Malware

Jade Puffer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

it helped itself to passwords, account details, API keys for OpenAI and Anthropic and Google Gemini... And then it moved on to its real target, which was the company's production database. And it tried to create a hidden admin account for itself

T1190Exploit Public-Facing ApplicationEvidence1

Apparently they had some software with a known security flaw. There'd been a patch out for at least a year. They hadn't patched it. And it was internet-facing. So Jade Puffer was able to get in

Persistence

2 techniques

T1078Valid AccountsEvidence1

T1136Create AccountEvidence1

And it tried to create a hidden admin account for itself to access that database

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

Stealth

1 technique

T1078Valid AccountsEvidence1

Impact

1 technique

T1486Data Encrypted for ImpactEvidence1

Encrypted all the items in the database, deleted the originals, so the data is now gone. So it's been held hostage | Sysdig have just published what they're calling the first documented case of fully autonomous AI-driven ransomware... It finds a way in, it steals passwords, it breaks into secondary servers, it encrypts the data, it leaves a ransom note demanding bitcoin

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

grahamcluleyNews

Jul 8, 2026

Smashing Security podcast #475: JadePuffer - the AI that ran a ransomware attack all by itself • Graham Cluley

An AI-driven ransomware strain described as operating autonomously end-to-end: gaining access via an unpatched internet-facing flaw, stealing passwords, account details, API keys, cloud credentials, and cryptocurrency seed keys, moving to a production database, encrypting data, deleting originals, and leaving a ransom note. The reported sample contained operational flaws, including failure to return the decryption key and use of a generic example Bitcoin address.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Jade Puffer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

T1190Exploit Public-Facing ApplicationEvidence1

Apparently they had some software with a known security flaw. There'd been a patch out for at least a year. They hadn't patched it. And it was internet-facing. So Jade Puffer was able to get in

Persistence

2 techniques

T1078Valid AccountsEvidence1

T1136Create AccountEvidence1

And it tried to create a hidden admin account for itself to access that database

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

Stealth

1 technique

T1078Valid AccountsEvidence1

Impact

1 technique

T1486Data Encrypted for ImpactEvidence1

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

grahamcluleyNews

Jul 8, 2026

Smashing Security podcast #475: JadePuffer - the AI that ran a ransomware attack all by itself • Graham Cluley

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.