JADEPUFFER

☆ pin

Also known as JadePuffer

Reports

First seen

Jul 2, 2026

Last seen

Aug 7, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Technology ×2 Other ×1

Top ATT&CK techniques

T1190 Exploit Public-Facing Application ×9T1486 Data Encrypted for Impact ×9T1490 Inhibit System Recovery ×5T1003 OS Credential Dumping ×5T1041 Exfiltration Over C2 Channel ×4T1021 Remote Services ×3T1078 Valid Accounts ×3T1555 Credentials from Password Stores ×3T1566 Phishing ×3T1087 Account Discovery ×3T1047 Windows Management Instrumentation ×2T1218 System Binary Proxy Execution ×2

Indicators

cve ×45domain ×4hash_sha256 ×2email ×2url ×1filename ×1ip_v4 ×1bitcoin_address ×1

Indicator values are available on Pro and via the API.

Recent reports

Critical

JADEPUFFER

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

July 2026 CVE Landscape: 85 High-Impact Vulnerabilities Actively Exploited

Cyber Brief July 2026 – EU Threat Intelligence Summary

July 2026 cybersecurity roundup: AI model breaches, agentic ransomware, and phantom squatting

CISA Orders Urgent Patching of Actively Exploited Langflow RCE Flaw CVE-2026-0770

JADEPUFFER Deploys ENCFORGE Ransomware Targeting AI Model Files via Langflow RCE

JadePuffer agentic AI agent upgraded with EncForge ransomware targeting AI model data

Check Point Threat Intelligence Report – 13 July 2026

Sysdig documents first agentic ransomware campaign by JadePuffer

JadePuffer ransomware conducted entirely by autonomous LLM agent

Avalon Malware Framework with CrownX Ransomware Discovered in Phishing Campaigns

AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack