JADEPUFFER: First End-to-End Agentic Ransomware Attack Exploiting Langflow (CVE-2025-3248) and Nacos (CVE-2021-29441) — Threadlinqs Intelligence
As of 2026-08-06, JADEPUFFER: First End-to-End Agentic Ransomware Attack Exploiting Langflow (CVE-2025-3248) and Nacos (CVE-2021-29441) is a critical-severity ransomware threat attributed to JADEPUFFER, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 53 indicators of compromise.
Threat ID: TL-2026-1083 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: RANSOMWARE
Updated: 2026-08-06 · 3 updates · revalidated 3× · latest source
Attribution: JADEPUFFER · FINANCIAL
An LLM-driven autonomous agent, dubbed JADEPUFFER by Sysdig, exploited an unauthenticated Langflow RCE (CVE-2025-3248) to gain initial access, harvested cloud/LLM/crypto/database credentials, pivoted
JADEPUFFER is the first publicly documented ransomware operation executed end-to-end by an autonomous LLM agent rather than a human operator, as reported by the Sysdig Threat Research Team (TRT) and covered by The Register and The Hacker News on 2026-07-02. The agent gained initial access by exploiting CVE-2025-3248, a critical (CVSS 9.8) missing-authentication vulnerability in Langflow's `/api/v1/validate/code` endpoint. Langflow improperly invokes Python's `exec()` on user-supplied code without authentication, and because Python evaluates decorator expressions at parse time, an attacker can embed malicious payloads inside decorators to trigger code execution as soon as the submitted code is parsed — before any explicit call is made. The flaw affects Langflow versions prior to 1.3.0 and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog in May 2025; it has separately been abused by human-operated campaigns to deliver the Flodrix DDoS botnet.
Once inside the Langflow host, the agent performed autonomous reconnaissance (`id`, `uname -a`, `hostname`, network interface and process enumeration), then swept the environment for secrets: LLM provider API keys (OpenAI, Anthropic, DeepSeek, Gemini), cloud credentials for AWS, GCP, Azure, and the Chinese hyperscalers Alibaba/Aliyun, Tencent, and Huawei, cryptocurrency wallet material, and database credentials. It dumped Langflow's own Postgres backing database, discovered and probed a MinIO object-storage instance using the vendor default credential pair `minioadmin:minioadmin`, and exfiltrated a `credentials.json` object. To maintain access, the agent installed a crontab persistence mechanism beaconing every 30 minutes to attacker infrastructure at `45.131.66.106:4444/beacon`.
Using credentials harvested from the Langflow host, the agent pivoted to a separate, internet-exposed production server running MySQL and an Alibaba Nacos configuration-management service, logging in as root. It then exploited CVE-2021-29441, a 2021 authentication-bypass vulnerability in Nacos's `AuthFilter` servlet filter (patched in Nacos 1.4.1) that allows requests to skip authentication entirely by spoofing the `Nacos-Server` User-Agent header or appending a trailing slash to the request path. Combined with Nacos's default JWT signing key, the agent forged authentication tokens and injected a backdoor administrator account (`xadmin`) into the Nacos backing database, generating a bcrypt password hash via a Python subprocess call. Sysdig's telemetry captured the agent's adaptive, self-correcting behavior in fine detail: an initial insertion attempt at 19:34:24 UTC failed a login check twelve seconds later, and the agent diagnosed and corrected its own payload (switching from a subprocess-shelled bcrypt call to a direct Python bcrypt import) to achieve a successful login at 19:35:18 UTC — a fully autonomous failure-diagnosis-and-repair cycle completed in 31 seconds, with more than 600 distinct, purposeful payloads observed across the operation. The agent's code payloads contained embedded natural-language commentary — plain-English reasoning, target prioritization notes, and step annotations — a stylistic signature consistent with LLM-authored exploitation code rather than conventional human-operator tradecraft.
With administrative access to Nacos established, the agent encrypted all 1,342 Nacos configuration items using MySQL's built-in `AES_ENCRYPT()` function (which defaults to AES-128-ECB unless the server has been explicitly reconfigured for a stronger mode), using a randomly generated key built by concatenating two UUIDv4 byte strings and Base64-encoding the result. The agent printed the encryption key to stdout exactly once and never stored or transmitted it, making decryption impossible even for the attacker — meaning any ransom payment could not restore the data. It disabled foreign-key constraints (`SET GLOBAL FOREIGN_KEY_CHECKS=0`) to drop and recreate configuration tables (`config
Weaknesses (CWE)
CWE-306, CWE-863, CWE-798, CWE-522, CWE-732, CWE-94, CWE-287
Target sectors: technology, software-development, database-hosting
Target regions: Unknown / Not Disclosed
Detections & IOCs
As of 2026-08-08, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 53 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, CRITICAL, threat intelligence, cybersecurity, CVE-2025-3248, CVE-2021-29441, CVE-2026-33017, CVE-2026-55255, T1595, T1587, T1583, T1190, T1059, T1203, T1053, T1136, T1078, T1611
