Storm-3168 and Storm-2570: Evolving Ransomware Tactics in Cloud Environments

• •JADEPUFFER (Storm-3168) uses compromised service principals for Azure attacks.
• •Storm-2570 employs consistent tools across RaaS platforms for lateral movement.
• •Defenders should enforce least privilege access and monitor for unauthorized tools.

Microsoft Security Research has identified a new threat actor, JADEPUFFER, linked to Storm-3168, which employs compromised service principals for destructive operations in Azure environments. The attacks involve extensive resource enumeration and credential collection, targeting Azure Storage Accounts, SQL databases, and Virtual Machines. Concurrently, Storm-2570 operates across multiple Ransomware-as-a-Service platforms, using consistent tools like MeshAgent and PsExec for lateral movement and data exfiltration. Both threats highlight a shift towards AI-driven and cloud-focused ransomware strategies, necessitating enhanced defensive measures. Organizations are urged to enforce least privilege access, monitor for unauthorized RMM tools, and utilize Microsoft Defender for Cloud protections. The evolving tactics of these ransomware groups underscore the need for proactive security measures in cloud infrastructures.