Skip to main content

Computerease

GET A QUOTE

Cloud Ransomware in Seven Minutes: What a New Microsoft Report Means for Your Business

Cloud ransomware attack showing a locked cloud environment, seven-minute data deletion alert, Azure storage accounts, and deleted files.

If your business runs on Microsoft 365, Azure, or other cloud services, you probably think of the cloud as safer than a server in the back closet. In many ways, it is. But research Microsoft published on September 25 is a useful reminder of what can happen once an attacker gets inside a cloud account.

In an attack that took place in early June, a group linked to an AI-driven ransomware operation used compromised cloud accounts to map a company’s Azure environment. Then, in about seven minutes, it tried to delete more than 100 storage accounts. Most of those deletions succeeded.

That speed changes the question for business owners. It is not only whether someone is watching your cloud environment. It is whether safeguards are already in place that still work when an attack moves faster than any person can react.

This article is not a technical guide for your IT team. It is a plain-English look at what happened, what it means for cloud security for small business owners, and what your IT provider should have in place. It builds on our recent look at how AI is speeding up cyberattacks

The short answer to “how are ransomware groups using AI agents in cloud attacks?” In this case, attackers used valid cloud credentials to get into a company’s Microsoft Azure environment. Automated tools then mapped the environment, deleted data, and collected access keys far faster than a person could. The group is linked to the first documented AI-driven ransomware operation, though Microsoft described this attack as automated or scripted rather than confirming AI was running it. The businesses best positioned to survive an attack like this have protected backups, tightly limited cloud permissions, and safeguards that block deletion even when an attacker has administrator access.

What Microsoft Found Inside a Compromised Cloud Environment

On September 25, 2026, Microsoft published research on a threat group it tracks as Storm-3168. Microsoft linked the group to JADEPUFFER, which the security firm Sysdig documented in July 2026 and described as the first known ransomware operation driven largely by an AI agent. Microsoft’s report is the first detailed look at the group’s activity inside Azure.

The attackers used two compromised service principals. These are accounts that apps and automated tools use to reach cloud resources, rather than accounts for people. The first spent about 15 and a half hours quietly mapping the environment, completing more than 300 successful lookups. The second carried out the attack.

Once the destruction started, it moved fast. In about seven minutes, the second account made more than 100 attempts to delete storage accounts, and most succeeded. It also deleted a key vault (where an organization stores passwords and access keys for its applications), along with the other pieces of one business application. About 30 minutes later, it collected access keys for more than 30 storage accounts, including some tied to disaster recovery. Those keys could open the door to the data inside.

Microsoft said the timing and the way work was split across accounts “strongly indicates automated or scripted execution.” It described the activity as consistent with ransomware and extortion tactics. But it did not observe a ransom note or confirm that any data was stolen.

How did the attackers get in? Microsoft could not say for certain. But login details for one of the accounts had been posted in plain text in a public GitHub issue by an employee of the affected organization. The post was later edited to remove them, but they stayed visible in the edit history. Microsoft’s guidance is direct: any credential exposed publicly should be treated as compromised and replaced, even after the original post is deleted.

Why Faster Cloud Attacks Matter to Small and Mid-Sized Businesses

Most small and mid-sized businesses now keep their email, files, and business applications in the cloud. That makes three lessons from this attack worth understanding.

The first is speed. Seven minutes is not enough time for anyone to notice an alert, log in, and stop an attack by hand. Protection has to be built in ahead of time. The 15 hours of quiet mapping beforehand is exactly the kind of unusual activity good monitoring should catch before the damage starts.

The second is that the way in was ordinary. Nothing here required breaking an advanced defense. The attackers appear to have had working credentials, and automation made everything after that faster. It is the same pattern we described in our article on Google’s warning [add link]: AI and automation speed up familiar tactics more than they invent new ones.

The third is that deleting data can do as much damage as encrypting it. When attackers delete cloud data instead of locking it, recovery depends entirely on backups they cannot reach. In this case, the attackers went after backup and recovery resources too.

What Stopped Part of the Attack

Not everything was lost. Microsoft reported that Azure resource locks and storage deletion protection blocked the deletion of a few storage accounts. Microsoft pointed to these as safeguards that keep working even when an attacker controls an account with broad administrator permissions.

Think of it like a safe deposit box that needs a second key. Even someone holding the account owner’s keys cannot empty it in a hurry. The attackers also tried to remove the protection locks on backup and disaster recovery resources, and every one of those attempts failed.

Some databases survived for a different reason. The attackers’ deletion requests used an unsupported version of a command, so each attempt failed. That was luck, not protection. The storage accounts that survived on purpose were the ones with locks someone had set up ahead of time.

What Good Cloud Security for Small Business Looks Like

The gaps that make an attack like this possible are common and easy to overlook. Login details for apps end up in code, emails, support tickets, or public websites. Old app accounts nobody remembers keep powerful permissions. Admin rights get handed out broadly because it is convenient. Backups sit in the same cloud account as everything else, where one compromised login can reach both. And nobody is watching after hours.

A well-run cloud environment closes these gaps on purpose. Your provider should treat cloud credentials like the keys to your building: never posted anywhere, and replaced right away if they are ever exposed. Every account, including app accounts, should have only the access it needs. In this attack, the accounts could delete what they did because of the permissions they had already been given. Critical data and backups should also have deletion locks.

Backups should be kept separate from your main environment. Immutable backups go a step further: they cannot be changed or deleted for a set period, even by an administrator. Backups should also be tested regularly. And someone should be watching your cloud environment around the clock for unusual activity, like hours of quiet mapping or a sudden burst of deletions.

Questions to Ask Your IT Provider About Cloud Security

You do not need to review cloud settings yourself. These questions, and what a good answer sounds like, will tell you quickly whether your business is protected:

  • “If someone logged in to our cloud account with admin rights tonight, what would stop them from deleting our data?” A good answer names specific safeguards, such as deletion locks and backups the attacker cannot reach.
  • “Are our backups stored where a compromised admin account cannot delete them?” A good answer is yes, with backups kept separate and protected from deletion.
  • “Who watches our cloud environment after hours?” A good answer describes around-the-clock monitoring with alerts for unusual activity.
  • “How many accounts can delete our cloud data, and when were they last reviewed?” A good answer is a short list and a recent review date.
  • “What happens if a password or access key is accidentally exposed?” A good answer is that it gets replaced right away, not just deleted from where it was posted.
  • “When did we last test restoring from backup?” A good answer is a specific date and a result.

If the answers are vague, or nobody is sure where your backups live, it is worth a closer look.

How Computerease Protects Our Clients’ Cloud Environments

Our clients do not track threat research or configure cloud permissions. That is our job. For businesses on our managed IT services and cloud IT services, we review who and what can reach your cloud environment and limit admin rights to what each account actually needs.

We manage backup and recovery designed to keep copies of your data separate from your main environment, and we test restores so you know recovery works before you need it. Our Microsoft 365 security audits catch risky settings and forgotten accounts before an attacker finds them.

Monitoring runs around the clock through our 24/7/365 security operations center. Managed SIEM monitoring pulls together activity from across your Microsoft 365 and cloud environment, so unusual patterns like a burst of deletions get flagged early.

Security-First IT Support for Missouri and Illinois Businesses

Computerease has been helping businesses protect their technology since 1984. Our family-owned team works with manufacturers, healthcare practices, law firms, accounting firms, and professional services companies across Missouri and Illinois. Cybersecurity is part of how we manage every environment, on-site or in the cloud. We stand behind our work with a 100% money-back guarantee. 

Not sure how well your cloud data is protected? Book a free discovery call. We will walk through where your data lives, who can reach it, and what would happen if an attacker got in.

Complete This Form To Claim Your FREE Cyber Security & AI Risk Assessment

Frequently Asked Questions

An AI agent is software that can carry out a series of tasks on its own, such as mapping a network, collecting access keys, and deleting data, without a person directing each step. That lets attackers move far faster than a human could.

They used two service principals, which are accounts that apps and automated tools use to reach cloud resources. Credentials for one of them had been posted in a public GitHub issue by an employee of the affected organization. Microsoft could not confirm that this specific credential was used in the attack.

Any business that runs on cloud services can be at risk if credentials are exposed or accounts have more access than they need. What matters most is not company size but whether safeguards like protected backups and deletion locks are in place.

Deletion locks, backups kept separate from your main environment, tightly limited admin permissions, and around-the-clock monitoring. In Microsoft’s case, resource locks and deletion protection saved a few storage accounts, and protection locks on backup and recovery resources held.

Microsoft secures its own infrastructure. Under its shared responsibility model, customers remain responsible for their data, user accounts, and access controls. Protecting and backing up your data is your side of the arrangement, which is where your IT provider comes in.

Sources