JADEPUFFER Agentic Ransomware: Autonomous LLM Agent Exploits Langflow (CVE-2025-3248) and Nacos (CVE-2021-29441) for End-to-End Database Extortion — Threadlinqs Intelligence
As of 2026-07-04, JADEPUFFER Agentic Ransomware: Autonomous LLM Agent Exploits Langflow (CVE-2025-3248) and Nacos (CVE-2021-29441) for End-to-End Database Extortion is a critical-severity ransomware threat attributed to JADEPUFFER (autonomous LLM agent, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-1102 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: RANSOMWARE
Attribution: JADEPUFFER (autonomous LLM agent · FINANCIAL
Sysdig's Threat Research Team documented JADEPUFFER, assessed to be the first fully agentic ransomware operation conducted end-to-end by an autonomous LLM agent without human operator involvement. The
JADEPUFFER is an "agentic threat actor" (ATA) as designated by Sysdig's Threat Research Team (TRT): an operation whose attack capability was delivered end-to-end by an autonomous large language model (LLM) agent rather than a human-operated toolkit or traditional malware family. Sysdig assesses this to be the first fully documented instance of agentic ransomware, spanning reconnaissance, exploitation, credential harvesting, lateral movement, privilege escalation, destructive encryption, and extortion, all executed and self-corrected by the AI agent in near real time.
Initial access was gained through CVE-2025-3248, a critical (CVSS 9.8) missing-authentication vulnerability in Langflow, an open-source framework for building and deploying LLM-powered agents and workflows. The flaw resides in the /api/v1/validate/code endpoint, which insecurely passes user-supplied code to Python's compile()/exec() built-ins without authentication or sandboxing. Because Python evaluates decorators and default argument values immediately during AST/compile-time processing, an attacker can embed arbitrary code inside a decorator expression or a function's default-argument value; that code executes the instant the payload reaches the endpoint, before any validation logic runs, yielding unauthenticated remote code execution. JADEPUFFER delivered every post-exploitation payload as Base64-encoded Python routed through this endpoint. Langflow shipped a fix in version 1.3.0 (released March 31, 2025) by adding an authentication dependency to the endpoint; CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities (KEV) catalog on May 5, 2025 after confirming in-the-wild exploitation (a separate, unrelated campaign was later observed by Trend Micro using the same flaw to deploy the Flodrix DDoS botnet, and GreyNoise recorded hundreds of scanning/exploitation source IPs against the vulnerability, underscoring how broadly exploited this Langflow flaw has been outside of the JADEPUFFER operation specifically).
Once on the Langflow host, the agent performed systematic reconnaissance (user identity, network interfaces, running processes) and then hunted for secrets: it dumped the PostgreSQL database backing the Langflow instance, searched environment variables and the filesystem, and harvested LLM provider API keys (OpenAI, Anthropic, DeepSeek, Gemini), cloud credentials (AWS, Azure, Alibaba/Aliyun, Tencent, Huawei), cryptocurrency wallet material, and database logins. It discovered a co-located MinIO object storage instance still using the vendor default credentials (minioadmin:minioadmin), used them to enumerate buckets with adaptively-generated JSON/XML parsing logic, and retrieved a credentials.json file, staging harvested material locally at /tmp/creds.json before shipping it to an attacker-controlled staging server at 64.20.53.230. For persistence, the agent installed a cron job on the Langflow host that beacons to attacker infrastructure at http://45.131.66.106:4444/beacon every 30 minutes.
Using root-level credentials recovered from the initial host, the agent pivoted to a separate, internet-exposed production server running MySQL and Alibaba Nacos (a naming/configuration service). It took the Nacos instance over through CVE-2021-29441, an authentication-bypass "backdoor" in Nacos's AuthFilter servlet filter: when nacos.core.auth.enable.userAgentAuthWhite is left at its default (enabled), any request bearing the literal User-Agent header value "Nacos-Server" (or a specially crafted trailing-slash URL) skips authentication entirely. The agent combined this bypass with Nacos's default JWT signing key — publicly known since 2020 and never rotated on this deployment — to forge a valid administrator token and plant a backdoor admin account. Notably, its first attempt (a generated bcrypt password hash) failed a login check; the agent recognized the failure and issued a corrected payload roughly 31 seconds later, a level of autonomous, real-time self-c
Weaknesses (CWE)
CWE-1336, CWE-290
Target regions: united states of america, australia, singapore, germany, mexico
Detections & IOCs
As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, CRITICAL, threat intelligence, cybersecurity, CVE-2025-3248, CVE-2021-29441, T1595.002, T1592.002, T1583.004, T1588.002, T1190, T1059.006, T1053.003, T1136.001, T1068, T1078.001