JADEPUFFER
Tracked by CyberSIXT since 2 Jul
- Articlesall time
- 11
- Articleslast 30 days
- 4
- CVEs exploitedattributed · all time
- 1
- Research reportsall time
- 8
12 articles from 7 outlets since 3 Jul; the latest 22 days ago.
- Article
- First report
- Research report
Show as table
Profile
Written by CyberSIXT from the sources listed below. Updated 26 Oct.
Security Affairs reported that Sysdig named an AI-driven ransomware operation JADEPUFFER1. Malpedia lists JadePuffer and Storm-3168 as aliases2.
Infosecurity reported that JADEPUFFER deployed ENCFORGE to destroy AI model artifacts, including PyTorch and TensorFlow files, through a Langflow flaw3. SecurityWeek reported that JADEPUFFER exploited CVE-2025-3248 in Langflow to run arbitrary Python code and access API keys and database credentials4. SecurityWeek also described a pivot to a production server linked to MySQL and Nacos, where JADEPUFFER injected a backdoor and encrypted configuration files4.
Sources
- JADEPUFFER AI ransomware exploits Langflow flaw CVE-2025-3248 · Security Affairs · 2026-07-03
- JADEPUFFER: alias · Malpedia
- JadePuffer's ENCFORGE ransomware erases AI models via Langflow · Infosecurity · 2026-07-20
- Agentic AI Used to Conduct Ransomware Attack via Langflow · SecurityWeek · 2026-07-03
Diamond Model
What the record links to JADEPUFFERRecorded associations sorted by Diamond Model vertex. They do not reconstruct an intrusion or establish a campaign. Model: Caltagirone, Pendergast and Betz (2013).
Names and sources
- JadePuffer
- CyberSIXT coverage, Malpedia, MISP Galaxy
- Storm-3168
- Malpedia, MISP Galaxy
CVEs exploited
1 CVE an article attributes to JADEPUFFERVendors targeted
MITRE ATT&CK® techniques
No MITRE ATT&CK® techniques are recorded for JADEPUFFER.
- New Malware Roundup Exposes AI Attacks and Evolving ThreatsSecurity Affairs
- Azure Ransomware Attack Wiped Cloud Tenants and Stole Storage KeysSecurityOnline
- Microsoft Says JadePuffer Tried to Destroy an Azure TenantDark Reading
- Storm-3168 Used Stolen Azure Identities to Delete Cloud DataSecurity Affairs
- JADEPUFFER Attackers Exploit Azure Identities to Delete Cloud ResourcesThe Hacker News
- Microsoft Links Azure Destruction Spree to Ransomware Actor Storm-3168Microsoft
- ENCFORGE Ransomware Hunts AI Models Through Langflow RCEThe Hacker News
- JadePuffer's ENCFORGE ransomware erases AI models via LangflowInfosecurity
- Agentic ransomware JadePuffer driven by LLM hits Langflow flawInfosecurity
- US Agency Pays $1M to Extortion Group Kairos Amid Rising ThreatsSecurity Affairs
- JADEPUFFER AI ransomware exploits Langflow flaw CVE-2025-3248Security Affairs
- Agentic AI Used to Conduct Ransomware Attack via LangflowSecurityWeek
The latest 12 are listed. See all 13 articles in the timeline.
Research reports
- Storm-3168: Agentic-driven cloud attacks using compromised service principalsMicrosoft · 6 Oct
- JADEPUFFER: Agentic ransomware for automated database extortionSysdig · 6 Oct
- JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI modelsSysdig · 6 Oct
- JADEPUFFER: The Dawn of Agentic Ransomware OperationsMedium · 28 Jul
- AI Security Incident Case: JadePuffer Ransomware Leverages AI Agent to Automate Attacksnsfocusglobal.com · 28 Jul
- JadePuffer Becomes the First Ransomware Campaign to Let an AI Agent Run the Entire Attack | SecureReading JadePuffer AI Ransomware Uses Autonomous LLM Agent to Automate Entire Cyberattacksecurereading.com · 28 Jul
- Threat Intelligence Report: JADEPUFFER Agentic Ransomware and Automated Extortionkrypt3ia.wordpress.com · 28 Jul
- New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE AttackThe Hacker News · 28 Jul