World's First LLM Ransomware JADEPUFFER Attacks in 31 Seconds

Kaspersky’s Global Research and Analysis Team (GReAT) has identified 'SilverFox' as one of the most active cybercriminal groups in the Asia-Pacific (APAC) region. The group conducts long-term cyber espionage and sensitive data theft through fake websites, phishing emails, and malicious files distributed via social media. Kaspersky recently detected the group circulating fake Claude apps for Windows, macOS, and Linux.

eE Gene (Seth), Principal Security Researcher at Kaspersky GReAT, stated, "SilverFox is one of the most active groups in the APAC region. They primarily gain access to targets through fake websites, phishing emails, and malicious files distributed on social media. Malware is spread to conduct long-term cyber espionage and collect sensitive information. Our recent analysis shows they are now distributing fake Claude apps for Windows, macOS, and Linux. They are exploiting the growing use of AI tools in organizations to breach security systems."

The primary target of SilverFox is Greater China, accounting for over 90 percent of the group's total attacks, with 71 percent occurring in Mainland China alone. Significant attack trends have also been observed in Myanmar, Cambodia, and Singapore. While industrial sectors remain the primary targets, IT and services, healthcare, and financial sectors are also at risk.

eE Gene noted, "According to our current threat intelligence, Greater China is SilverFox's main target. Over 90 percent of the group's attacks occurred in this region, with 71 percent in Mainland China alone. Significant attacks are also happening in Myanmar, Cambodia, and Singapore. We must keep a close eye on these regions."

Meanwhile, Kaspersky warned of new cyber threats surrounding Agentic AI, citing 'JADEPUFFER' as an example—described as the world's first fully LLM-driven ransomware. According to Kaspersky, this malicious AI agent completed the entire process of detecting a failed attack, adapting its strategy, and launching a new attack in just 31 seconds.

eE Gene added, "In this incident reported by Sysdig, the malicious AI agent detected a failed attack, altered its strategy, and executed a new attack in just 31 seconds. This speed far exceeds the response capabilities of most human security personnel. Simultaneously, 'JADEPUFFER' demonstrated unprecedented autonomous capability. It can make independent decisions across various attack stages without direct supervision. In other words, the AI agent is acquiring the ability to analyze situations and make decisions like an experienced human attacker."

To counter such threats, Kaspersky recommended AI-driven proactive threat hunting, Zero Trust Architecture, integrated security across technological infrastructures, and increased utilization of AI in threat detection and response.

eE Gene further remarked, "When attackers use AI to automate decision-making processes and execute every stage of an attack rapidly, defenders must respond with the same level of intelligence. Cyber security solutions enriched with regularly updated threat intelligence are no longer an added advantage; they are essential for staying ahead of rapidly evolving threats."
//DBTech/CCSP/EMS/SME//