{
 "type": "bundle",
 "id": "bundle--23283601-43b4-56fd-8300-567963cce6d5",
 "objects": [
  {
   "type": "incident",
   "spec_version": "2.1",
   "id": "incident--f9ec04c5-9da4-500d-9994-948d1ddc6085",
   "created": "2026-06-01T00:00:00.000Z",
   "modified": "2026-06-01T00:00:00.000Z",
   "name": "Storm-3168 (JADEPUFFER): Agentic-driven cloud attacks using compromised service principals",
   "description": "Microsoft Security Research reported that JADEPUFFER (tracked as Storm-3168), previously described by Sysdig as the first documented agentic ransomware operation, used two compromised service principals in one Azure tenant. One performed reconnaissance and the other performed discovery, bulk resource deletion and storage key collection. Microsoft said the timing and division of work strongly indicated automated or scripted execution. Resource locks and deletion protection blocked some deletions, and SQL database deletions failed because of an unsupported API version.",
   "external_references": [
    {
     "source_name": "AgentDossier",
     "external_id": "TR-2026-015",
     "url": "https://sushegaad.github.io/AgentDossier/traces/tr-2026-015/"
    },
    {
     "source_name": "Dark Reading",
     "url": "https://www.darkreading.com/cloud-security/jadepuffer-ai-actor-azure-tenant-destructive-cloud-attack",
     "description": "JadePuffer AI Actor Compromises Azure Tenant in Destructive Cloud Attack"
    },
    {
     "source_name": "Microsoft Security",
     "url": "https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/",
     "description": "Storm-3168: agentic-driven cloud attacks using compromised service principals"
    },
    {
     "source_name": "Sysdig",
     "url": "https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion",
     "description": "JADEPUFFER: agentic ransomware for automated database extortion"
    },
    {
     "source_name": "CSO Online",
     "url": "https://www.csoonline.com/article/4193195/this-ai-agent-autonomously-hacked-a-network-adapted-on-the-fly-and-demanded-a-ransom.html",
     "description": "This AI agent autonomously hacked a network, adapted on the fly, and demanded a ransom"
    }
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--e63ee52d-ba86-59cd-96a6-45b5fa0e2965",
   "created": "2026-06-01T00:00:00.000Z",
   "modified": "2026-06-01T00:00:00.000Z",
   "name": "JADEPUFFER / Storm-3168, a threat actor reported as an agentic ransomware operation using compromised service principals and automated tooling",
   "roles": [
    "attacker"
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--b2f625fd-d6d6-5115-9a66-7ded8e962965",
   "created": "2026-06-01T00:00:00.000Z",
   "modified": "2026-06-01T00:00:00.000Z",
   "name": "An unnamed organization's Azure tenant, with Microsoft Security Research investigating",
   "roles": [
    "defender"
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--79f090cd-5dc0-543d-a988-10a55d882425",
   "created": "2026-06-01T00:00:00.000Z",
   "modified": "2026-06-01T00:00:00.000Z",
   "name": "TA0006 Credential Access",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0006"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--e6260d6d-ea9e-5145-ae26-c5fd720e09a5",
   "created": "2026-06-01T00:00:00.000Z",
   "modified": "2026-06-01T00:00:00.000Z",
   "name": "TA0007 Discovery",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0007"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--a48e3b81-acc2-5bad-a416-fbd90cfaab75",
   "created": "2026-06-01T00:00:00.000Z",
   "modified": "2026-06-01T00:00:00.000Z",
   "name": "TA0009 Collection",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0009"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--5b3c92d1-b318-5a95-a3dc-1af17b882205",
   "created": "2026-06-01T00:00:00.000Z",
   "modified": "2026-06-01T00:00:00.000Z",
   "name": "TA0040 Impact",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0040"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--eeb6edc5-0ab6-59f5-9636-6545c2e641a5",
   "created": "2026-06-01T00:00:00.000Z",
   "modified": "2026-06-01T00:00:00.000Z",
   "name": "TA0043 Reconnaissance",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0043"
    }
   ]
  }
 ]
}