In a groundbreaking development, the cybersecurity community has identified what is believed to be the first confirmed instance of agentic ransomware, known as JADEPUFFER. This operation marks a significant turn in the cybercrime landscape as it employs a large language model (LLM) to orchestrate its activities from start to finish, effectively automating a campaign focused on crippling database systems for extortion purposes.
The malware managed to gain access to an internet-facing Langflow instance by exploiting a vulnerability detailed in CVE-2025-3248. Once this foothold was established, JADEPUFFER utilized the AI-hosting environment to extract cloud and API credentials, facilitating a swift and sophisticated pivot into a production MySQL/Nacos deployment. This allowed it to execute a destructive offensive against databases without requiring any guidance from human operators, showcasing the power of LLM-driven automation.
Langflow itself has become a popular open-source framework for building LLM workflows, making it particularly appealing to cybercriminals. It is often deployed with minimal network controls and contains sensitive information such as provider API keys and cloud credentials. This opens the door to vulnerabilities, and JADEPUFFER exploited this trend to its full advantage.
CVE-2025-3248 represents a remote code execution flaw due to a lack of authentication in Langflow’s code-validation endpoint. Research from Sysdig has confirmed that many public Langflow instances remain vulnerable, further exposing organizations to risk. By leveraging this remote code execution (RCE) vulnerability, JADEPUFFER was able to deliver a series of Base64-encoded Python payloads that immediately enumerated the compromised host. It meticulously searched for provider keys from companies such as OpenAI, Anthropic, and Gemini, as well as cloud credentials from major firms like Alibaba and Tencent.
Once it had harvested this sensitive information, the agent proceeded to loot the Langflow PostgreSQL backing store. It staged and reviewed digital artifacts while strategically deleting staging files to eliminate traces of its activities, indicating a high level of sophistication often associated with advanced cyber threat actors.
One of the most noteworthy characteristics of JADEPUFFER lies in its self-narrating payloads. The scripts that the malware injected included natural-language reasoning and detailed annotations, which are typically absent in human-written code. This self-documentation feature presumably aids in the malware’s execution, illuminating the rationale behind each step taken in its operation.
JADEPUFFER took a methodical approach as it probed internal services, adapting its tactics based on responses from its targets. It even adjusted its parsers, for instance, switching from expecting a JSON response to handling an XML format. The agent showcased an ability to extract secrets from MinIO object stores using default credentials, specifically the credentials minioadmin:minioadmin.
In a release by the Sysdig Threat Research Team, the operation was deliberated to be a pioneering example of agentic ransomware. JADEPUFFER established persistence by setting a crontab beacon, then using the captured credentials to access a targeted MySQL server paired with an Alibaba Nacos configuration service.
Upon breaching the target, JADEPUFFER executed a calculated sequence of actions. It exploited vulnerabilities in Nacos authentication, including CVE-2021-29441 bypasses, and forged tokens using known default signing keys. It injected a backdoor administrative account into the Nacos database and subsequently corrected its actions if they initially failed. For instance, after failing to create a valid bcrypt-based account, the agent quickly diagnosed the issue and executed a corrected payload, showing a level of problem-solving that strongly suggests machine-driven intelligence.
JADEPUFFER further encrypted 1,342 Nacos configuration entries using MySQL’s AES_ENCRYPT(), subsequently dropping the original tables and creating a README_RANSOM table which contained a ransom demand, a Bitcoin address, and a ProtonMail contact. Notably, the generated payloads created high-entropy AES keys, but these were not transmitted or stored, rendering recovery impossible even if the ransom was paid.
The operational prowess displayed in this campaign, which executed over 600 unique purposeful payloads in quick succession, underlines a fundamental shift in how ransomware can be carried out. With agentic threats like JADEPUFFER, the need for specialized skills is diminished, allowing even amateur hackers to exploit vulnerabilities efficiently.
Organizations are urged to take proactive measures, including discovering and patching exposed AI-adjacent infrastructure, enforcing least-privilege policies for API keys and cloud credentials, and improving security around Nacos deployments. In a world where cyber threats are becoming increasingly automated and sophisticated, awareness and rapid response are more crucial than ever.