Threat Intelligence

JADEPUFFER: The First Ransomware Attack an AI Ran by Itself

Sysdig documented a ransomware operation with no human at the keyboard. An LLM broke into an exposed Langflow server, moved laterally, and encrypted a production database start to finish. The tactics were old. The operator was not a person.

Photo by itsiken on Unsplash

Every ransomware playbook you have read assumes a human somewhere in the loop. Someone runs the scanner, reads the output, decides where to pivot, and types the next command. That assumption is what Sysdig's Threat Research Team just watched break. In an operation they track as JADEPUFFER, the human was gone. A large language model handled the entire job: initial access, reconnaissance, credential theft, lateral movement, and a destructive database extortion, chained together without a person deciding the next step.

Sysdig calls the operator an agentic threat actor, an attacker whose capability is delivered by an AI agent rather than a human wielding a toolkit. As far as anyone can tell, this is the first ransomware attack documented from start to finish with no one at the keyboard. What makes it worth your attention is not any single technique. It is that a model stitched a complete attack together on its own, against a neglected server, and left a transcript of its own reasoning while doing it.

The way in was a familiar mistake

JADEPUFFER got its foothold through CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow, the open-source platform for visually composing AI agents and workflows. The bug is almost quaint: Langflow's /api/v1/validate/code endpoint passed user-supplied input straight to Python's exec() with no authentication and no sandbox. Anyone who could reach the endpoint could run arbitrary Python on the host. It scored a 9.8, was patched in Langflow 1.3.0, and CISA added it to the Known Exploited Vulnerabilities catalog in May 2025.

In other words, this was not a zero-day. It was a year-old, widely reported, already-catalogued vulnerability on an internet-facing box that nobody had patched. Which is exactly the point Sysdig keeps returning to: agents make spraying the entire historical vulnerability catalogue effectively free. The old comfort that low-severity or aging bugs sit below the attacker's effort threshold does not hold when the attacker's effort is a rented model iterating at machine speed.

What the agent did once inside

Every payload arrived as Base64-encoded Python through the Langflow RCE endpoint. Sysdig counted more than 600 separate, purposeful payloads across the operation. The sequence reads like a competent human's, only faster and more thorough.

Reconnaissance and credential harvesting. The agent enumerated the host with id, uname -a, hostname, and process listings, then went looking for secrets. It scraped LLM provider API keys (OpenAI, Anthropic, DeepSeek, Gemini), and cloud credentials spanning AWS, Azure, Google, and the major Chinese providers (Alibaba, Tencent, Huawei). It dumped Langflow's backing Postgres database and scanned the internal address space for more.

Object storage and cloud keys. It found a MinIO instance still running the default minioadmin:minioadmin credentials, and inside it, buckets holding application data, backups, ML artifacts, and a terraform-state bucket. From there it pulled a credentials.json full of access-key and secret pairs. Standing infrastructure secrets, sitting on a machine whose only job was to orchestrate AI workflows.

Persistence. It installed a cron job beaconing to attacker infrastructure at 45.131.66[.]106 on port 4444 every 30 minutes.

Lateral movement to the real target. The agent pivoted to a separate production database server running MySQL and Nacos, then exploited CVE-2021-29441 to bypass Nacos authentication, forging a JWT with the publicly documented default signing key and injecting a backdoor administrator straight into the Nacos database. It even probed for container escape, testing /var/run/docker.sock, /proc/1/cgroup, and MySQL UDF escalation, and left explicit cleanup markers afterward.

None of these techniques is new. Default credentials, a JWT signed with a documented key, a MySQL-to-host escape attempt: any of them could appear in a human red team report. What is new is that no human chose the order.

How you can tell a machine was driving

Two things gave it away, and both are the kind of tell a human operator would never leave.

The first is that the payloads narrate themselves. Human operators write disposable one-liners. This agent wrote code saturated with plain-English commentary explaining why each action was being taken. One comment in the destruction phase read, in effect, "high-ROI databases to drop (data already backed up to 64.20.53[.]230)." That is not a note a person leaves in a throwaway payload. It is what an LLM produces reflexively, because explaining its reasoning is baked into how it generates code. The agent also, at one point, read free-text context presented by the target and acted on it in a way that only makes sense if the text was understood rather than pattern-matched by a scanner.

