Storm-3168 Deletes Azure Resources in 7-Minute Destructive Cloud

🚨 ACTIVE EXPLOITATION

• Storm-3168 Deletes Azure Resources in 7-Minute Destructive Cloud Attack
  Storm-3168 used compromised Azure service principal credentials to destroy cloud resources in about seven minutes.
  • Applies to Azure customers using service principals, storage accounts, SQL databases, Key Vaults, Function Apps, App Services, and backup/recovery controls.
  • Microsoft tracked actor Storm-3168 used two compromised service principals in one tenant: one mapped the environment over 15+ hours with 300+ read operations, the other destroyed resources and collected storage keys.
  • Over roughly seven minutes the attacker made 100+ deletion attempts against storage accounts, deleting most, plus a Key Vault, Function App, and App Service plan; Azure SQL deletions failed due to an unsupported API version.
  • One service principal's client ID, secret, and tenant ID had appeared in plaintext in a public GitHub issue; the activity is linked to JADEPUFFER agentic ransomware operations and likely extortion.
  • IOCs: 45.131.66[.]106 (App Service probing, malicious ARM requests), 34.153.223[.]102 and 64.20.53[.]230 (App Service probing).
  Sources 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

🔓 CVEs & KEV

• CVE-2026-84154 — Dassault Systèmes GEOVIA Geospatial Data Manager — CVSS 9.9 — Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Re...

• CVE-2026-96431 — Flowring Technology Corp Agentflow 4.0 — CVSS 9.3 — Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous TypeUnres...

• CVE-2026-96429 — Flowring Technology Corp Agentflow 4.0 — CVSS 9.3 — Flowring Agentflow 4.0 - SQL InjectionSQL Injection in the /WebAgenda/SMBAjax...

• CVE-2026-96428 — Flowring Technology Corp Agentflow 4.0 — CVSS 9.3 — Flowring Agentflow 4.0 - SQL InjectionSQL Injection in the /WebAgenda/SMBAjax...

• CVE-2026-96430 — Flowring Technology Corp Agentflow 4.0 — CVSS 8.7 — Flowring Agentflow 4.0 - Exposed Dangerous Method or FunctionExposed Dangerou...

• CVE-2026-101169 — Octopus Deploy Octopus Server — CVSS 8.7 — In affected versions of Octopus Server, an authenticated user with permission...

• CVE-2026-96440 — Flowring Technology Corp Agentflow 4.0 — CVSS 7.1 — Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Di...

🕵️ RESEARCH & DEEP DIVES

• nvidia-openshell-sandbox-egress — r/netsec

• ray-control-plane-exposure-eks — r/netsec

• opertraitor-kubernetes-rbac-audit — Palo Alto Unit 42

📋 ADVISORIES

• Kiteworks lifts server shutdown warning after patching critical flaw
  Kiteworks has patched a critical vulnerability and lifted its precautionary advisory telling customers to shut down their servers.

  • Kiteworks serves thousands of global corporations and government agencies via its Private Content Network, with over 100 million end-users.
  • A critical vulnerability in an unnamed feature used by less than 1% of customers was patched; self-hosted Kiteworks Advanced Forms users were told to contact support.
  • Kiteworks urged customers to shut down servers Saturday after federal intelligence authorities warned of a potentially imminent attack; hosted systems were brought back online Monday with no evidence of compromise.
  • No CVE ID has been assigned and details of the flaw have not been disclosed; Shadowserver found nearly 400 internet-exposed Kiteworks instances, 234 in the US.
  • Kiteworks (formerly Accellion) was previously targeted by the Clop gang in zero-day attacks on its legacy File Transfer Appliance, causing breaches at Qualys, Shell, Kroger, and others.
  Sources 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

• Pentagon directs Cyber Command to defend 2026 midterms from foreign interference
  The Pentagon has directed US Cyber Command to prioritize cyber operations against foreign actors seeking to interfere in the 2026 US midterm elections.

  • Applies to US Cyber Command and defense of the 2026 US midterm elections.
  • Targets foreign threat actors seeking to interfere in the elections.
  • Directive signed by Secretary of War Pete Hegseth directs Cyber Command to deploy its cyber capabilities against these actors.
  Sources 📄 Source: war.gov · 📎 Coverage: mastodon.social · 👁 via @campuscodi@mastodon.social

• wolfssl-5.9.4-tls-flaws (5) — <https://cybersecuritynews.com/wolfssl-5-9-4-fixes-tls-flaws/|Cyber Security News>
  📄 Source for Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigation — databreaches.net

• 📄 Source for OpenAI agent accessed Australian Medicare portal during training, sparking security concerns — openai.com