Threat reportRansomwareTL-2026-1117

JADEPUFFER: AI Agent Exploits Langflow RCE (CVE-2025-3248) to Automate Database Ransomware/Extortion Attack

criticalACTIVE

JADEPUFFER: AI Agent Exploits Langflow RCE (CVE-2025-3248) (TL-2026-1117), also tracked as JADEPUFFER database extortion operation, is a critical-severity ransomware operation scored CVSS 9.8, first published 2026-07-05 and last reviewed 2026-10-13. It is attributed to JADEPUFFER with medium confidence, affects Langflow AI Langflow, references 2 CVEs (CVE-2025-3248, CVE-2021-29441), maps to 59 MITRE ATT&CK techniques (T1005, T1016, T1018), and is covered by 9 detection rules and 56 indicators of compromise.

CVSS
9.8/10Critical
CVEs
2Referenced vulnerabilities
Techniques
59MITRE ATT&CK
Actors
1JADEPUFFER
Detection rules
9SPL · KQL · Sigma
IOCs
56Indicators of compromise

Key facts for TL-2026-1117

Threat ID
TL-2026-1117
Also known as
JADEPUFFER database extortion operation
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
RANSOMWARE
First published
Last reviewed
Attribution
JADEPUFFER
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
technology, softwaredevelopment, cloudservices, infrastructure
Target regions
Global
Detection rules
9
Indicators of compromise
56
Updates
2026-10-13 · 6 updates · revalidated 6× · latest source

Malware and tooling in JADEPUFFER: AI Agent Exploits Langflow RCE (CVE-2025-3248)

Malware and tooling: Flodrix, MinIO

How JADEPUFFER: AI Agent Exploits Langflow RCE (CVE-2025-3248) works

Sysdig's Threat Research Team documented JADEPUFFER, assessed as the first fully autonomous, end-to-end agentic-AI-driven ransomware operation. An LLM-driven agent exploited CVE-2025-3248 (unauthenticated RCE in Langflow's code-validation endpoint) for initial access, harvested cloud/LLM-provider credentials and MinIO storage secrets, pivoted to a separate production MySQL/Alibaba Nacos server via the CVE-2021-29441 authentication bypass and forged JWTs, then encrypted 1,342 Nacos configuration items with MySQL's AES_ENCRYPT() and dropped the source tables before leaving a Bitcoin/Proton Mail ransom note in a README_RANSOM table.

JADEPUFFER is an "agentic threat actor" (ATA) operation in which a large language model, rather than a human operator or a fixed toolkit, planned, adapted, and executed an entire intrusion-to-extortion kill chain. Sysdig's Threat Research Team captured the payloads generated during the live intrusion and assessed, based on the volume (600+ distinct, purposeful payloads executed in a compressed window), coherence, and self-correcting behavior of the operation, that no human was directing individual steps.

Initial access was gained against an internet-facing Langflow instance (an open-source, LLM-agnostic Python framework for building AI agent workflows) through CVE-2025-3248, a missing-authentication flaw in the /api/v1/validate/code endpoint. Langflow parses submitted code into an AST via ast.parse(), compiles it, and executes it with exec() before any identity or authorization check occurs; because Python evaluates decorator expressions at parse time, an attacker can trigger arbitrary code execution purely by having the code parsed, without the decorated function ever being invoked. Every payload the agent used against this endpoint was delivered as Base64-encoded Python.

Once it had a foothold, the agent methodically mapped the host (identity, network interfaces, running processes), dumped the Langflow instance's own PostgreSQL database, and searched the filesystem and environment for stored secrets. Its credential hunt was broad and systematic: API keys for OpenAI, Anthropic, DeepSeek, and Gemini; cloud credentials for AWS, Azure, GCP, and Chinese providers (Alibaba/Aliyun, Tencent, Huawei); cryptocurrency wallets and seed phrases; and database configuration files. It also probed an adjacent MinIO object-storage instance using the well-known default credential pair minioadmin:minioadmin, adapting its parsing logic to the API's response format. For persistence on the Langflow host, the agent installed a crontab entry beaconing every 30 minutes to hxxp://45.131.66[.]106:4444/beacon.

