JadePuffer agentic AI attacks target Azure, destroy cloud resources
JadePuffer, tracked as Storm-3168, used AI-driven attacks to wipe Azure storage and other cloud resources.
78
Threat actor
JADEPUFFER
- Mentions · 7d0
- Mentions · 30d0
- All mentions10
- First seenAug 15, 2026
- Last mentionedSep 28, 2026
Timeline
10 articles · newest firstJadePuffer AI Actor Compromises Azure Tenant in Destructive Cloud Attack
JadePuffer allegedly used exposed credentials to delete an Azure tenant's storage, apps, and databases.
70
Autonomous agents attack Azure using compromised identities and destroying resources
Microsoft says Storm-3168, or Jadepuffer, used compromised Azure service principals to delete cloud resources and collect credentials.
82
JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources
JADEPUFFER-linked Storm-3168 deleted Azure storage, databases, and recovery resources with stolen service principals.
78
Storm-3168 Hackers Abuse Compromised Service Principals to Destroy Azure Cloud Resources
Microsoft says Storm-3168 used compromised Azure service principals to delete cloud resources and collect storage keys.
76
When Ransomware Targets AI Models: Defending the AI/ML Recovery Chain
Sysdig's JADEPUFFER ransomware campaign deployed the ENCFORGE Go binary via Langflow CVE-2025-3248 to encrypt AI models, datasets, and vector stores for destruction-based extortion.
75
AI Agents Now Run Ransomware Attacks End-to-End Without Human Operators
SOCRadar documented JADEPUFFER, an AI agent that autonomously executed a ransomware campaign from Langflow exploit through encryption and extortion.
80
JADEPUFFER Evolves Agentic Ransomware to Target AI Models and Training Data
Sysdig links JADEPUFFER, an AI-driven ransomware actor, to ENCFORGE, a new locker encrypting and destroying AI models, training data, and vector databases.
76
AI Threat Landscape Digest: July–August 2026
Check Point's digest reports AI agents escaping containment, a Claude Code-driven ransomware affiliate, and JADEPUFFER's fully autonomous AI extortion operation.
78
The Agentic AI threat cluster: Seven incidents, three actors, and what they mean for your exposure
Tenable links seven agentic AI attack incidents to three threat actors, including Taiwan's confirmed autonomous attack that exfiltrated over 2,564 personnel records.
78
Related CVEs
by mentions- CVE-2025-3248100%9.8Unauthenticated RCE in Langflow /api/v1/validate/code
- CVE-2026-2485887%9.8FortiCloud SSO Authentication Bypass Across Multiple Fortinet Products
Appears with
- Microsoftorganization · 5
- Microsoftvendor · 5
- Storm-3168threat actor · 4
- Microsoft Azureproduct · 4
- EncForgemalware · 4
- Sysdigorganization · 3
- Azure SQLproduct · 3
- Azure Key Vaultproduct · 3
- Azure Storageproduct · 3
- Langflowproduct · 3
- SOCRadarorganization · 2
- Azure Site Recoveryproduct · 2
- Langflowvendor · 2
- ENCFORGEproduct · 2
- CISAorganization · 2
- Sysdigvendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.