[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYEY0K3y3LrXikxmGOnKvJ1AyDeLO-eTfHLUNNN86sNI":3},{"article":4,"iocs":55,"watch_terms":72,"solutions":73,"lesson":167},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"f9e03db5-5b4d-4d3e-a900-56478532af8e","JadePuffer agentic AI attacks target Azure, destroy cloud resources","jadepuffer-agentic-ai-attacks-target-azure-destroy-cloud-resources-178f19","The JadePuffer ransomware operator is targeting Azure tenants with agent-driven attacks that conduct reconnaissance, steal credentials, and destroy core components. [...]","The JadePuffer ransomware operator, tracked as Storm-3168 by Microsoft, is using AI agents to automate attacks against Azure tenants. These attacks involve reconnaissance, credential theft, and the destruction of cloud resources like storage accounts, Key Vaults, and virtual machines. While the attackers aim to make recovery difficult, some protections like Azure resource locks prevented complete data loss in observed incidents.","JadePuffer ransomware operator targets Azure tenants with agentic AI attacks, destroying cloud resources.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fjadepuffer-agentic-ai-attacks-target-azure-destroy-cloud-resources\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F07\u002F01\u002FAzure.jpg","2026-09-28T15:49:27+00:00","2026-09-28T18:00:12.032316+00:00",9,[17,20,22,25,27,30],{"name":18,"type":19},"JadePuffer","threat_actor",{"name":21,"type":19},"Storm-3168",{"name":23,"type":24},"Azure","product",{"name":26,"type":24},"EncForge",{"name":28,"type":29},"AI agents","technology",{"name":31,"type":29},"service principals","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63,66,69],{"type":57,"value":58,"context":59},"mitre_attack","T1078.004","Use of compromised service principals for authentication to Azure",{"type":57,"value":61,"context":62},"T1531","Account Access: Abuse Elevation Control Mechanism (deletion of Azure resources)",{"type":57,"value":64,"context":65},"T1087.004","Account Discovery: Cloud Account",{"type":57,"value":67,"context":68},"T1557","Credential Dumping: Credential API",{"type":57,"value":70,"context":71},"T1490","Inhibit System Recovery (removal of backup and recovery protections)",[23,26],{"controls":74,"vendors":162},[75,104,133],{"slug":76,"name":77,"problem":78,"products":79},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":105,"name":106,"problem":107,"products":108},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"slug":134,"name":135,"problem":136,"products":137},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[138,146,154],{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":155,"vendor_name":156,"vendor_logo":157,"product_slug":158,"product_name":159,"url":160,"description":161},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",[163],{"slug":126,"name":127,"logo_path":128,"roles":164},[165,166],"reported_by","affected",{"slug":168,"title":169,"body":170,"framework_refs":171,"framework_notes":187},"ai-powered-ransomware-automates-azure-tenant-destruction","AI-Powered Ransomware Automates Azure Tenant Destruction","The JadePuffer\u002FStorm-3168 threat actor is leveraging agentic AI to automate the full attack lifecycle — from reconnaissance and credential theft to the deliberate destruction of Azure storage accounts, Key Vaults, and virtual machines — dramatically accelerating the speed and scale of cloud ransomware attacks. This matters because AI-driven automation removes the human bottleneck from attack execution, meaning defenders have far less time to detect and respond before critical resources are wiped. The fact that Azure resource locks prevented complete data loss in some incidents highlights how a single, often-overlooked configuration control can be the difference between recovery and catastrophic loss. Organizations that treat cloud security as a default-secure environment are especially vulnerable to these targeted, high-impact campaigns.",[172,173,174,175,176,177,178,179,180,181,182,183,184,185,186],"CIS Control 3: Data Protection","CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 11: Data Recovery","NIST AC-2: Account Management","NIST AC-6: Least Privilege","NIST CP-9: Information System Backup","NIST IR-4: Incident Handling","NIST SI-4: Information System Monitoring","NIST CM-2: Baseline Configuration","Azure Security Benchmark: NS-1 (Network Segmentation)","Azure Security Benchmark: IM-1 (Identity Management)","MITRE ATT&CK T1078: Valid Accounts","MITRE ATT&CK T1485: Data Destruction","MITRE ATT&CK T1530: Data from Cloud Storage",{}]