Threat video1:00
JADEPUFFER End-to-End Attack: Detection & IOCs
Storm-3168 ran a fully agentic chain that forged JWTs to take over Nacos. 9 detection rules, 61 IOCs, 58 ATT&CK techniques and a free Splunk SPL rule.
Read the full threat intel for JADEPUFFER End-to-End Attack: Detection & IOCs →
Chapters
- 0:00The hookAgentic ransomware encrypted 1,342 configurations.
- 0:06The storyExploited Langflow in July.
- 0:12Attack pathReportedly exploited Langflow for initial access.
- 0:27AttributionAttributed to JADEPUFFER.
- 0:31Indicators of compromise7 indicators to hunt: 3 IPs, 2 URLs and 2 SHA-256 hashes.
- 0:39MITRE ATT&CK techniques58 ATT&CK techniques, from reconnaissance to impact.
- 0:44Remediation9 steps now: Patch Langflow to version.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Agentic ransomware encrypted 1,342 configurations.
0:06Exploited Langflow in July.
0:08Encrypted configurations.
0:12Reportedly exploited Langflow for initial access.
0:16Harvested credentials from the host.
0:18Pivoted to Nacos via bypass.
0:20Self-corrected its failed exploit.
0:22Encrypted data, demanded ransom.
0:27Attributed to JADEPUFFER. Confidence: high.
0:317 indicators to hunt: 3 IPs, 2 URLs and 2 SHA-256 hashes.
0:3958 ATT&CK techniques, from reconnaissance to impact.
0:449 steps now: Patch Langflow to version.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.