Cloud threatsMicrosoft

Cloud application identity compromise: Microsoft highlights the risk of mass resource deletion

Cloud identities used by applications also require strict permission controls. Microsoft research shows that compromised service principals can be used to delete resources and collect credentials.

Anti-Ransomware · Compiled with SI agent assistanceOriginal Microsoft threat research:Checked 2026.10.26
Illustration of an adult Chinese woman with short hair reviewing cloud application permissions in an office
Illustration · Source ↗ · About this image ↗

Source Facts

Microsoft disclosed Storm-3168 research on 25 September. In activity observed in June, two compromised Azure service principals divided the work of discovering and destroying resources. Resource locks and protection settings blocked some deletion attempts.

The research did not confirm the initial intrusion route, observe a ransom note or establish successful data exfiltration. Businesses should focus on limiting application-identity permissions. Exposed keys must be revoked or rotated; removing text from a webpage is insufficient.

Next Steps for Businesses / Editorial Observations

Include application identities and backup protection permissions in reviews to prevent one credential from affecting many resources.

Next steps you can take

  • Inventory service principal permissions and keys, rotate exposed credentials and investigate historical usage logs.
  • Restrict administrative permissions over backup and recovery resources, and monitor bulk deletion and changes to protection settings.

Original sources

Storm-3168: Agentic-driven cloud attacks using compromised service principals

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of a software package conveyor and a master key stored separatelyIllustrationSupply chain security · 2026.10.24

LiteLLM explains package compromise: exposed keys must be revoked to complete the response

LiteLLMOriginal synthetic illustration of an old certificate being removed from a glass certificate chainIllustrationSecurity updates · 2026.10.24

Oracle updates Java trust certificates, removing affected eMudhra root certificates

OracleOriginal synthetic illustration of a bookshop owner and developer checking an access credential replacement checklistIllustrationIncident Reports · 2026.10.24

Railway updates incident response information: users still need to revoke and replace sensitive credentials

Railway