azure resources.

Source

https://gbhackers.com/storm-3168-hackers-abuse-compromised-service-principals/