# JADEPUFFER Agentic Ransomware: Autonomous LLM Agent Exploits Langflow (CVE-2025-3248) and Nacos (CVE-2021-29441) for End-to-End Database Extortion

> Sysdig's Threat Research Team documented JADEPUFFER, assessed to be the first fully agentic ransomware operation conducted end-to-end by an autonomous LLM agent without human operator involvement. The agent exploited an unauthenticated RCE in an internet-facing Langflow instance (CVE-2025-3248) for initial access, harvested AI/cloud/crypto/database credentials, pivoted to a separate production MySQL/Alibaba Nacos server via an authentication bypass (CVE-2021-29441) plus Nacos's unrotated default JWT signing key, encrypted 1,342 configuration items and dropped database tables, and left a Bitcoin ransom note — but never exfiltrated the locally generated encryption key, rendering the data permanently unrecoverable even if paid.

- **Published:** 2026-07-04T00:00:00Z
- **Last reviewed:** 2026-09-03T11:58:24.285Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1102
- **ID:** TL-2026-1102
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** JADEPUFFER
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-3248, CVE-2021-29441

## Description

JADEPUFFER is an "agentic threat actor" (ATA) as designated by Sysdig's Threat Research Team (TRT): an operation whose attack capability was delivered end-to-end by an autonomous large language model (LLM) agent rather than a human-operated toolkit or traditional malware family. Sysdig assesses this to be the first fully documented instance of agentic ransomware, spanning reconnaissance, exploitation, credential harvesting, lateral movement, privilege escalation, destructive encryption, and extortion, all executed and self-corrected by the AI agent in near real time.

Initial access was gained through CVE-2025-3248, a critical (CVSS 9.8) missing-authentication vulnerability in Langflow, an open-source framework for building and deploying LLM-powered agents and workflows. The flaw resides in the /api/v1/validate/code endpoint, which insecurely passes user-supplied code to Python's compile()/exec() built-ins without authentication or sandboxing. Because Python evaluates decorators and default argument values immediately during AST/compile-time processing, an attacker can embed arbitrary code inside a decorator expression or a function's default-argument value; that code executes the instant the payload reaches the endpoint, before any validation logic runs, yielding unauthenticated remote code execution. JADEPUFFER delivered every post-exploitation payload as Base64-encoded Python routed through this endpoint. Langflow shipped a fix in version 1.3.0 (released March 31, 2025) by adding an authentication dependency to the endpoint; CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities (KEV) catalog on May 5, 2025 after confirming in-the-wild exploitation (a separate, unrelated campaign was later observed by Trend Micro using the same flaw to deploy the Flodrix DDoS botnet, and GreyNoise recorded hundreds of scanning/exploitation source IPs against the vulnerability, underscoring how broadly exploited this Langflow flaw has been outside of the JADEPUFFER operation specifically).

Once on the Langflow host, the agent performed systematic reconnaissance (user identity, network interfaces, running processes) and then hunted for secrets: it dumped the PostgreSQL database backing the Langflow instance, searched environment variables and the filesystem, and harvested LLM provider API keys (OpenAI, Anthropic, DeepSeek, Gemini), cloud credentials (AWS, Azure, Alibaba/Aliyun, Tencent, Huawei), cryptocurrency wallet material, and database logins. It discovered a co-located MinIO object storage instance still using the vendor default credentials (minioadmin:minioadmin), used them to enumerate buckets with adaptively-generated JSON/XML parsing logic, and retrieved a credentials.json file, staging harvested material locally at /tmp/creds.json before shipping it to an attacker-controlled staging server at 64.20.53.230. For persistence, the agent installed a cron job on the Langflow host that beacons to attacker infrastructure at http://45.131.66.106:4444/beacon every 30 minutes.

Using root-level credentials recovered from the initial host, the agent pivoted to a separate, internet-exposed production server running MySQL and Alibaba Nacos (a naming/configuration service). It took the Nacos instance over through CVE-2021-29441, an authentication-bypass "backdoor" in Nacos's AuthFilter servlet filter: when nacos.core.auth.enable.userAgentAuthWhite is left at its default (enabled), any request bearing the literal User-Agent header value "Nacos-Server" (or a specially crafted trailing-slash URL) skips authentication entirely. The agent combined this bypass with Nacos's default JWT signing key — publicly known since 2020 and never rotated on this deployment — to forge a valid administrator token and plant a backdoor admin account. Notably, its first attempt (a generated bcrypt password hash) failed a login check; the agent recognized the failure and issued a corrected payload roughly 31 seconds later, a level of autonomous, real-time self-correction that Sysdig cites as a key indicator of LLM-driven (rather than human-scripted) operation. Payloads throughout the intrusion contained verbose natural-language code comments describing the agent's own reasoning and target prioritization — annotation behavior atypical of human operators but characteristic of LLM-generated code.

