Actor Profile

JADEPUFFER (tracked by Microsoft as Storm-3168) is a threat actor notable for conducting the first documented ransomware operation orchestrated end-to-end using large language models (LLMs). The actor demonstrates evolving tradecraft, transitioning from AI-assisted attacks against on-premises infrastructure to destructive cloud operations. Originally documented by Sysdig exploiting Langflow vulnerabilities (CVE-2025-3248) and deploying custom Go-based ransomware (ENCFORGE) targeting AI infrastructure, JADEPUFFER has since expanded operations to Microsoft Azure environments. The actor's motivation appears financially driven, aligned with ransomware objectives focused on resource destruction and recovery impairment to coerce payment, though no ransom notes were observed in the June 2026 Azure incident.

TTPs (Tactics, Techniques, Procedures)

JADEPUFFER employs compromised Azure service principals for initial access, likely obtained through credential harvesting from public GitHub repositories (exposed client IDs, secrets, and tenant IDs in plaintext commit history). The actor conducts extensive reconnaissance using read operations (300+ enumeration actions over 16 hours) targeting Virtual Machines, subscriptions, resource groups, and App Service configuration stores for credential discovery. Destructive operations include deletion of Azure Storage Accounts, SQL databases, Key Vaults, Function Apps, Virtual Machines, App Services, and recovery protection locks executed via a second service principal over 35 minutes (150+ operations). The actor demonstrates lateral movement capabilities, persistence establishment, and uses automated/scripted tooling evidenced by coordinated multi-principal operations and rapid execution timing. Previous campaigns leveraged MySQL AES_ENCRYPT() functions and custom ENCFORGE ransomware targeting AI infrastructure with 180+ file extension signatures.

Targets & Patterns

JADEPUFFER targets cloud services and technology sectors, specifically organizations operating Microsoft Azure environments and AI infrastructure. The June 2026 incident focused on a single Azure tenant, while Microsoft observed repeated probing against Azure App Services across multiple customers, indicating broader targeting. Victim selection appears opportunistic, exploiting exposed credentials in public repositories and vulnerable internet-facing services (Langflow instances). The actor prioritizes high-value cloud resources including storage accounts, databases, key vaults, and backup/recovery systems to maximize operational impact and impair recovery capabilities. AI infrastructure remains a key target area, with ENCFORGE malware designed to encrypt model checkpoints, vector databases, training datasets, embedding indices, and macOS development environments. The pattern suggests targeting organizations with weak secrets management practices and inadequate cloud security posture.

Historical Context

JADEPUFFER was first documented by Sysdig as the inaugural threat actor to execute a complete ransomware operation using LLM-driven autonomous agents. Initial campaigns exploited CVE-2025-3248 in Langflow to compromise AI infrastructure, harvest credentials, move laterally, encrypt Nacos configuration files using MySQL's AES_ENCRYPT() function, drop database tables, and deploy ransom notes demanding Bitcoin payment. The same Langflow instance was subsequently re-compromised with ENCFORGE, a compiled Go-based ransomware specifically engineered for AI environments. The June 2026 Azure incident represents a significant evolution in tradecraft, demonstrating the actor's capability to transition from on-premises AI infrastructure attacks to large-scale cloud environment destruction using compromised identity and access management (IAM) primitives. This progression indicates growing sophistication in cloud-native attack techniques and automation capabilities.

Defensive Recommendations

  • Implement Azure resource locks and storage account-level deletion protection to prevent unauthorized deletion even when identities are compromised with administrative permissions
  • Monitor for anomalous service principal activity including high-volume read operations (300+ enumeration actions), rapid resource group/VM discovery across subscriptions, and App Service configuration store access patterns indicative of credential harvesting
  • Scan public GitHub repositories and commit history for exposed Azure service principal credentials (client IDs, client secrets, tenant IDs) and immediately rotate compromised secrets; implement automated secret scanning in CI/CD pipelines
  • Deploy conditional access policies and privileged identity management (PIM) for service principals with time-bound, just-in-time access to limit blast radius of compromised identities
  • Enable Azure Activity Log monitoring and alerting for bulk deletion operations, especially targeting Storage Accounts, Key Vaults, SQL databases, and recovery services within compressed timeframes (7-35 minutes)