The JadePuffer ransomware operator is running agent-driven attacks against Azure tenants. The agents do reconnaissance, steal credentials and then destroy core components of the cloud environment. BleepingComputer describes the sequence in that order, which is also the order a human operator would follow, only faster.

Faster here means 100 Azure accounts wiped in 7 minutes, according to a TechTimes report on the campaign. That is a little over four seconds per account.

Ransomware operators have historically encrypted data and sold the key back. This operator's agents are wiping cloud resources. The reporting I have seen does not say a ransom note arrived first, or at all.

Microsoft published a separate write-up on 25 September about a cluster it tracks as Storm-3168. It describes agentic reconnaissance and destruction in Azure through compromised service principals, which are the non-human identities applications use to sign in to a tenant. The reporting does not say JadePuffer and Storm-3168 are the same actor, and I will not say it either. The method is the same in outline: steal an identity, let software do the walking.

(Okta shipped an AI agent kill switch this week and its price targets rose. The kill switch governs agents a company deploys. These agents were deployed by the attacker.)

The TechTimes headline says only pre-configured locks survived. Detection did not stop the wipe. Response did not stop it either. Seven minutes is shorter than most on-call rotations take to find the laptop.

The control that changed the outcome was a lock set before the attack, on resources the stolen credentials could otherwise delete. Anything not locked beforehand was gone.