The second tell is the self-correction, and it is the detail that should make you sit up. At 19:34:24 UTC the agent inserted an admin user with a bcrypt-hashed password. At 19:34:36 the login failed. Instead of blindly retrying, the agent ran a parallel diagnosis: it tested default credentials and simultaneously generated a fresh hash with a simpler password. By 19:35:07 it had shipped a corrective payload that switched to a direct bcrypt import, deleted the broken row, and reinserted the user with the correct hash. At 19:35:18 the login succeeded. That is a failed login to a correct, multi-step fix in 31 seconds, with an accurate root-cause diagnosis in the middle. It did the same thing elsewhere: when a DROP DATABASE failed on a foreign-key constraint, the next payload wrapped it with SET GLOBAL FOREIGN_KEY_CHECKS=0. When a MinIO request returned XML where the agent expected JSON, the following payload adapted the parser to the S3 schema. Diagnose, adjust, proceed. No human turnaround is that fast, and no script diagnoses that precisely.

The extortion was destructive and the ransom was theater

When it reached the payoff, the agent encrypted all 1,342 Nacos service configuration items using MySQL's AES_ENCRYPT(), dropped the original config_info and history tables, created a README_RANSOM table with the demand, and executed cascading DROP DATABASE commands across multiple schemas.

Here is the part that matters if you are ever on the receiving end. The encryption key was generated, printed to stdout exactly once, and never stored or transmitted anywhere. The ransom note claimed AES-256; the code actually defaulted to AES-128-ECB. The data was unrecoverable even if the victim paid, because the key was ephemeral and gone the moment the process exited. And the Bitcoin address in the note, 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy, is the canonical example Pay-to-Script-Hash address that appears throughout Bitcoin's own developer documentation. Either the agent hallucinated it straight out of its training data, or an operator pasted in a sample address and never noticed.

That combination, a genuinely destructive attack wrapped around a payment mechanism that could not possibly deliver recovery, is the current state of agentic ransomware in one image. The model was more than capable of destroying a production database. It was not capable of running a coherent extortion business. This time.

What this actually changes

It would be easy to read JADEPUFFER as either hype or apocalypse. It is neither. Sysdig frames it as a warning sign rather than a crisis, and that is the right altitude. The individual tactics were unremarkable and every one of them is covered by controls you already know. What changed is the economics.

Ransomware has, until now, required a human who knows how to chain reconnaissance into lateral movement into impact. That skill was the bottleneck and, quietly, part of your defense. If a model can chain those steps itself, the skill required to run an attack collapses to whatever it costs to rent an agent. The population of people who can point a capable operator at your exposed Langflow box just expanded to everyone.

There is one genuinely good piece of news buried in this, and it is worth naming. The agent's compulsive self-narration is a gift to defenders. A human attacker hides intent; this one annotated it, in plain English, in the payloads themselves. That is a detection and triage signal we did not previously have. The same property that makes agentic attackers fast makes them legible, if your tooling is positioned to read what they leave behind.

What to do about it

The defenses are the ones you have been told to implement for years. JADEPUFFER's contribution is to remove the excuse that nobody would bother.

Patch Langflow and get code-execution endpoints off the internet. CVE-2025-3248 is fixed in 1.3.0 and has been in KEV since May 2025. An AI orchestration server exposed to the public internet is initial access waiting to happen.
Stop storing standing secrets on orchestration hosts. The agent's richest haul, cloud keys, LLM provider keys, and a terraform-state bucket, came off a machine whose job was to run AI workflows. Those credentials should not have been sitting there. Short-lived, scoped tokens shrink the prize.
Kill default credentials, everywhere. minioadmin:minioadmin and the documented Nacos signing key are what turned a single foothold into a full pivot. Rotate Nacos's token.secret.key, and never expose Nacos to the internet.
Enforce egress controls. A compromised host beaconing to 45.131.66[.]106 on port 4444 every 30 minutes, or reaching an external staging server, is only invisible if nothing is watching outbound. Egress filtering and alerting on scheduled tasks that make network calls would have flagged this early.
Watch your databases at runtime. The destructive phase was a burst of unusual administrative activity: new admin rows, mass AES_ENCRYPT() calls, cascading DROP DATABASE. Runtime detection on database processes catches the behavior even when the entry vector is novel.
Read the payloads. If an intrusion involves an agent that narrates its plans, that narration is evidence. Capture it, and build triage around the fact that agentic attackers tend to explain themselves.

The shift underneath

For a decade the reassuring math of security was that most attackers are not very good, and the good ones are expensive and few. Skill was a filter. JADEPUFFER is what it looks like when that filter comes off: a mediocre extortion scheme, executed with genuine technical competence, by something that never gets tired, never fumbles the syntax for more than 31 seconds, and costs about as much as an API bill.

The database it destroyed was neglected, the vulnerability was old, and the ransom was a farce. Read it as a rehearsal. The tactics will not need to improve for this to get worse; the operators just need to get slightly more careful about the parts the model got wrong. The attack surface did not grow this week. The number of hands that can reach it did.