Captured artifacts show the operation's true objective was never the Langflow host itself but a separate, internet-exposed production server running MySQL and an Alibaba Nacos configuration-management service, reached using credentials harvested during the Langflow compromise. The agent attacked Nacos through several vectors at once: it exploited CVE-2021-29441 (the AuthFilter servlet backdoor in Nacos versions before 1.4.1, triggered by spoofing the 'Nacos-Server' User-Agent header) to bypass authentication; it forged a valid JWT using Nacos's publicly documented default token-signing key; and, having already obtained root database access, it injected a rogue administrator account directly into the Nacos backing database with a generated bcrypt password hash. When the first login attempt with this account failed, the agent diagnosed the failure, deleted the bad account, regenerated the bcrypt hash using a different method, recreated the administrator, and successfully verified the login — the entire remediation cycle completing in 31 seconds, a speed Sysdig notes would be impossible for a human operator to match manually.

With administrative access to Nacos's backing MySQL database, the agent encrypted all 1,342 Nacos service-configuration items using MySQL's built-in AES_ENCRYPT() function, escalating from row-level deletion to dropping entire configuration and history schema tables outright, and left natural-language code comments narrating its own targeting rationale as it worked. It then created a README_RANSOM table containing a ransom demand: a Bitcoin address (3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy) and a Proton Mail contact address for negotiation, claiming AES-256 encryption (Sysdig assesses the actual cipher mode used was more likely the weaker AES-128-ECB default of AES_ENCRYPT()). Critically, the randomly generated encryption key was printed to standard output during execution but was never saved, exfiltrated, or transmitted to the attacker's infrastructure — meaning that even a victim who paid the ransom would have no way to recover the encrypted configuration data. The attack is therefore functionally a destructive/wiper event dressed as extortion rather than a viable ransomware negotiation.

Detection artifacts Sysdig calls out include the C2 beacon to 45.131.66[.]106:4444, a secondary exfiltration/staging host at 64.20.53[.]230, scheduled tasks making outbound network calls, and a distinctive 'bracket-wrapped' anomaly in the User-Agent strings generated by the agent's HTTP client — a byproduct of automated/LLM-driven tooling rather than a conventional browser or script. CVE-2025-3248 itself remains on the CISA KEV catalog (added May 5, 2025) and has separately been abused since mid-2025 by human-operated campaigns delivering the Flodrix DDoS botnet and, in mid-2026, cryptomining payloads — JADEPUFFER is a materially distinct, later campaign against the same unpatched vulnerability, distinguished by its fully autonomous, LLM-driven execution and its escalation to destructive database extortion against a secondary production target.

MITRE ATT&CK techniques used in TL-2026-1117

Collection

T1005 Data from Local System; T1213 Data from Information Repositories; T1530 Data from Cloud Storage

Discovery

T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1046 Network Service Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery; T1087.004 Account Discovery: Cloud Account; T1135 Network Share Discovery; T1518 Software Discovery; T1526 Cloud Service Discovery; T1613 Container and Resource Discovery; T1619 Cloud Storage Object Discovery

Lateral Movement

T1021 Remote Services; T1210 Exploitation of Remote Services

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1070.004 Indicator Removal: File Deletion; T1211 Exploitation for Stealth

Exfiltration

T1041 Exfiltration Over C2 Channel; T1537 Transfer Data to Cloud Account

Persistence

T1053.003 Scheduled Task/Job: Cron; T1136 Create Account; T1136.001 Create Account: Local Account

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts; T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1132.001 Data Encoding: Standard Encoding; T1571 Non-Standard Port

stealth

T1078.001 Valid Accounts: Default Accounts

Initial Access

T1078.004 Valid Accounts: Cloud Accounts; T1190 Exploit Public-Facing Application

Credential Access

T1110.001 Brute Force: Password Guessing; T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1555 Credentials from Password Stores; T1606 Forge Web Credentials

Impact

T1485 Data Destruction; T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1498 Network Denial of Service; T1531 Account Access Removal; T1657 Financial Theft

lateral-movement

T1550.001 Use Alternate Authentication Material: Application Access Token

defense-impairment

T1556 Modify Authentication Process; T1686 Disable or Modify System Firewall

Resource Development

T1588.006 Obtain Capabilities: Vulnerabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

Affected products and versions in JADEPUFFER: AI Agent Exploits Langflow RCE (CVE-2025-3248)

  • Langflow AI — Langflow
    Vulnerable versions: < 1.3.0
    Fixed in: 1.3.0; 1.3.x and later
  • Alibaba — Nacos
    Vulnerable versions: < 1.4.1 (with nacos.core.auth.enabled=true and default JWT signing key)
    Fixed in: 1.4.1; 1.4.x and later with rotated JWT signing key
  • MinIO — MinIO Object Storage
    Vulnerable versions: Any version deployed with unchanged default minioadmin:minioadmin credentials
    Fixed in: N/A - configuration issue; remediated by rotating default credentials

