Actor Profile

JadePuffer (tracked by Microsoft as Storm-3168) is a ransomware operator that emerged in July 2026, specializing in agent-driven attacks against cloud infrastructure. The actor leverages AI agents to automate the entire attack chain, representing a significant evolution in cloud-targeted ransomware operations. JadePuffer's motivation appears to be financially driven through ransomware extortion, with operations focused on Azure cloud environments. The actor demonstrates sophisticated understanding of cloud architecture, targeting storage accounts, Key Vaults, Function Apps, Virtual Machines, App Services, and AI assets including training datasets and vector databases. Initial access in observed incidents was linked to compromised service principals, with credentials for at least one service principal exposed in a public GitHub issue prior to attacks.

TTPs (Tactics, Techniques, Procedures)

JadePuffer employs automated AI-driven attack chains beginning with initial access via compromised service principals (valid accounts). The actor conducts cloud resource reconnaissance and discovery operations to map Azure tenant infrastructure. Credential theft operations include retrieval of storage account keys (30+ successful requests observed). Lateral movement occurs through abuse of Azure service principals with excessive permissions. For persistence and impact, the actor performs destructive operations including deletion of Azure Storage accounts (100+ targeted), removal of Azure Site Recovery locks to eliminate backup protections, and attempted deletion of Azure SQL databases. The destructive phase executes rapidly (seven minutes observed) with parallel targeting across multiple resource types. The actor also employs a tool called EncForge to target AI-specific assets. Operational security failures include credential exposure in public repositories.

Targets & Patterns

JadePuffer exclusively targets cloud service providers, specifically Microsoft Azure tenants. The actor demonstrates a broad targeting strategy across Azure resource types including Storage accounts, Key Vaults, Function Apps, Virtual Machines, App Services, and Azure SQL databases. This parallel multi-resource targeting pattern suggests an intent to maximize destructive impact across different data services rather than focusing on a single resource type. Recent expansion includes targeting AI-specific assets such as training datasets and vector databases, indicating the actor is adapting to high-value cloud-native workloads. The selection of Azure tenants with compromised service principals suggests opportunistic targeting based on credential availability, though the specific vertical sectors affected beyond general cloud services are not specified in available reporting.

Historical Context

JadePuffer malware and operations first emerged in July 2026, with initial research by Sysdig highlighting the use of AI agents for attack automation. Microsoft Security Research observed two attacks in June 2026 (prior to public identification), indicating the actor was active before formal discovery. Shortly after initial reporting, the actor expanded operational scope to include AI assets, training datasets, and vector databases using the EncForge tool. This represents one of the first documented cases of agentic AI being weaponized for ransomware operations against cloud infrastructure. The rapid evolution from initial emergence to expanded AI asset targeting demonstrates an adaptive threat actor. No clear links to previous ransomware families or established APT groups have been publicly reported.

Defensive Recommendations

  • Implement Azure resource locks and storage account-level protections to prevent unauthorized deletion of critical resources, as these defenses successfully blocked some JadePuffer deletion attempts
  • Activate Microsoft Defender for Cloud workload protections to detect anomalous service principal activity, particularly rapid sequential deletion operations and bulk storage key retrieval
  • Conduct regular audits of public code repositories (GitHub, GitLab) for exposed Azure service principal credentials and secrets using automated scanning tools
  • Enforce least-privilege Azure RBAC permissions for service principals, limiting destructive capabilities and restricting access to storage account keys and Site Recovery operations
  • Monitor for rapid sequential API calls targeting multiple resource types (Storage, Key Vault, VMs, Function Apps) within short timeframes as indicators of automated attack chains