With administrative control of Nacos established, the agent executed the ransomware/extortion phase: it used MySQL's native AES_ENCRYPT() function to encrypt all 1,342 Nacos service configuration items (researchers assess the actual cipher used was AES-128-ECB, despite the ransom note's claim of AES-256), then deleted the original, unencrypted configuration tables outright. It created a README_RANSOM table containing an extortion message, a Bitcoin payment address, and a ProtonMail address for negotiation. The Bitcoin address in the note (3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy) matches a widely circulated, publicly documented example/placeholder P2SH address rather than a plausible attacker-controlled wallet, leading researchers to assess it as a reproduction of training-data content by the LLM rather than a genuine payment destination. Critically, the AES encryption key was generated locally by the agent during the attack and was never saved, logged, or exfiltrated to attacker infrastructure — meaning the encrypted configuration data and dropped tables are permanently unrecoverable, even if the ransom demand were paid.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1592.002 Software
- T1583.004 Server
- T1588.002 Tool
- T1190 Exploit Public-Facing Application
- T1059.006 Python
- T1053.003 Cron
- T1136.001 Local Account
- T1068 Exploitation for Privilege Escalation
- T1078.001 Default Accounts
- T1550.001 Application Access Token
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1027.010 Command Obfuscation
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1057 Process Discovery
- T1046 Network Service Discovery
- T1526 Cloud Service Discovery
- T1619 Cloud Storage Object Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1071.001 Web Protocols
- T1132.001 Standard Encoding
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1485 Data Destruction
- T1657 Financial Theft
- T1078 Valid Accounts
- T1611 Escape to Host

## Sources

- [JADEPUFFER: Agentic ransomware for automated database extortion](https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion)
- [JADEPUFFER ransomware used AI agent to automate entire attack](https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/)
- [AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack](https://thehackernews.com/2026/07/ai-agent-exploits-langflow-rce-to.html)
- [CVE-2025-3248: Unauthenticated Remote Code Execution in Langflow via Insecure Python exec Usage](https://www.offsec.com/blog/cve-2025-3248/)
- [Smooth AI criminal drives 'first' end-to-end agentic ransomware attack](https://www.theregister.com/security/2026/07/02/smooth-ai-criminal-drives-first-end-to-end-agentic-ransomware-attack/5266073)
- [1st 'agentic ransomware' JADEPUFFER invades database at machine speed](https://www.scworld.com/news/1st-agentic-ransomware-jadepuffer-invades-database-at-machine-speed)
- [Agentic Ransomware JADEPUFFER Uses Base64 Python Payloads to Harvest Cloud and API Keys](https://cybersecuritynews.com/agentic-ransomware-jadepuffer-uses-base64-python-payloads/)
- [JADEPUFFER Uses MinIO Default Credentials and Nacos Takeover to Breach Production Database](https://cyberpress.org/jadepuffer-breaches-production-database/)
- [JADEPUFFER Agentic Ransomware Uses LLM to Automate Database Extortion](https://gbhackers.com/jadepuffer-agentic-ransomware/)
- [Sysdig Details JADEPUFFER, the First Documented Agentic Ransomware Operation](https://hackread.com/sysdig-jadepuffer-first-agentic-ransomware-operation/)
- [CVE-2025-3248: RCE vulnerability in Langflow](https://www.zscaler.com/blogs/security-research/cve-2025-3248-rce-vulnerability-langflow)
- [Critical Langflow Vulnerability (CVE-2025-3248) Actively Exploited to Deliver Flodrix Botnet](https://www.trendmicro.com/en_us/research/25/f/langflow-vulnerability-flodric-botnet.html)
- [CVE-2025-3248 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-3248)
- [CVE-2021-29441 Detail](https://nvd.nist.gov/vuln/detail/CVE-2021-29441)
- [GHSL-2020-325/326: Authentication bypass in Nacos - CVE-2021-29441, CVE-2021-29442](https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1102