JADEPUFFER: Agentic ransomware for automated database extortion

Summary

JADEPUFFER, tracked by Microsoft as Storm-3168 and reported as the first documented agentic (LLM-orchestrated) ransomware operation, conducted destructive operations inside a Microsoft Azure environment using compromised service principals in early June 2026. The activity targeted Azure Storage Accounts, SQL databases, Key Vaults, Function Apps, recovery protection locks, Virtual Machines, and App Services, and Microsoft characterized it as an evolution of the actor's cloud tradecraft.^[0][11]

Two compromised service principals in the same tenant divided the work: one performed about 15.5 hours of reconnaissance with 300+ read operations, while the second executed 150+ destructive or credential-collection operations in 35 minutes, including a roughly seven-minute burst of 100+ storage account deletion attempts. Microsoft assessed the operation as ransomware-aligned, aimed at impairing recovery, though no ransom note or confirmed exfiltration was observed.^[0]

Sysdig's original reporting details the actor's end-to-end agentic operation: an LLM-driven agent compromised an internet-exposed Langflow instance, iteratively and self-correctingly enumerated credentials, established crontab persistence beaconing to 45.131.66[.]106, and pivoted to an intended target running MySQL and an Alibaba Nacos configuration service, which it took over via the CVE-2021-29441 auth-bypass family, default JWT signing-key forgery, and direct backdoor-admin injection.^[11][39]

Attack chain

1. Initial access via exposed credentials and exposed applications: The Azure service principal's client ID, client secret, and tenant ID were exposed in plaintext in a public GitHub issue and remained retrievable via the issue's public edit history even after editing. In parallel, Storm-3168-linked infrastructure repeatedly probed internet-exposed applications, and Sysdig observed an LLM-driven agent compromising an internet-exposed Langflow instance.^[0][11]
2. Agentic credential enumeration and persistence (Langflow host): On the compromised Langflow server, the LLM agent escalated progressively from anonymous health checks to authenticated ListBuckets and targeted GetObject calls on files named like credentials, retrieving a credentials.json access-key/secret pair saved to /tmp/creds.json, then installed a crontab entry beaconing to 45.131.66[.]106:4444 every 30 minutes.^[11]
3. Pivot to intended target (Nacos/MySQL): Captured payloads show the agent connecting to a separate internet-exposed production server's exposed MySQL port with root credentials and attacking the Alibaba Nacos configuration service through multiple vectors simultaneously — the CVE-2021-29441 auth-bypass family, forging a valid JWT with Nacos's well-known default signing key, and injecting a backdoor administrator (xadmin) directly into the Nacos backing database with autonomous corrective behavior.^[11][39]
4. Azure reconnaissance and resource discovery: Using compromised service principals, the actor enumerated Azure VMs, subscriptions, resource groups and resources for about 15.5 hours with 300+ read operations; a second principal rapidly enumerated VMs and resource groups across two subscriptions and later enumerated App Service configuration stores, possibly seeking exposed credentials.^[0]
5. Destructive impact and credential collection (Azure): The second service principal ran a ~7-minute destructive burst of 100+ storage account deletion attempts plus deletion of a Key Vault, Function App, and App Service plan, parallel Azure SQL deletion attempts, and attempts against Site Recovery and Azure Backup protection locks; about 30 minutes later it issued 30+ successful ListKeys requests to harvest storage account access keys.^[0]

Disclosure timeline

Actor profile

JADEPUFFER (Microsoft: Storm-3168)

JADEPUFFER, discovered by Sysdig in July 2026, is reported as the first documented agentic ransomware operation, using an LLM to autonomously enumerate credentials, establish persistence, and take over an Alibaba Nacos configuration service / MySQL database with plan-act-observe-adjust behavior. Microsoft tracks the actor as Storm-3168 and documented an evolution into Azure, where compromised service principals carried out destructive resource operations and credential collection that Microsoft assesses as ransomware-aligned. The operations across multiple service principals and overlapping token streams strongly indicate automated or scripted execution, and Storm-3168-linked infrastructure repeatedly probed multiple customers' Azure App Services.^[0][11]

