Microsoft details JADEPUFFER-linked Azure reconnaissance, resource deletion, and credential access using compromised service principals, identifying the activity as associated with Storm-3168 and prov...

Microsoft details JADEPUFFER-linked Azure reconnaissance, resource deletion, and credential access using compromised service principals, identifying the activity as associated with Storm-3168 and providing guidance for defenders.

Researchers identified what they believe is the first documented case of a ransomware operation, JadePuffer, conducted entirely by a large language model (LLM) agent.

El grupo JADEPUFFER usó credenciales comprometidas para destruir recursos en Azure. Microsoft documenta actividades vinculadas al código Storm-3168.

JadePuffer could be the first reported case of a ransomware attack driven by AI from start to finish. How can businesses respond?

The JadePuffer autonomous AI agent has upgraded with custom malware called EncForge that focuses on encrypting AI assets, such as training datasets, vector databases, and model checkpoints.

The Sysdig TRT documents JADEPUFFER: the first known agentic ransomware operation, where an LLM autonomously exploited Langflow, harvested credentials, and executed full database extortion.

The JadePuffer autonomous AI agent has upgraded with custom malware called EncForge that focuses on encrypting AI assets, such as training datasets, vector databases, and model checkpoints.

 Security researchers have identified JadePuffer as the first ransomware operation conducted entirely by an AI agent, marking a watershed moment in automated cyberattacks. Discovered by cloud security firm Sysdig, this incident demonstrates how large language model (LLM) agents can now execute complex intrusion campaigns without human intervention during the attack itself.  Attack methodology  The attack began by exploiting CVE-2025-3248, a critical remote code execution vulnerability in Langflow, an open-source platform for building LLM applications. Once inside the initial server, the AI agent systematically gathered intelligence, harvested credentials, and mapped the network to identify higher-value targets. It then pivoted to a production server running MySQL and Nacos configuration management, where it leveraged another known authentication bypass vulnerability to gain administrative access.  What made JadePuffer particularly notable was its ability to detect and correct errors autonomously during the attack. When the agent's first attempt to create an administrator account failed, it analyzed the error and launched a corrected procedure just 31 seconds later, successfully modifying its credential generation approach. Sysdig researchers emphasized that this rapid self-correction capability is a strong indicator of genuine agentic behavior rather than a human operator using conventional automation tools.  After securing access, JadePuffer encrypted more than 1,300 configuration elements in the database, deleted the original tables, and left a ransom note with a Bitcoin address and contact email. However, analysis revealed a disturbing detail: the encryption key was never stored or transmitted to any attacker-controlled server, suggesting victims could not recover their data even if they paid. Researchers believe this indicates the attack was oriented more toward data destruction than financial extortion, with claims of external backups appearing to be psychological pressure tactics without evidence of actual exfiltration.  Security implications  While JadePuffer has drawn attention to AI's role in cybercrime, experts stress that the fundamental vulnerability was poor security hygiene rather than the AI itself. Exposed credentials, unpatched vulnerabilities, default configurations, and excessive privileges enabled the agent to traverse the infrastructure within minutes. This incident underscores the urgent need for organizations to harden their AI application deployments, implement zero-trust architectures, and maintain rigorous patch management, as autonomous agents will increasingly exploit any weakness they encounter at machine speed.

The Sysdig TRT documents JADEPUFFER: the first known agentic ransomware operation, where an LLM autonomously exploited Langflow, harvested credentials, and executed full database extortion.

JadePufferランサムウェア、AIエージェント利用し攻撃全体を自動化

Forscher dokumentieren den ersten LLM-gesteuerten Ransomware-Angriff. Doch die KI scheiterte an grundlegenden Fehlern. Eine Mahnung für Admins.

Microsoft has uncovered a destructive Azure campaign linked to Storm-3168, also known as JADEPUFFER, in which attackers abused compromised service principals to map cloud environments, delete critical...

Sysdig

The agentic ransomware group JADEPUFFER struck Langflow infrastructure with ENCFORGE, a payload that encrypts AI models without a functioning ransom mechanism. Recovery costs for a single enterprise-ready fine-tuned model are estimated at $75,000–$500,000.

The Sysdig TRT documents JADEPUFFER: the first known agentic ransomware operation, where an LLM autonomously exploited Langflow, harvested credentials, and executed full database extortion.