Threat Intelligence Report: JADEPUFFER Agentic Ransomware and Automated Extortion

Report date: July 13, 2026

Threat type: Agentic ransomware, destructive extortion, cloud and application compromise Activity status: Emerging

Attribution: Unattributed

Confidence: Moderate

Primary source: Sysdig Threat Research Team

Intended audience: Security leadership, threat intelligence, incident response, cloud security, vulnerability management, and detection engineering teams

Executive Summary

JADEPUFFER is an emerging threat activity cluster associated with what Sysdig assesses to be the first documented end…