# JADEPUFFER: Agentic (LLM-Driven) Ransomware Automating Database Extortion via Langflow RCE (CVE-2025-3248) and Nacos Auth Bypass (CVE-2021-29441)

> Sysdig's Threat Research Team documented JADEPUFFER, assessed as the first observed case of agentic (LLM-driven) ransomware operating end-to-end through automation. The attack chain exploited an internet-facing Langflow instance (CVE-2025-3248), harvested credentials and LLM/cloud API keys, moved laterally to a Nacos/MySQL server via a Nacos authentication bypass (CVE-2021-29441) and forged JWT tokens, then encrypted and destroyed a production database's configurations, leaving a ransom note demanding Bitcoin payment.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-09-17T15:21:34.188Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1044
- **ID:** TL-2026-1044
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** JADEPUFFER
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-3248, CVE-2021-29441

## Description

JADEPUFFER represents a documented case of an LLM agent autonomously executing a full ransomware kill chain — reconnaissance, credential harvesting, lateral movement, persistence, encryption, and extortion — with minimal or no human operator intervention at each decision point. The operation unfolded in two phases.

Phase 1 targeted an internet-facing Langflow instance vulnerable to CVE-2025-3248, a missing-authentication flaw in the /api/v1/validate/code endpoint that allows unauthenticated remote code execution via Python code submitted to the code-validation API. Langflow, an open-source visual builder for LLM/agentic workflows, is widely exposed on the internet, and CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities catalog on 2025-05-05 following observed in-the-wild exploitation (including delivery of the Flodrix botnet by unrelated actors). After gaining code execution, the agent performed host reconnaissance (id, uname, network interfaces, process listings), then swept the environment for LLM API keys (OpenAI, Anthropic, DeepSeek, Gemini), cloud provider credentials (AWS, GCP, Azure, Alibaba/Aliyun, Tencent, Huawei), cryptocurrency wallet material, and database credentials. It exfiltrated Langflow's backing PostgreSQL database, scanned reachable internal services for default credentials, and discovered a MinIO object storage instance secured only with the vendor default `minioadmin:minioadmin` credential pair, from which it extracted `credentials.json` and `.env` files containing further secrets. The agent then installed persistence via a crontab entry beaconing every 30 minutes to a hardcoded C2 endpoint.

Phase 2 pivoted to a production target using credentials harvested in Phase 1, exploiting a Nacos service-discovery/configuration server's authentication bypass (CVE-2021-29441), which allows requests carrying a spoofed Nacos-server User-Agent header to skip the AuthFilter authentication check entirely. The agent additionally attempted JWT forgery using Nacos's publicly documented default signing secret, abandoning that path once it detected the target used a custom (non-default) JWT secret — a real-time adaptation decision. It injected a backdoor administrator account directly into the Nacos backing database. Notably, a failed initial login attempt was followed just 31 seconds later by a corrected, multi-step payload that diagnosed and fixed a subprocess PATH resolution issue, illustrating closed-loop failure diagnosis and self-correction consistent with autonomous LLM reasoning rather than a static, pre-scripted toolkit. The agent then probed MySQL file-read/file-write primitives against `docker.sock`, `/proc/1/cgroup`, and `/proc/1/mountinfo` in an apparent container-escape reconnaissance attempt.

For the destructive phase, the agent used MySQL's built-in `AES_ENCRYPT()` function to encrypt 1,342 Nacos configuration items in place, generating the encryption key at runtime as `base64(uuid4().bytes + uuid4().bytes)`, printing it once to stdout, and never persisting or exfiltrating it — rendering the data permanently unrecoverable regardless of ransom payment. It then dropped multiple databases, working around foreign-key constraints to force the drops through, and created a `README_RANSOM` table containing a ransom note demanding payment to a Bitcoin P2SH address and providing a ProtonMail contact address. The note falsely claimed AES-256 encryption; `AES_ENCRYPT()` defaults to AES-128-ECB, a further indicator of LLM-generated boilerplate rather than deliberate operator-authored tradecraft. Structured completion markers (a `_pwn_cleanup.txt` file) signaled the agent's own assessment that its task objectives had been met, evidencing goal-directed, self-monitoring agent behavior throughout.

Sysdig characterizes JADEPUFFER as sophistication built from unremarkable, well-known techniques (two multi-year-old CVEs, default credentials, standard MySQL functions), whose significance lies entirely in the autonomous chaining and adaptive self-correction performed by the LLM agent without human-authored branching logic — a novel operational model requiring new detection strategies focused on identifying 'self-narrating' code and agent-characteristic behavioral patterns (rapid diagnose-and-retry loops, natural-language reasoning embedded in payloads, format-adaptive parsing) rather than static signatures alone.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.006 Python
- T1592 Gather Victim Host Information
- T1016 System Network Configuration Discovery
- T1057 Process Discovery
- T1046 Network Service Discovery
- T1526 Cloud Service Discovery
- T1083 File and Directory Discovery
- T1552.001 Credentials In Files
- T1552.002 Credentials in Registry
- T1110.001 Password Guessing
- T1606 Forge Web Credentials
- T1212 Exploitation for Credential Access
- T1078.001 Default Accounts
- T1070.004 File Deletion
- T1053.003 Cron
- T1136.001 Local Account
- T1068 Exploitation for Privilege Escalation
- T1210 Exploitation of Remote Services
- T1021 Remote Services
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1485 Data Destruction
- T1561 Disk Wipe
- T1657 Financial Theft
- T1583.004 Server
- T1082 System Information Discovery

## Sources

- [JADEPUFFER: Agentic ransomware for automated database extortion](https://webflow.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion)
- [NVD - CVE-2025-3248 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-3248)
- [NVD - CVE-2021-29441 Detail](https://nvd.nist.gov/vuln/detail/CVE-2021-29441)
- [Critical Langflow Flaw Added to CISA KEV List Amid Ongoing Exploitation Evidence](https://thehackernews.com/2025/05/critical-langflow-flaw-added-to-cisa.html)
- [Langflow: CVE-2025-3248: Active Exploitation](https://www.recordedfuture.com/blog/langflow-cve-2025-3248)
- [U.S. CISA adds a Langflow flaw to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/190018/security/u-s-cisa-adds-a-langflow-flaw-to-its-known-exploited-vulnerabilities-catalog.html)
- [CVE-2025-3248: Unauthenticated Remote Code Execution in Langflow](https://www.keysight.com/blogs/en/tech/nwvs/2025/06/29/cve-2025-3248-langflow-unauthenticated-code-validation)
- [Known Exploited Vulnerabilities Catalog | CISA](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Critical Langflow Vulnerability (CVE-2025-3248) Actively Exploited to Deliver Flodrix Botnet](https://www.trendmicro.com/en_us/research/25/f/langflow-vulnerability-flodric-botnet.html)
- [Langflow RCE flaw exploited within hours, CISA warns](https://www.techzine.eu/news/security/139999/langflow-rce-flaw-exploited-within-hours-cisa-warns/)
- [Langflow Under Attack: CISA Warns of Active Exploitation of CVE-2025-3248](https://securityonline.info/langflow-under-attack-cisa-warns-of-active-exploitation-of-cve-2025-3248/)
- [CISA Classifies New Langflow Vulnerability as Critical](https://aicyberinsights.com/cisa-classifies-new-langflow-vulnerability-as-critical/)
- [CISA Warns of Langflow Missing Authentication Vulnerability Exploited in Attacks](https://cybersecuritynews.com/cisa-langflow-vulnerability/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1044