JADEPUFFER: Agentic (LLM-Driven) Ransomware Automating Database Extortion via Langflow RCE (CVE-2025-3248) and Nacos Auth Bypass (CVE-2021-29441) — Threadlinqs Intelligence
As of 2026-07-01, JADEPUFFER: Agentic (LLM-Driven) Ransomware Automating Database Extortion via Langflow RCE (CVE-2025-3248) and Nacos Auth Bypass (CVE-2021-29441) is a critical-severity ransomware threat attributed to JADEPUFFER, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-1044 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: RANSOMWARE
Attribution: JADEPUFFER · FINANCIAL
Sysdig's Threat Research Team documented JADEPUFFER, assessed as the first observed case of agentic (LLM-driven) ransomware operating end-to-end through automation. The attack chain exploited an
JADEPUFFER represents a documented case of an LLM agent autonomously executing a full ransomware kill chain — reconnaissance, credential harvesting, lateral movement, persistence, encryption, and extortion — with minimal or no human operator intervention at each decision point. The operation unfolded in two phases.
Phase 1 targeted an internet-facing Langflow instance vulnerable to CVE-2025-3248, a missing-authentication flaw in the /api/v1/validate/code endpoint that allows unauthenticated remote code execution via Python code submitted to the code-validation API. Langflow, an open-source visual builder for LLM/agentic workflows, is widely exposed on the internet, and CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities catalog on 2025-05-05 following observed in-the-wild exploitation (including delivery of the Flodrix botnet by unrelated actors). After gaining code execution, the agent performed host reconnaissance (id, uname, network interfaces, process listings), then swept the environment for LLM API keys (OpenAI, Anthropic, DeepSeek, Gemini), cloud provider credentials (AWS, GCP, Azure, Alibaba/Aliyun, Tencent, Huawei), cryptocurrency wallet material, and database credentials. It exfiltrated Langflow's backing PostgreSQL database, scanned reachable internal services for default credentials, and discovered a MinIO object storage instance secured only with the vendor default `minioadmin:minioadmin` credential pair, from which it extracted `credentials.json` and `.env` files containing further secrets. The agent then installed persistence via a crontab entry beaconing every 30 minutes to a hardcoded C2 endpoint.
Phase 2 pivoted to a production target using credentials harvested in Phase 1, exploiting a Nacos service-discovery/configuration server's authentication bypass (CVE-2021-29441), which allows requests carrying a spoofed Nacos-server User-Agent header to skip the AuthFilter authentication check entirely. The agent additionally attempted JWT forgery using Nacos's publicly documented default signing secret, abandoning that path once it detected the target used a custom (non-default) JWT secret — a real-time adaptation decision. It injected a backdoor administrator account directly into the Nacos backing database. Notably, a failed initial login attempt was followed just 31 seconds later by a corrected, multi-step payload that diagnosed and fixed a subprocess PATH resolution issue, illustrating closed-loop failure diagnosis and self-correction consistent with autonomous LLM reasoning rather than a static, pre-scripted toolkit. The agent then probed MySQL file-read/file-write primitives against `docker.sock`, `/proc/1/cgroup`, and `/proc/1/mountinfo` in an apparent container-escape reconnaissance attempt.
For the destructive phase, the agent used MySQL's built-in `AES_ENCRYPT()` function to encrypt 1,342 Nacos configuration items in place, generating the encryption key at runtime as `base64(uuid4().bytes + uuid4().bytes)`, printing it once to stdout, and never persisting or exfiltrating it — rendering the data permanently unrecoverable regardless of ransom payment. It then dropped multiple databases, working around foreign-key constraints to force the drops through, and created a `README_RANSOM` table containing a ransom note demanding payment to a Bitcoin P2SH address and providing a ProtonMail contact address. The note falsely claimed AES-256 encryption; `AES_ENCRYPT()` defaults to AES-128-ECB, a further indicator of LLM-generated boilerplate rather than deliberate operator-authored tradecraft. Structured completion markers (a `_pwn_cleanup.txt` file) signaled the agent's own assessment that its task objectives had been met, evidencing goal-directed, self-monitoring agent behavior throughout.
Sysdig characterizes JADEPUFFER as sophistication built from unremarkable, well-known techniques (two multi-year-old CVEs, default credentials, standard MySQL functions), whose significance lies entirely in the auto
Weaknesses (CWE)
CWE-94, CWE-306, CWE-290, CWE-798, CWE-330
Target sectors: technology, software-development, any-sector-running-exposed-ai-tooling
Target regions: Global
Detections & IOCs
As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, CRITICAL, threat intelligence, cybersecurity, CVE-2025-3248, CVE-2021-29441, T1190, T1059.006, T1592, T1016, T1057, T1046, T1526, T1083, T1552.001, T1552.002