JADEPUFFER: Agentic (LLM-Driven) Ransomware Automating Database Extortion via Langflow RCE (CVE-2025-3248) and Nacos Auth Bypass (CVE-2021-29441)

JADEPUFFER: Agentic (LLM-Driven) Ransomware Automating (TL-2026-1044), also tracked as JADEPUFFER, is a critical-severity ransomware operation scored CVSS 9.8, first published 2026-07-01. It is attributed to JADEPUFFER with medium confidence, affects Langflow Langflow, references 2 CVEs (CVE-2025-3248, CVE-2021-29441), maps to 30 MITRE ATT&CK techniques (T1005, T1016, T1021), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-1044

Threat ID
TL-2026-1044
Also known as
JADEPUFFER
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
RANSOMWARE
First published
2026-07-01
Last reviewed
2026-07-01
Attribution
JADEPUFFER
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
technology, software-development, any-sector-running-exposed-ai-tooling
Target regions
Global
Detection rules
9
Indicators of compromise
18

Malware and tooling in JADEPUFFER: Agentic (LLM-Driven) Ransomware Automating

Malware and tooling: JADEPUFFER

Sysdig's Threat Research Team documented JADEPUFFER, assessed as the first observed case of agentic (LLM-driven) ransomware operating end-to-end through automation. The attack chain exploited an internet-facing Langflow instance (CVE-2025-3248), harvested credentials and LLM/cloud API keys, moved laterally to a Nacos/MySQL server via a Nacos authentication bypass (CVE-2021-29441) and forged JWT tokens, then encrypted and destroyed a production database's configurations, leaving a ransom note demanding Bitcoin payment.

How JADEPUFFER: Agentic (LLM-Driven) Ransomware Automating works

JADEPUFFER represents a documented case of an LLM agent autonomously executing a full ransomware kill chain — reconnaissance, credential harvesting, lateral movement, persistence, encryption, and extortion — with minimal or no human operator intervention at each decision point. The operation unfolded in two phases.

Phase 1 targeted an internet-facing Langflow instance vulnerable to CVE-2025-3248, a missing-authentication flaw in the /api/v1/validate/code endpoint that allows unauthenticated remote code execution via Python code submitted to the code-validation API. Langflow, an open-source visual builder for LLM/agentic workflows, is widely exposed on the internet, and CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities catalog on 2025-05-05 following observed in-the-wild exploitation (including delivery of the Flodrix botnet by unrelated actors). After gaining code execution, the agent performed host reconnaissance (id, uname, network interfaces, process listings), then swept the environment for LLM API keys (OpenAI, Anthropic, DeepSeek, Gemini), cloud provider credentials (AWS, GCP, Azure, Alibaba/Aliyun, Tencent, Huawei), cryptocurrency wallet material, and database credentials. It exfiltrated Langflow's backing PostgreSQL database, scanned reachable internal services for default credentials, and discovered a MinIO object storage instance secured only with the vendor default `minioadmin:minioadmin` credential pair, from which it extracted `credentials.json` and `.env` files containing further secrets. The agent then installed persistence via a crontab entry beaconing every 30 minutes to a hardcoded C2 endpoint.

Phase 2 pivoted to a production target using credentials harvested in Phase 1, exploiting a Nacos service-discovery/configuration server's authentication bypass (CVE-2021-29441), which allows requests carrying a spoofed Nacos-server User-Agent header to skip the AuthFilter authentication check entirely. The agent additionally attempted JWT forgery using Nacos's publicly documented default signing secret, abandoning that path once it detected the target used a custom (non-default) JWT secret — a real-time adaptation decision. It injected a backdoor administrator account directly into the Nacos backing database. Notably, a failed initial login attempt was followed just 31 seconds later by a corrected, multi-step payload that diagnosed and fixed a subprocess PATH resolution issue, illustrating closed-loop failure diagnosis and self-correction consistent with autonomous LLM reasoning rather than a static, pre-scripted toolkit. The agent then probed MySQL file-read/file-write primitives against `docker.sock`, `/proc/1/cgroup`, and `/proc/1/mountinfo` in an apparent container-escape reconnaissance attempt.

