Microsoft: AI Cuts Post-Compromise Attack Time to Minutes
Microsoft’s 2026 report says AI cut post-compromise attack stages from days to minutes.
2
Stories per day · 30 days
2 RSS
16 stories, newest first · one card per story
Stories tagged #jadepuffer
Storm-3168 Deletes Azure Resources in 7-Minute Destructive Cloud Attack
Microsoft says Storm-3168 used stolen Azure identities to delete cloud resources within about seven minutes.
3
Hackers Use Compromised Service Principals to Delete Azure Storage and Steal Cloud Credentials
Microsoft links destructive Azure Storage deletions and storage key theft by Storm-3168 (JADEPUFFER) to compromised service principals with credentials leaked on GitHub.
1
JadePuffer crims hijacked Azure identities and used them to blow up cloud resources
Microsoft attributes Azure cloud destruction attacks to Storm-3168, the actor behind JadePuffer agentic ransomware, after hijacked service principals deleted 100+ storage accounts.
4
JadePuffer agentic AI attacks target Azure, destroy cloud resources
JadePuffer, tracked as Storm-3168, used AI-driven attacks to wipe Azure storage and other cloud resources.
3
JadePuffer AI Actor Compromises Azure Tenant in Destructive Cloud Attack
JadePuffer allegedly used exposed credentials to delete an Azure tenant's storage, apps, and databases.
1
Autonomous agents attack Azure using compromised identities and destroying resources
Microsoft says Storm-3168, or Jadepuffer, used compromised Azure service principals to delete cloud resources and collect credentials.
3
Storm-3168, Linked to JADEPUFFER, Abused Stolen Azure Identities
Microsoft details Storm-3168 (JADEPUFFER) using two stolen Azure service principals to rapidly delete 100+ storage accounts and harvest keys for extortion.
4
JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources
JADEPUFFER-linked Storm-3168 deleted Azure storage, databases, and recovery resources with stolen service principals.
5
Storm-3168 Hackers Abuse Compromised Service Principals to Destroy Azure Cloud Resources
Microsoft says Storm-3168 used compromised Azure service principals to delete cloud resources and collect storage keys.
4
Storm-3168: Agentic-driven cloud attacks using compromised service principals
Microsoft details Storm-3168 (JADEPUFFER) destroying Azure resources via compromised service principals in the first documented agentic ransomware operation's Azure activity.
1
When Ransomware Targets AI Models: Defending the AI/ML Recovery Chain
Sysdig's JADEPUFFER ransomware campaign deployed the ENCFORGE Go binary via Langflow CVE-2025-3248 to encrypt AI models, datasets, and vector stores for destruction-based extortion.
4
AI Agents Now Run Ransomware Attacks End-to-End Without Human Operators
SOCRadar documented JADEPUFFER, an AI agent that autonomously executed a ransomware campaign from Langflow exploit through encryption and extortion.
3
JADEPUFFER Evolves Agentic Ransomware to Target AI Models and Training Data
Sysdig links JADEPUFFER, an AI-driven ransomware actor, to ENCFORGE, a new locker encrypting and destroying AI models, training data, and vector databases.
4
AI Threat Landscape Digest: July–August 2026
Check Point's digest reports AI agents escaping containment, a Claude Code-driven ransomware affiliate, and JADEPUFFER's fully autonomous AI extortion operation.
3
The Agentic AI threat cluster: Seven incidents, three actors, and what they mean for your exposure
Tenable links seven agentic AI attack incidents to three threat actors, including Taiwan's confirmed autonomous attack that exfiltrated over 2,564 personnel records.
1