InfoSecBulletin Cybersecurity for mankind
The JadePuffer ransomware group is attacking Azure users with agent-based attacks that gather information, steal passwords, and damage key components. The malware appeared in July. Researchers at Sysdig, a cloud security company, noted that it uses AI tools to automate the whole attack process. This includes searching for information, stealing credentials, moving across systems, staying hidden, and encrypting data.
The company soon said that JadePuffer shifted its attention to AI assets, training datasets, and vector databases with a tool named EncForge. Microsoft Security Research saw two JadePuffer attacks in June. These attacks looked for cloud resources, got storage account keys, and removed Azure Storage accounts.
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
The harmful phase lasted seven minutes and hit over 100 storage accounts, along with Key Vaults, Function Apps, Virtual Machines, and App Services. Even though the attacker deleted most of the targeted Azure Storage accounts, some were safe because of Azure resource locks and protections at the account level.
Microsoft calls the JadePuffer threat actor Storm-3168. It says this actor used two hacked service accounts. These accounts are security identities that let applications, hosted services, and automated tools log in to Azure and access resources.
Both service principals were in the same tenant. One was for searching and finding resources, while the other “did discovery, harmful actions, and collected credentials.” The attacker took away backup and recovery protections (Azure Site Recovery locks), making it harder to restore.
This way of working might support ransomware attacks, but Microsoft did not mention any money requests and did not confirm if data was stolen in the cases seen.
Researchers found that trying to delete Azure SQL databases did not work because the attacker used a version of the API that is not supported. Also, efforts to remove recovery protection locks did not succeed.
“The parallel targeting of Azure SQL databases and storage accounts suggests an effort to broaden the destructive impact across different data services rather than concentrating on a single resource type,” Microsoft said . Around half an hour after the wipe efforts, Storm-3168 returned to do more than 30 requests for storage account keys, and most were successful.
Microsoft could not determine exactly how the initial access occurred, but noted that credentials for one service principal appeared in a public GitHub issue before the attacks.
The researchers suggest several ways to reduce risks and advice for system admins. This includes turning on cloud workload protections, looking for secrets in public places, and checking Azure RBAC permissions to follow least-privilege rules.