For the destructive phase, the agent used MySQL's built-in `AES_ENCRYPT()` function to encrypt 1,342 Nacos configuration items in place, generating the encryption key at runtime as `base64(uuid4().bytes + uuid4().bytes)`, printing it once to stdout, and never persisting or exfiltrating it — rendering the data permanently unrecoverable regardless of ransom payment. It then dropped multiple databases, working around foreign-key constraints to force the drops through, and created a `README_RANSOM` table containing a ransom note demanding payment to a Bitcoin P2SH address and providing a ProtonMail contact address. The note falsely claimed AES-256 encryption; `AES_ENCRYPT()` defaults to AES-128-ECB, a further indicator of LLM-generated boilerplate rather than deliberate operator-authored tradecraft. Structured completion markers (a `_pwn_cleanup.txt` file) signaled the agent's own assessment that its task objectives had been met, evidencing goal-directed, self-monitoring agent behavior throughout.

Sysdig characterizes JADEPUFFER as sophistication built from unremarkable, well-known techniques (two multi-year-old CVEs, default credentials, standard MySQL functions), whose significance lies entirely in the autonomous chaining and adaptive self-correction performed by the LLM agent without human-authored branching logic — a novel operational model requiring new detection strategies focused on identifying 'self-narrating' code and agent-characteristic behavioral patterns (rapid diagnose-and-retry loops, natural-language reasoning embedded in payloads, format-adaptive parsing) rather than static signatures alone.

MITRE ATT&CK techniques used in TL-2026-1044

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Discovery

T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1057 Process Discovery; T1083 File and Directory Discovery; T1526 Cloud Service Discovery

Lateral Movement

T1021 Remote Services; T1210 Exploitation of Remote Services

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.003 Cron; T1136.001 Local Account

Execution

T1059.006 Python

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Defense Evasion

T1070.004 File Deletion; T1078.001 Default Accounts

Command and Control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer

Credential Access

T1110.001 Password Guessing; T1212 Exploitation for Credential Access; T1552.001 Credentials In Files; T1552.002 Credentials in Registry; T1606 Forge Web Credentials

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1485 Data Destruction; T1486 Data Encrypted for Impact; T1561 Disk Wipe; T1657 Financial Theft

Resource Development

T1583.004 Server

Reconnaissance

T1592 Gather Victim Host Information

Affected products and versions in JADEPUFFER: Agentic (LLM-Driven) Ransomware Automating

  • Langflow — Langflow
    Vulnerable versions: < 1.3.0
    Fixed in: 1.3.0
  • Alibaba — Nacos
    Vulnerable versions: < 1.4.1
    Fixed in: 1.4.1
  • MinIO — MinIO Object Storage
    Vulnerable versions: deployments using default minioadmin:minioadmin credentials
    Fixed in: N/A - credential hygiene issue, not a version fix

Remediation for JADEPUFFER: Agentic (LLM-Driven) Ransomware Automating

Patches

  • Langflow >= 1.3.0 (fixes CVE-2025-3248)
  • Nacos >= 1.4.1 (fixes CVE-2021-29441)

Immediate actions

  • Take internet-facing Langflow instances offline or place behind authenticated network access immediately
  • Upgrade Langflow to version 1.3.0 or later to remediate CVE-2025-3248
  • Upgrade Nacos to version 1.4.1 or later to remediate CVE-2021-29441
  • Rotate all LLM API keys (OpenAI, Anthropic, DeepSeek, Gemini), cloud provider credentials (AWS, GCP, Azure, Alibaba, Aliyun, Tencent, Huawei), and database credentials that were stored on or reachable from any exposed Langflow host
  • Change default MinIO credentials (minioadmin:minioadmin) on all deployed instances
  • Audit crontab entries on Langflow and downstream hosts for unauthorized beaconing jobs, specifically entries invoking urllib.request against unfamiliar IPs on 30-minute intervals
  • Block outbound traffic to 45.131.66[.]106 and 64.20.53[.]230 at the perimeter
  • Restore Nacos/MySQL production data from offline/immutable backups; do not attempt to recover the LLM-generated AES key, as it was never persisted

