CTI · reviewed · 2026-09-27

Storm-3168: Agentic-driven cloud attacks using compromised service principals

Full story & timeline

Actors

Storm-3168JADEPUFFER

Malware / tools

—

Campaigns

—

CVEs

—

Victim sectors

technologyartificial intelligence

Geography

—

MITRE ATT&CK

T1078 Valid Accounts Stealth
T1552 Unsecured Credentials Credential Access
T1526 Cloud Service Discovery Discovery
T1651 Cloud Administration Command Execution
T1571 Non-Standard Port Command and Control
T1485 Data Destruction Impact

Indicators

Observables tied to this case, from the curated feed. raw sidecar

34.153.223.102 ipv4 · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Storm-3168 JADEPUFFER C2 Infrastructure Connections
id: bbeb094f-1063-4df1-b772-90392f336d85
status: experimental
description: Detects network connections to or from infrastructure reported as C2 for Storm-3168/JADEPUFFER agentic ransomware operations, namely a cron beacon host and the C2 servers documented by Sysdig and Microsoft alongside the compromised service principal activity.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/
  - https://www.sysdig.com/blog/jadepuffer-evolves-the-agentic-threat-actor-deploys-ransomware-built-to-destroy-ai-models
author: Tia N. List
date: 2026/09/27
tags:
  - attack.t1571
  - attack.t1078
  - attack.command-and-control
  - attack.stealth
logsource:
  category: network_connection
detection:
  selection_dst:
    dst_ip:
      - 45.131.66.106
      - 34.153.223.102
      - 64.20.53.230
  selection_src:
    src_ip:
      - 45.131.66.106
      - 34.153.223.102
      - 64.20.53.230
  condition: selection_dst or selection_src
falsepositives:
  - Connections to shared or reassigned hosting infrastructure
level: high