Security researchers at the Sysdig Threat Research Team (TRT) have uncovered JADEPUFFER, the first documented case of an agentic ransomware threat actor.
Unlike normal ransomware that follows predefined scripts and manual attack workflows, JADEPUFFER uses Large Language Models (LLMs) to independently reason, adapt to errors, steal credentials, and execute database extortion without intervention.
Key Highlights
- First Fully Autonomous Ransomware: JADEPUFFER is classified as an Agentic Threat Actor (ATA), driven end-to-end by an LLM rather than human operators.
- Initial Access via AI Tooling: The attackers gained initial entry by exploiting CVE-2025-3248, an unauthenticated remote code execution (RCE) flaw in Langflow (an open-source AI application builder).
- Self-Narrating & Self-Correcting Code: The malware generated Python payloads with embedded reasoning comments and dynamically adapted when errors occurred (e.g., automatically fixing failed password hashes in 31 seconds).
- Multi-Cloud Credential Harvesting: JADEPUFFER actively searched memory and configuration files for API keys across OpenAI, Anthropic, Gemini, AWS, GCP, Azure, and Chinese cloud providers (Alibaba, Tencent, Huawei).
- Targeted Extortion: After looting the Langflow deployment and internal MinIO object storage, JADEPUFFER pivoted to a target database server running MySQL and Alibaba Nacos, inserting backdoors and executing database extortion.
How JADEPUFFER Operates: Step-by-Step Attack Flow
Phase 1: Entry and Micro-Reconnaissance
- RCE via Langflow (CVE-2025-3248): Langflow instances often host sensitive provider keys and database connections. JADEPUFFER targeted an internet-facing Langflow node using missing-authentication flaws to execute Base64-encoded Python payloads.
- Parallel Secret Sweeping: Once inside, the AI agent swept the environment for:
- LLM API Keys: OpenAI, Anthropic, DeepSeek, Gemini.
- Cloud Credentials: AWS, GCP, Azure, and Chinese cloud platforms (Alibaba, Tencent, Huawei).
- Crypto & Database Credentials: Seed phrases, `.env` files, and local Postgres dumps.
- S3/MinIO Object-Store Enumeration: The agent discovered internal MinIO storage (`minioadmin:minioadmin`), fetched configuration files like `credentials.json`, and parsed XML responses using self-correcting logic.
- Persistence: The agent planted a crontab entry on the host to beacon back to attacker infrastructure every 30 minutes.
Phase 2: Autonomous Pivot & Database Backdooring
- Targeting Production Databases: Using stolen artifacts, JADEPUFFER pivoted to an exposed production host running MySQL and Alibaba Nacos.
- Real-Time Error Handling: When a backdoor administrator creation failed on Nacos due to password hashing issues, the LLM detected the failure, deleted the invalid record, re-generated a compliant hash, and verified login—all within 31 seconds without human involvement.
- Database Extortion: After securing full administrative control, JADEPUFFER executed its automated database-extortion playbook against the production MySQL tables.
Technical Assets
Below are the key Indicators of Compromise (IOCs) and a detection policy rule based on the JADEPUFFER analysis:
| Type | Indicator / Pattern | Context |
| Network C2 | 45.131.66[.]106:4444 |
External IP used for HTTP beacons (/beacon) via crontab |
| Vulnerability |
|
Unauthenticated RCE endpoint in exposed Langflow instances |
| Backdoor Creds |
|
Backdoor account injected directly into Nacos / MySQL user tables |
| File Artifacts |
|
Staged credential output and container escape probe text |
| Commands |
|
Persistent crontab entry planted on initial access hosts |
Why Agentic Ransomware Changes the Cyber Threat Landscape
Traditional defensive controls rely on predictable attacker behavior, known signatures, and fixed timing. JADEPUFFER introduces three critical paradigm shifts:
| Normal Ransomware | JADEPUFFER Agentic Ransomware |
| Static scripts or manual keyboard actions | Dynamic, real-time decision-making via LLMs |
| Fails or stops when encountering errors | Self-debugging code that resolves errors in seconds |
| Fixed sequence of attack steps | Adaptive lateral movement tailored to discovered targets |
Defensive Recommendations & Action Plan
- Patch AI & Workflow Tools Immediately: Ensure open-source AI frameworks like Langflow, Flowise, and Nacos are fully updated and never exposed directly to the public internet without strong authentication.
- Rotate Default Credentials: Immediately change default administrative passwords on object stores like MinIO (`minioadmin:minioadmin`) and service discovery solutions like Nacos.
- Implement Runtime Threat Detection: Deploy cloud detection and response (CDR) tools capable of monitoring process execution inside AI workload containers. Look for anomalous python execution spawning network scans or encoding payloads.
- Enforce Least-Privilege API Scopes: Restrict cloud provider and LLM API keys so that compromised development environments cannot leak root or multi-tenant production access.