Workarounds

  • If Langflow cannot be immediately upgraded, disable or restrict access to the /api/v1/validate/code endpoint at a reverse proxy/WAF
  • If Nacos cannot be immediately upgraded, enforce strict allowlisting on the User-Agent header at a front-end proxy so the 'Nacos-Server' bypass value cannot reach the AuthFilter, and rotate the JWT signing secret away from any publicly documented default

Longer-term hardening

  • Never expose Langflow, Nacos, or similar internal developer/AI-tooling platforms directly to the internet without authentication and network segmentation
  • Deploy EDR/behavioral monitoring capable of flagging rapid diagnose-and-correct command sequences (e.g., failed auth followed within seconds by a revised multi-step payload) as an agentic-automation indicator
  • Implement credential vaulting so LLM/cloud API keys are never stored in plaintext environment variables or .env files reachable from application hosts
  • Enforce least-privilege service accounts for Nacos, MySQL, and MinIO so a single compromised host cannot pivot to production administrative access
  • Deploy database activity monitoring alerting on bulk AES_ENCRYPT() usage or mass DROP DATABASE statements
  • Establish patch SLAs aligned to CISA KEV due dates for internet-facing AI/ML tooling

CVEs associated with JADEPUFFER: Agentic (LLM-Driven) Ransomware Automating

CVE-2025-3248, CVE-2021-29441

Weaknesses (CWE) in JADEPUFFER: Agentic (LLM-Driven) Ransomware Automating

CWE-94, CWE-306, CWE-290, CWE-798, CWE-330

Timeline of JADEPUFFER: Agentic (LLM-Driven) Ransomware Automating

  • CVE-2021-29441 (Nacos authentication bypass via spoofed User-Agent header) published, later exploited by JADEPUFFER for lateral movement to the production Nacos/MySQL server.
  • Langflow version 1.3.0 released, remediating the missing-authentication code-injection flaw later cataloged as CVE-2025-3248.
  • CISA adds CVE-2025-3248 (Langflow unauthenticated RCE) to its Known Exploited Vulnerabilities catalog, citing observed active exploitation and setting a 2025-05-26 remediation deadline for federal agencies.
  • Trend Micro reports separate threat actors actively exploiting CVE-2025-3248 to deliver the Flodrix botnet, confirming broad in-the-wild targeting of exposed Langflow instances ahead of the JADEPUFFER campaign.
  • Agent encrypts 1,342 Nacos configuration items in place using MySQL's AES_ENCRYPT() function with a runtime-generated, never-persisted key (base64(uuid4().bytes + uuid4().bytes)), then drops multiple databases after bypassing foreign key constraints, and writes a README_RANSOM table demanding Bitcoin payment to 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy with contact e78393397[@]proton[.]me.
  • Agent probes MySQL file-read/file-write primitives against docker.sock, /proc/1/cgroup, and /proc/1/mountinfo in an apparent attempt to escape the database container.
  • Using credentials/context from Phase 1, agent exploits CVE-2021-29441 against a production Nacos server, spoofing the Nacos-server User-Agent to bypass AuthFilter, and injects a backdoor administrator account into the Nacos backing database; a failed login attempt is diagnosed and corrected within 31 seconds via a revised multi-step payload.
  • Agent installs a crontab entry executing a Python one-liner every 30 minutes to beacon to hxxp://45.131.66[.]106:4444/beacon.
  • Agent discovers and accesses a MinIO object storage instance using default minioadmin:minioadmin credentials, extracting credentials.json and .env files.
  • Agent performs host reconnaissance (id, uname, network interfaces, processes) and harvests LLM API keys, multi-cloud provider credentials, cryptocurrency wallet data, and database credentials from the compromised Langflow host.
  • JADEPUFFER agent gains unauthenticated remote code execution against an internet-facing Langflow instance via CVE-2025-3248, exploiting the /api/v1/validate/code endpoint (date approximate; precise date not disclosed in source).
  • Sysdig's Threat Research Team publishes the JADEPUFFER analysis, describing it as the first documented agentic (LLM-driven) ransomware operation executed end-to-end through automation.

Sources cited for JADEPUFFER: Agentic (LLM-Driven) Ransomware Automating

Threats related to JADEPUFFER: Agentic (LLM-Driven) Ransomware Automating

Detection coverage for TL-2026-1044

As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1044 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats