Signalis
sign in--:--:--UTC
Threat actors

JADEPUFFER

☆ pin
Also known as JadePuffer, Storm-3168
Reports
15
First seen
Jul 2, 2026
Last seen
Sep 28, 2026
Motivation
Financial

Relationships

CVE-2025-3248, in 9 of JADEPUFFER's reports, exploited in the wild×9CVE-2025-3248CVE-2021-29441, in 2 of JADEPUFFER's reports, exploited in the wild×2CVE-2021-29441CVE-2026-33017, in 2 of JADEPUFFER's reports, exploited in the wild×2CVE-2026-33017CVE-2026-55255, in 2 of JADEPUFFER's reports, exploited in the wild×2CVE-2026-55255Co-mentioned with JADEPUFFER in 2 Signalis reports (co-mention, not confirmed collaboration)×2thegentlemenReports targeting TechnologyTechnologyReports targeting OtherOtherJADEPUFFER

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors
Technology ×2Other ×1

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×12T1190 Exploit Public-Facing Application ×12T1490 Inhibit System Recovery ×8T1041 Exfiltration Over C2 Channel ×6T1003 OS Credential Dumping ×5T1087 Account Discovery ×5T1078 Valid Accounts ×5T1021 Remote Services ×5T1555 Credentials from Password Stores ×4T1547 Boot or Logon Autostart Execution ×3T1566 Phishing ×3T1005 Data from Local System ×3

Indicators

cve ×46domain ×4ip_v4 ×4hash_sha256 ×2email ×2bitcoin_address ×1url ×1filename ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2025-3248 (exploited)CVE-2024-42009 (exploited)CVE-2021-29441 (exploited)CVE-2026-33017 (exploited)CVE-2026-55255 (exploited)CVE-2018-14558 (exploited)CVE-2020-22653 (exploited)CVE-2020-22658 (exploited)CVE-2020-25499 (exploited)CVE-2020-8515 (exploited)CVE-2022-35733 (exploited)CVE-2023-25717 (exploited)CVE-2025-28137 (exploited)CVE-2025-34152 (exploited)CVE-2013-3307 (exploited)CVE-2025-55182 (exploited)CVE-2025-5777 (exploited)CVE-2025-66376 (exploited)CVE-2025-9491 (exploited)CVE-2025-9528 (exploited)

Recent reports

Critical

JadePuffer agentic AI attacks target Azure, destroy cloud resources

Bleeping ComputerHigh

JADEPUFFER Attackers Use Compromised Azure Service Principals for Destructive Operations

The Hacker NewsHigh

Storm-3168 (JADEPUFFER): Agentic-driven cloud attacks using compromised Azure service principals

Microsoft Threat IntelligenceHigh

AI Threat Landscape Digest: July–August 2026

Check Point ResearchCritical

July 2026 CVE Landscape: 85 High-Impact Vulnerabilities Actively Exploited

Recorded Future InsiktHigh

Cyber Brief July 2026 – EU Threat Intelligence Summary

CERT-EU Threat IntelMedium

July 2026 cybersecurity roundup: AI model breaches, agentic ransomware, and phantom squatting

ESET WeLiveSecurityCritical

CISA Orders Urgent Patching of Actively Exploited Langflow RCE Flaw CVE-2026-0770

Bleeping ComputerHigh

JADEPUFFER Deploys ENCFORGE Ransomware Targeting AI Model Files via Langflow RCE

The Hacker NewsHigh

JadePuffer agentic AI agent upgraded with EncForge ransomware targeting AI model data

Bleeping ComputerHigh

Check Point Threat Intelligence Report – 13 July 2026

Check Point ResearchHigh

Sysdig documents first agentic ransomware campaign by JadePuffer

CyberScoopHigh

JadePuffer ransomware conducted entirely by autonomous LLM agent

Bleeping ComputerHigh

Avalon Malware Framework with CrownX Ransomware Discovered in Phishing Campaigns

The Hacker NewsHigh

AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack

The Hacker News

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans