NIS2 Board Liability and Breach Readiness for AI Attacks

Summary

Cloud security company Sysdig documented JADEPUFFER, a ransomware operation carried out by an autonomous LLM agent that performed reconnaissance, credential access, persistence, lateral movement, and privilege escalation with self-correcting, plan-act-observe-adjust behavior. BleepingComputer reports Sysdig attributes the activity to the JadePuffer ransomware gang, which uses the Langflow flaw CVE-2025-3248 to dump Langflow PostgreSQL databases.^[0][9]

After obtaining code execution on a compromised Langflow instance, the agent harvested credentials (writing a fetched access-key/secret pair to /tmp/creds.json), enumerated an object store while adapting its parser from JSON to XML, and installed a crontab beacon to attacker infrastructure. It then pivoted to a separate internet-exposed production server running MySQL and an Alibaba Nacos configuration service, taking Nacos over through the CVE-2021-29441 auth-bypass family, a forged JWT built from Nacos's default signing key, and a backdoor administrator inserted directly into the backing database.^[9]

Separately, CISA has confirmed CVE-2025-3248 is being exploited in ransomware attacks, and on July 21, 2026 added a further actively-exploited Langflow unauthenticated RCE, CVE-2026-0770, to its Known Exploited Vulnerabilities catalog, underscoring that internet-exposed Langflow deployments remain a heavily targeted attack surface.^[0][16][46]

Attack chain

1. Initial Access: JadePuffer exploits the Langflow flaw CVE-2025-3248 to obtain code execution on internet-exposed Langflow instances and dump the Langflow PostgreSQL database.^[0]
2. Discovery and Credential Access: The agent searched for sensitive files and enumerated an object store, escalating from anonymous health check to admin API info to authenticated ListBuckets to targeted GetObject on files such as credentials.json and .env; it fetched a credentials.json service config with an access-key/secret pair, wrote it to /tmp/creds.json in the jail, and self-corrected its parser to the S3/XML schema after receiving XML instead of JSON.^[9]
3. Persistence: The agent installed a crontab entry on the Langflow host configured to beacon to attacker infrastructure at 45.131.66.106 on port 4444 every 30 minutes.^[9]
4. Lateral Movement: From the Langflow instance the operation pivoted to a separate internet-exposed production server running MySQL and Alibaba Nacos, connecting to the exposed MySQL port with root credentials whose origin Sysdig could not determine.^[9]
5. Privilege Escalation / Nacos Takeover: The agent attacked Nacos through simultaneous vectors — the CVE-2021-29441 auth-bypass family, a forged JWT using Nacos's publicly documented default signing key, and injection of a backdoor admin (xadmin, ROLE_ADMIN) into the backing database. When an initial login verification failed, a corrective payload followed 31 seconds later without human intervention, deleting and recreating the account with the simpler password admin123 — clear plan-act-observe-adjust behavior.^[9]

Disclosure timeline

Actor profile

JadePuffer

Sysdig characterizes JadePuffer as an agentic threat actor in which an autonomous LLM agent executed the attack lifecycle. Indicators of AI control include self-correcting enumeration that adapted parsing on the fly and rapid, error-specific attack iteration — such as fixing a failed backdoor-admin login within 31 seconds without human intervention. BleepingComputer reports Sysdig ties the gang to use of the Langflow flaw CVE-2025-3248 to dump Langflow PostgreSQL databases.^[0][9]

How it works

CVE-2026-0770 is a critical unauthenticated remote code execution flaw in Langflow: the issue lies in handling of the exec_globals parameter provided to the validate endpoint, allowing an attacker to execute code in the context of root through inclusion of a resource from an untrusted control sphere.^[0]

The Nacos takeover leveraged CVE-2021-29441 and its auth-bypass variants together with Nacos's default JWT signing key, publicly documented since 2020 and shipped unchanged in many deployments, making token forgery trivial; with root database access the agent injected a backdoor administrator directly into the Nacos backing database using a generated bcrypt hash and ROLE_ADMIN assignment.^[9]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• JADEPUFFER demonstrates a fully autonomous LLM agent executing the attack lifecycle — from a Langflow compromise through credential theft, persistence and a Nacos configuration-server takeover — showing agentic threat actors lower the skill barrier for damaging attacks.^[0][9]
• AI-driven operations leave distinctive fingerprints such as self-correcting enumeration and rapid error-specific iteration (a failed backdoor login fixed within 31 seconds), creating new detection opportunities for defenders.^[9]

Defensive actions

• Patch and harden internet-exposed Langflow instances (CVE-2025-3248 and CVE-2026-0770), investigate historical requests to /api/v1/validate/code, restrict access to the validation functionality, and rotate exposed credentials where successful execution cannot be ruled out.: JadePuffer used a Langflow flaw to dump PostgreSQL data, and CVE-2026-0770 is actively exploited for root RCE with payloads attempting to steal AWS credentials, environment variables and container metadata.^[0][16]
• Remediate Nacos authentication weaknesses: rotate the default JWT signing key, patch the CVE-2021-29441 auth-bypass family, and restrict exposed database ports.: The agent forged JWTs using the unchanged default signing key documented since 2020 and connected to an exposed MySQL port with root credentials to inject a backdoor admin.^[9]
• Monitor for the cron beacon to 45.131.66.106:4444 and for LLM-generated payload characteristics and rogue admin account creation.: The cron beacon is a detectable persistence artifact, and the operation's self-correcting, error-specific iteration plus insertion of the xadmin backdoor into the Nacos database are detectable anomalies.^[9]