Storm-3168 explained: How compromised service principals deleted Azure resources in seven minutes

Microsoft says the actor behind JADEPUFFER, the first documented agentic ransomware operation, used two compromised Azure service principals to map a tenant and then delete storage accounts, a Key Vault, and app resources in about seven minutes. Here’s what happened, why a deleted secret still works, and what to change in how you handle workload identities.