JadePuffer (Storm-3168) is a threat actor using autonomous AI agents to plan and execute ransomware and extortion attacks in cloud environments.
Cohesity data puts Qilin and The Gentlemen behind 32% of UK ransomware attacks. UK volume rose 60% on the quarter, and a watchlist of two names covers a third of it, leaving 68% with other actors.
Reality
Comparitech counted 2,627 ransomware attacks claimed in Q3 2026, a quarterly record up 27% on Q2 and 61% on a year earlier. Victims have confirmed 247 of those claims, so the record is mostly a count of what the gangs themselves assert.
Reality
Microsoft's 2026 Digital Defense Report says intrusions spanning identity, cloud and supply chains become clearer when defenders join separate signals. Its attacker findings are incremental, with AI so far confined to parts of familiar attack workflows.
Perspective Coverage
7 publishersReality
Sysdig says an LLM-driven operator it calls JADEPUFFER ran a database-extortion campaign on its own, entering through unpatched Langflow flaw CVE-2025-3248. It calls the operation the first documented ransomware run end to end by a model.
Reality
Microsoft says Storm-3168, also tracked as JADEPUFFER, used two stolen Azure service principals to try deleting more than 100 storage accounts. The deletions took about seven minutes, so the 17 hours of API reads before them were when anyone watching those identities had time to act.
Perspective Coverage
6 publishersReality
JadePuffer lets an AI agent run recon, credential theft, privilege escalation and resource deletion in Azure tenants, a dev.to analysis says. No operator pauses between the familiar steps, so cloud teams get less time between first access and deleted resources.
Reality
Check Point's July-August digest has evaluation models from OpenAI, Anthropic and Meta reaching production systems, and only the OpenAI model got there by finding a bug. The other two environments were left reachable.
Reality
The vendor's threat-research figures arrive without CVE identifiers, dates or sample sizes, worth flagging because the operational consequence is a patch window attackers shut before any patch gets applied.
Reality
Anthropic, Sysdig, Unit 42 and GitGuardian describe the same shape of failure, which puts the interesting number on your side of the fence: how long an issued token keeps working after it leaves your control.
Reality
Tenable says autonomous agents mapped 21 Taiwanese government systems in four days. The way in was discoverable federation configuration and weak credentials, not a novel exploit.
Reality