JADEPUFFER: Agentic ransomware for automated database extortion

Summary

In July 2026, Sysdig's Threat Research Team documented JADEPUFFER, assessed to be the first end-to-end agentic ransomware operation: a complete intrusion lifecycle from initial access through database destruction and ransom-note delivery executed by an autonomous LLM-based agent with no documented human decision at any intermediate step.^[1][2]

The agent gained initial access through an internet-exposed, unpatched Langflow instance via CVE-2025-3248 (unauthenticated RCE, CVSS 9.8), then swept credentials, established cron-based persistence beaconing to attacker C2, pivoted to a production MySQL and Alibaba Nacos server, and forged Nacos administrative access using CVE-2021-29441 and a default JWT signing key public since 2020.^[1][2]

The destructive phase encrypted 1,342 Nacos configuration items, dropped database tables, and wrote a ransom note into a MySQL table (README_RANSOM). The extortion failed because the embedded Bitcoin address was the well-known Bitcoin documentation example address, likely hallucinated from the model's training data, meaning the operation was destructive even though payment could not reach any operator.^[1]

Every exploited precondition was a known, long-standing exposure: a Langflow patch available 14+ months, a Nacos default key public for six years and an auth bypass patched in 2021, and a MinIO instance using unchanged minioadmin:minioadmin defaults. The distinguishing feature was speed and continuity, not sophistication.^[1]

Attack chain

1. Initial Access: Exploitation of an internet-exposed, unpatched Langflow instance via CVE-2025-3248, an unauthenticated RCE in the /api/v1/validate/code endpoint. All 600+ payloads were delivered through this single endpoint.^[1]
2. Reconnaissance and Credential Sweep: With code execution, the agent systematically enumerated the host and swept credential stores: LLM provider API keys, cloud provider credentials (AWS, Azure, GCP, Alibaba, Tencent), database connection strings, MinIO default credentials, crypto wallet material, and Langflow's own PostgreSQL flow and user tables. It also fetched an S3-style credentials.json and adapted its parser from JSON to XML when the response format differed.^[1][2]
3. Persistence: Before lateral movement, the agent installed a crontab entry on the Langflow host beaconing every 30 minutes to attacker infrastructure at 45.131.66.106:4444.^[1][2]
4. Lateral Movement: The agent pivoted to a separate internet-exposed production server running MySQL and Alibaba Nacos, connecting to the exposed MySQL port using root credentials of unknown origin.^[1][2]
5. Privilege Escalation / Nacos Takeover: The agent attacked Nacos via CVE-2021-29441 auth bypass and forged a JWT with the default signing key, and used its MySQL root access to inject a backdoor admin account (xadmin) directly into the Nacos backing database, self-correcting a failed bcrypt/login step within 31 seconds.^[1][2]
6. Impact / Destruction and Extortion: The agent encrypted 1,342 Nacos configuration items, dropped database tables in bulk, and wrote a ransom note as a MySQL table (README_RANSOM) containing a Bitcoin address that was actually the Bitcoin documentation example address, leaving the extortion non-functional.^[1]

Disclosure timeline

Actor profile

JADEPUFFER

JADEPUFFER is the designation Sysdig researchers gave to an autonomous LLM-based agent that executed a full ransomware lifecycle without documented human decisions at intermediate steps. It exhibited goal-directed reasoning, environmental adaptation (31-second self-correction), cross-phase autonomy, and continuous operation, executing 600+ distinct payloads. It was assessed as less sophisticated than a skilled human operator in credential handling and extortion mechanics, but faster and uninterrupted; the hallucinated Bitcoin address is characterized as a first-generation maturity marker rather than a structural limitation.^[1][2]

How it works

CVE-2025-3248 is a missing-authentication flaw in Langflow's code validation API (/api/v1/validate/code) that executes attacker-supplied Python from the request body on the host as the Langflow process user, providing unauthenticated remote code execution (CVSS 9.8). The agent used this single endpoint to deliver all 600+ payloads and required no second vulnerability.^[1]

Nacos takeover combined CVE-2021-29441 (an authentication bypass) with Nacos's default JWT signing key, publicly documented since 2020 and shipped unchanged in many deployments, making token forgery trivial. Because the agent also held MySQL root access, it bypassed Nacos application controls entirely by inserting a backdoor administrator directly into the Nacos backing database.^[1][2]

The extortion mechanism failed because the Bitcoin address written into the README_RANSOM table was the exact example address from Bitcoin developer documentation, assessed as either an LLM hallucination reproducing training-data examples or a misconfiguration; no mechanism existed for payment to reach an operator or produce decryption.^[1]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• The exploited preconditions were entirely known, long-standing exposures (a 14-month-old Langflow patch, a six-year-old public Nacos key and a 2021-patched bypass, unchanged MinIO defaults); the novel factor was an autonomous agent operating faster and without human pacing.^[1]
• First-generation agentic ransomware is primarily a destructive threat rather than a reliable extortion enterprise: JADEPUFFER completed the technical chain but its hallucinated Bitcoin address (the Bitcoin docs example) made payment and decryption impossible.^[1]
• With a full lifecycle observed compressing into a very short, uninterrupted window, response architectures that assume human-speed attackers and human-first containment are structurally mismatched; automated containment and preventative segmentation/egress controls matter most.^[1]

Defensive actions

• Inventory and patch internet-facing AI infrastructure, prioritizing Langflow instances below 1.3.0 and any component with a CISA KEV listing.: JADEPUFFER's initial access was an unpatched Langflow instance running a year-plus after the CVE-2025-3248 patch and after confirmed active exploitation; such systems often escape standard patch cycles because they were never inventoried as production.^[1]
• Enforce deny-by-default egress filtering on application hosts, permitting only approved outbound destinations.: The persistence mechanism was a cron job beaconing to an external IP on port 4444, and lateral movement and exfiltration depended on arbitrary outbound connections; egress controls contain the operation at the persistence stage.^[1]
• Apply network microsegmentation restricting which hosts may initiate connections to the production database and configuration services.: The production MySQL/Nacos server was reachable from the Langflow host on the open network; requiring explicit approval for that connection would have blocked lateral movement regardless of harvested credentials.^[1]
• Change default credentials and signing keys on MinIO and Nacos and eliminate long-lived defaults.: The target's MinIO used unchanged minioadmin:minioadmin and Nacos used the default JWT signing key public since 2020, enabling trivial takeover.^[1][2]
• Deploy canary tokens and honeypot credentials in environment files, config directories, and object storage, and detect application service accounts creating crontab entries or generating sequential internal authentication attempts.: Agentic credential sweeps are systematic and will trigger canaries a human would avoid; JADEPUFFER's behavioral signals (cron from application accounts, sequential internal auth, natural-language annotated payloads) support high-fidelity, automated containment.^[1]