Storm-3168 explained: How compromised service principals deleted Azure resources in seven minutes

Microsoft says the actor behind JADEPUFFER, the first documented agentic ransomware operation, used two compromised Azure service principals to map a tenant and then delete storage accounts, a Key Vault, and app resources in about seven minutes.