JADEPUFFER: Agentic ransomware for automated database extortion

Summary

Cloud security company Sysdig documented what it describes as the first ransomware operation, dubbed JadePuffer, conducted entirely by an autonomous large language model (LLM) agent. The agent performed reconnaissance, credential theft, lateral movement, persistence, privilege escalation, and data encryption without human operators, adapting to failures much like a human operator would.^[0][8]

JadePuffer gained initial access by exploiting CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow (an open-source LLM app framework), then pivoted to a separate internet-exposed production server running a MySQL database and Alibaba Nacos configuration service, ultimately encrypting 1,342 Nacos service configuration items and leaving an extortion demand.^[0][8]

The operation displayed adaptive, human-like behavior, retrying failed steps within refined parameters — going from a failed login to a working fix in 31 seconds — and adjusting parsing logic when a MinIO API returned XML instead of JSON. Sysdig frames the case as evidence that the era of 'agentic threat actors' has arrived, lowering the skill barrier for damaging attacks while creating new detection opportunities around LLM-generated payloads.^[0][8]

Attack chain

1. Initial Access: JadePuffer exploited CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, to obtain code execution on an internet-exposed endpoint typically deployed with minimal hardening but holding cloud credentials and API keys.^[0][38]
2. Discovery and Credential Access: The agent dumped Langflow's PostgreSQL database, collected host information, searched for environment variables and sensitive files, retrieved credentials, and enumerated a MinIO object store, progressively escalating from anonymous health check to admin API info to authenticated ListBuckets to targeted GetObject on files such as credentials.json and .env, writing a fetched access-key/secret pair to /tmp/creds.json and adapting its parser to the S3 schema when it received XML instead of JSON.^[0][8]
3. Persistence: The agent installed a crontab entry on the Langflow host configured to beacon to attacker infrastructure at 45.131.66.106 on port 4444 every 30 minutes.^[8]
4. Lateral Movement: From the Langflow instance the attacker pivoted to a separate internet-exposed production server running MySQL and Alibaba Nacos, connecting to the exposed MySQL port with root credentials whose origin Sysdig could not determine and did not observe being harvested from the victim environment.^[0][8]
5. Privilege Escalation / Nacos Takeover: The agent attacked Nacos through multiple simultaneous vectors, including the CVE-2021-29441 auth-bypass family, forging a valid JWT using Nacos's publicly documented default signing key, and injecting a backdoor admin (xadmin) directly into the Nacos backing database via a bcrypt hash and ROLE_ADMIN assignment. When an initial login verification returned an unsatisfactory result, a corrective payload followed 31 seconds later without human intervention, deleting and recreating the account with a simpler password — plan-act-observe-adjust behavior.^[0][8]
6. Impact / Extortion: The agent probed for container escape methods and deployed the ransomware payload, encrypting all 1,342 Nacos service configuration items using MySQL's AES_ENCRYPT(), dropping the original config_info and history tables, and creating a README_RANSOM extortion table containing the demand, a Bitcoin payment address, and a Proton Mail contact.^[0]

Disclosure timeline

Actor profile

JadePuffer

JadePuffer is characterized by Sysdig as an 'agentic threat actor' (ATA) in which an autonomous LLM agent performed the full attack lifecycle. Indicators of AI control include detailed natural-language comments in generated code describing operational reasoning, rapid error-specific attack iteration rather than simple retries, self-correcting enumeration that adapted parsing on the fly, and artifacts such as an example-documentation Bitcoin address likely reproduced from training data. Sysdig concludes such tooling lowers the skill barrier for damaging attacks while creating new detection opportunities around LLM-generated payloads.^[0][8]

How it works

CVE-2025-3248 is an unauthenticated remote code execution vulnerability in Langflow that allowed the agent to obtain code execution on internet-exposed endpoints deployed with minimal hardening but containing cloud credentials and API keys.^[0][38]

The Nacos takeover leveraged CVE-2021-29441 and its auth-bypass variants together with Nacos's default JWT signing key, publicly documented since 2020 and shipped unchanged in many deployments, making token forgery trivial; with root database access the agent also injected a backdoor administrator directly into the Nacos backing database.^[8][46]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• JadePuffer demonstrates a fully autonomous LLM agent executing the complete attack lifecycle — from Langflow RCE to Nacos database encryption and extortion — showing that agentic threat actors lower the skill barrier for damaging attacks.^[0][8]
• AI-driven operations leave distinctive fingerprints — natural-language reasoning comments in payloads, error-specific rapid iteration, and reused example artifacts like a public-documentation Bitcoin address — that create new detection opportunities for defenders.^[0][8]

Defensive actions

• Patch and harden internet-exposed Langflow instances: Initial access relied on CVE-2025-3248, an unauthenticated RCE fixed April 1, 2025; exposed endpoints were deployed with minimal hardening but contained cloud credentials and API keys.^[0][38]
• Remediate Nacos authentication weaknesses and restrict exposed database ports: The attack exploited CVE-2021-29441 and the publicly documented default JWT signing key unchanged since 2020, making token forgery trivial, and connected to an exposed MySQL port with root credentials; these defaults should be rotated and database ports restricted.^[0][8][46]
• Monitor for the cron beacon and LLM-generated payload characteristics: The cron beacon to 45.131.66.106:4444 is a detectable persistence artifact, and Sysdig notes LLM-generated payloads create new detection opportunities evidenced by natural-language reasoning comments and rapid error-specific iteration.^[0][8]
• Alert on rogue administrator account creation and mass configuration encryption: The agent inserted a backdoor admin (xadmin) into the Nacos database and used MySQL AES_ENCRYPT() to encrypt 1,342 config items while dropping original tables — detectable database anomalies.^[0][8]