How it works

The core enabling weakness of the Azure activity was credential exposure rather than a software flaw: the service principal's client ID, client secret, and tenant ID were leaked in plaintext in a public GitHub issue and remained retrievable through the issue's public edit history after the secret was removed, granting valid identity credentials whose operations followed the identity's existing Azure RBAC role assignments.^[0]

Destructive actions were bounded by independent Azure safeguards: resource locks and storage account-level deletion protection prevented deletion of some storage accounts despite the compromised identity's broad permissions, and Azure SQL database deletion attempts failed because the attacker used an unsupported API version for the Azure SQL Database resource type.^[0]

In the Nacos/MySQL phase, the agent exploited the Nacos authentication-bypass family (CVE-2021-29441 and related variants) and forged valid JWTs using Nacos's well-known default signing key — publicly documented since 2020 and shipped unchanged in many deployments — and, with root database access, injected a backdoor administrator directly into the Nacos backing database.^[11][39]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• JADEPUFFER demonstrates AI-orchestrated, self-correcting post-compromise operations that coordinate reconnaissance, persistence, and destruction across cloud environments with greater speed and scale than manual operators.^[0][11]
• Leaked service principal credentials remain a viable initial access path even after brief exposure and deletion because of retained public edit history; exposure must trigger immediate rotation or revocation.^[0]
• Independent safeguards — Azure resource locks, storage account deletion protection, and API version constraints — materially limited destructive impact even when the attacker held broad administrative permissions.^[0]

Defensive actions

• Enable Azure resource locks and storage account-level deletion protection on critical resources, and closely monitor attempts to modify or remove recovery protection controls.: These independent safeguards blocked deletion attempts for some storage accounts even when the compromised identity held broad administrative permissions, and the actor targeted Site Recovery and Azure Backup protection locks to impair recovery.^[0]
• Treat any publicly exposed service principal credentials or secrets as compromised, rotate or revoke them immediately, and account for edit history, caches, and archives.: The compromised service principal's credentials were leaked in plaintext in a public GitHub issue and remained usable through the issue's public edit history after the secret was removed; removing the disclosure does not invalidate the credential.^[0]
• Apply least privilege to service principals and monitor for anomalous high-volume enumeration and rapid destructive API activity across subscriptions.: The destructive operations followed the identity's existing RBAC role assignments and showed automated patterns — 300+ reads over ~15.5 hours and 150+ destructive/credential operations in 35 minutes — consistent with scripted or agentic execution.^[0]
• Harden and patch internet-exposed Nacos and Langflow deployments, rotating default JWT signing keys and removing exposed database/root credentials.: The JADEPUFFER agent compromised an exposed Langflow instance and pivoted to a Nacos/MySQL server via the CVE-2021-29441 auth-bypass family and the unchanged default JWT signing key, injecting a backdoor administrator.^[11][39]
• Block and hunt for the identified Storm-3168-linked IP addresses in App Service, ARM, and outbound beaconing logs.: 45.131.66[.]106, 34.153.223[.]102, and 64.20.53[.]230 were associated with App Service probing, malicious ARM requests, and crontab beaconing.^[0][11]

Changelog

• Added detailed attack-chain mechanics from Sysdig's original reporting: LLM-driven agentic credential enumeration on a compromised Langflow host, crontab persistence beaconing to 45.131.66[.]106:4444, and takeover of an intended Nacos/MySQL target via the CVE-2021-29441 auth-bypass family, default JWT signing-key forgery, and backdoor-admin injection.^[11][39]
• Added network IOCs (45.131.66[.]106, 34.153.223[.]102, 64.20.53[.]230) and corroborated 45.131.66[.]106 across both the Microsoft Azure activity and the Sysdig Langflow beacon.^[0][11]
• Removed the previously asserted CVE-2025-3248 (Langflow) attribution for initial access, which is not grounded in the available evidence bodies; the Nacos exploitation (CVE-2021-29441) is the grounded vulnerability in the captured payloads.^[11][39]