InfoSecBulletin Cybersecurity for mankind
The JadePuffer ransomware group is attacking Azure users with agent-based attacks that gather information, steal passwords, and damage key components. The malware appeared in July. Researchers at Sysdig, a cloud security company, noted that it uses AI tools to automate the whole attack process. This includes searching for information, stealing credentials, moving across systems, staying hidden, and encrypting data.
The company soon said that JadePuffer shifted its attention to AI assets, training datasets, and vector databases with a tool named EncForge. Microsoft Security Research saw two JadePuffer attacks in June. These attacks looked for cloud resources, got storage account keys, and removed Azure Storage accounts.
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
The harmful phase lasted seven minutes and hit over 100 storage accounts, along with Key Vaults, Function Apps, Virtual Machines, and App Services. Even though the attacker deleted most of the targeted Azure Storage accounts, some were safe because of Azure resource locks and protections at the account level.
Microsoft calls the JadePuffer threat actor Storm-3168. It says this actor used two hacked service accounts. These accounts are security identities that let applications, hosted services, and automated tools log in to Azure and access resources.
Both service principals were in the same tenant. One was for searching and finding resources, while the other “did discovery, harmful actions, and collected credentials.” The attacker took away backup and recovery protections (Azure Site Recovery locks), making it harder to restore.
This way of working might support ransomware attacks, but Microsoft did not mention any money requests and did not confirm if data was stolen in the cases seen.
Researchers found that trying to delete Azure SQL databases did not work because the attacker used a version of the API that is not supported. Also, efforts to remove recovery protection locks did not succeed.
“The parallel targeting of Azure SQL databases and storage accounts suggests an effort to broaden the destructive impact across different data services rather than concentrating on a single resource type,” Microsoft said . Around half an hour after the wipe efforts, Storm-3168 returned to do more than 30 requests for storage account keys, and most were successful.
Microsoft could not determine exactly how the initial access occurred, but noted that credentials for one service principal appeared in a public GitHub issue before the attacks.
The researchers suggest several ways to reduce risks and advice for system admins. This includes turning on cloud workload protections, looking for secrets in public places, and checking Azure RBAC permissions to follow least-privilege rules.
