InfoSecBulletin Cybersecurity for mankind
The JadePuffer ransomware group is attacking Azure users with agent-based attacks that gather information, steal passwords, and damage key components. The malware appeared in July. Researchers at Sysdig, a cloud security company, noted that it uses AI tools to automate the whole attack process. This includes searching for information, stealing credentials, moving across systems, staying hidden, and encrypting data.
The company soon said that JadePuffer shifted its attention to AI assets, training datasets, and vector databases with a tool named EncForge. Microsoft Security Research saw two JadePuffer attacks in June. These attacks looked for cloud resources, got storage account keys, and removed Azure Storage accounts.
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
The harmful phase lasted seven minutes and hit over 100 storage accounts, along with Key Vaults, Function Apps, Virtual Machines, and App Services. Even though the attacker deleted most of the targeted Azure Storage accounts, some were safe because of Azure resource locks and protections at the account level.
Microsoft calls the JadePuffer threat actor Storm-3168. It says this actor used two hacked service accounts. These accounts are security identities that let applications, hosted services, and automated tools log in to Azure and access resources.
Both service principals were in the same tenant. One was for searching and finding resources, while the other “did discovery, harmful actions, and collected credentials.” The attacker took away backup and recovery protections (Azure Site Recovery locks), making it harder to restore.
This way of working might support ransomware attacks, but Microsoft did not mention any money requests and did not confirm if data was stolen in the cases seen.
Researchers found that trying to delete Azure SQL databases did not work because the attacker used a version of the API that is not supported. Also, efforts to remove recovery protection locks did not succeed.
“The parallel targeting of Azure SQL databases and storage accounts suggests an effort to broaden the destructive impact across different data services rather than concentrating on a single resource type,” Microsoft said . Around half an hour after the wipe efforts, Storm-3168 returned to do more than 30 requests for storage account keys, and most were successful.
Microsoft could not determine exactly how the initial access occurred, but noted that credentials for one service principal appeared in a public GitHub issue before the attacks.
The researchers suggest several ways to reduce risks and advice for system admins. This includes turning on cloud workload protections, looking for secrets in public places, and checking Azure RBAC permissions to follow least-privilege rules.
