JADEPUFFER
Named by 5 kept items in this workspace.
4 items name it under threat actors and 1 under classification.key entities.
Search every workspace for JADEPUFFER. It matches the name as written, so it can find other things that share it.
The items that name it 5
Associated with Storm-3168, conducting destructive operations in Azure environments.
Threat actor discovered by Sysdig in July 2026, reported to be the first documented agentic ransomware operation; conducted Azure-focused resource destruction and credential collection using compromised service principals, consistent with ransomware/extortion-aligned tactics.
Codename for the first known case of agentic ransomware, where a human operator deployed an AI agent and provisioned infrastructure to let the agent handle an entire extortion operation from start to finish by exploiting CVE-2025-3248 in Langflow, documented by Sysdig.
Name given by Sysdig's Threat Research Team to the operator/attack it says is the first ransomware attack run start-to-finish by an AI agent (a large language model), which exploited CVE-2025-3248 in Langflow, stole credentials, moved laterally, and encrypted/wiped a company's production database.
All threat actors in this workspace.