Microsoft Threat Intelligence has detailed an AI-driven ransomware attack that wiped more than 100 Azure storage accounts in about seven minutes. The group is tracked as JadePuffer, also known as Storm-3168.

The attack used two compromised Azure service principals. One identity spent 15.5 hours running over 300 read operations to map the victim’s cloud environment. A second principal then carried out the destructive phase, deleting storage accounts, a key vault, a function app and virtual machines.

One of the stolen credentials had been leaked in a public GitHub issue, according to Microsoft. The attacker also fired more than 30 requests for storage keys, attempting to compromise recovery mechanisms.

Microsoft said no ransom note was observed. Some deletion attempts were blocked by Azure resource locks, which saved part of the infrastructure.

The findings were published in a September 25 investigation. Microsoft says the attack shows why non-human cloud identities need strict controls.