JadePuffer Abuses Azure Identities, Destroys Cloud Assets, Flags Agentic Ransomware

En bref

• JadePuffer took over Azure identities and deleted cloud resources.
• Microsoft issued the warning on 28 September 2026; no CVE was assigned.
• Agentic ransomware—autonomous attack agents—was flagged as a rising concern.
• The number of affected organizations remains unknown.
• Defenders should prioritize identity hardening and immutable cloud backups.

On 28 September 2026, Microsoft disclosed that a threat group tracked as JadePuffer had taken over Azure identities and then deleted cloud resources. The actor seized control of identity accounts inside Microsoft's cloud platform. No CVE identifier accompanied the warning, so the activity does not map to a single patchable flaw. Victim count remains unknown.

Organizations running Azure workloads are most at risk. Because Azure identities often carry broad permissions across subscriptions, one hijacked account can enable destructive actions across an entire cloud estate. Microsoft is both the platform vendor and the source of the alert. The attack surface is the control plane—identity, roles, and automation—not endpoints.

The impact extends beyond a simple breach. Wiping cloud resources can disable services, erase data, and force expensive recovery. Microsoft also flagged agentic ransomware—malware that uses autonomous agents to accelerate attacks—as a related concern. Identity takeover plus resource destruction creates a high-impact scenario with little time to respond.

With no CVE, patching will not address this threat. Misconfigurations, stolen credentials, or over-privileged service principals are likely enablers. JadePuffer's tactics fit a broader trend of targeting cloud control planes for maximum disruption. Microsoft's warning indicates active monitoring.

Watch for unusual Azure activity such as mass deletions, new role assignments, or disabled logging. Expect more technical details from Microsoft. Verify that backups are isolated and restorable. Track whether agentic ransomware becomes a confirmed tool for JadePuffer.

À faire maintenant

1. Audit Azure/Entra ID sign-in logs and privileged role assignments for anomalies; revoke sessions and rotate credentials for any compromised accounts immediately.
2. Enforce phishing-resistant MFA and strict conditional access for all Azure administrative and service accounts.
3. Enable immutable, air-gapped backups for critical cloud resources and test restoration procedures at least quarterly.
4. Apply least privilege to service principals and managed identities; remove unused permissions and review automation accounts.
5. Configure Microsoft Defender for Cloud alerts for resource deletion, role changes, and identity anomalies; automate response where possible.
6. Conduct a tabletop exercise for agentic ransomware and update incident response playbooks to include cloud control plane compromise.
7. Monitor Azure activity logs for destructive verbs like delete or purge, and set up real-time notifications.

Source originale

The Register — Security