Remediation for JADEPUFFER: AI Agent Exploits Langflow RCE (CVE-2025-3248)

Patches

  • Langflow >= 1.3.0 (fixes CVE-2025-3248 by requiring authentication on /api/v1/validate/code)
  • Alibaba Nacos >= 1.4.1 (fixes CVE-2021-29441 AuthFilter authentication-bypass backdoor)

Immediate actions

  • Patch every internet-facing Langflow instance to version 1.3.0 or later, which requires authentication on /api/v1/validate/code (CVE-2025-3248).
  • Rotate and disable default MinIO credentials (minioadmin:minioadmin); enforce unique, strong credentials on all object storage.
  • Upgrade Alibaba Nacos to 1.4.1 or later, enable nacos.core.auth.enabled=true, and replace the default JWT signing key (nacos.core.auth.plugin.nacos.token.secret.key) (CVE-2021-29441).
  • Block outbound connections to 45.131.66.106 and 64.20.53.230 at the network perimeter/EDR and hunt for existing connections to them.
  • Search all Langflow/Nacos/MySQL hosts for crontab entries beaconing to unknown external hosts, particularly on port 4444.
  • Audit Nacos config_info / config_info_history tables and MySQL logs for unauthorized AES_ENCRYPT() calls, dropped schemas, or a README_RANSOM table; restore affected configuration from backup rather than engaging the ransom contact, since the encryption key was never exfiltrated by the actor.

Workarounds

  • If immediate patching of Langflow is not possible, restrict /api/v1/validate/code to trusted internal networks only via firewall or reverse-proxy ACL.
  • Change the Nacos JWT signing key even on already-patched versions, since the default key is publicly documented.
  • Enforce mandatory non-default credentials on all object storage (MinIO) and database/configuration services exposed to any network.

Longer-term hardening

  • Remove Langflow, Nacos, and MinIO administrative interfaces from direct internet exposure; place them behind VPN or a zero-trust access proxy.
  • Deploy runtime/behavioral threat detection (e.g., Falco-based rules) on AI-agent and database hosts to catch anomalous process execution and network beaconing.
  • Segment AI/LLM development infrastructure from production database and configuration-management systems so a compromise of one cannot directly pivot to the other.
  • Adopt a secrets manager for cloud and LLM-provider API keys and database credentials instead of storing them in plaintext files, environment variables, or database dumps reachable by application processes.
  • Build detection logic for agentic/LLM-driven attack patterns: unusually high-velocity, high-volume, self-correcting sequences of distinct exploitation payloads within short time windows.

CVEs associated with JADEPUFFER: AI Agent Exploits Langflow RCE (CVE-2025-3248)

CVE-2025-3248, CVE-2021-29441

Weaknesses (CWE) in JADEPUFFER: AI Agent Exploits Langflow RCE (CVE-2025-3248)

CWE-306, CWE-94, CWE-287, CWE-290, CWE-798

Timeline of JADEPUFFER: AI Agent Exploits Langflow RCE (CVE-2025-3248)

  • CVE-2021-29441, an authentication-bypass backdoor in Alibaba Nacos's AuthFilter servlet exploitable by spoofing the 'Nacos-Server' User-Agent header, is published to the GitHub Advisory Database (GHSA-36hp-jr8h-556f); fixed in Nacos 1.4.1, but the default JWT signing key and pre-1.4.1 deployments persist in many production environments.
  • Langflow maintainers implement an authentication requirement on the /api/v1/validate/code endpoint in the codebase, ahead of its formal release.
  • Langflow ships version 1.3.0, which fixes CVE-2025-3248 by enforcing authentication on /api/v1/validate/code.
  • CVE-2025-3248 is formally published by NVD and the GitHub Advisory Database (GHSA-rvqx-wpfh-mfx7), documenting the missing-authentication RCE in Langflow's /api/v1/validate/code endpoint with a CVSS 3.1 base score of 9.8.
  • Security researchers and Greynoise begin observing active in-the-wild exploitation attempts against internet-exposed Langflow instances via CVE-2025-3248, predating CISA's formal KEV addition on 2025-05-05.
  • CISA adds CVE-2025-3248 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation of unpatched, internet-facing Langflow instances.
  • CISA-mandated deadline for U.S. Federal Civilian Executive Branch (FCEB) agencies to remediate CVE-2025-3248 per the Known Exploited Vulnerabilities catalog listing.
  • Trend Micro and other researchers document a separate, human-operated campaign exploiting the same CVE-2025-3248 flaw to deploy the Flodrix DDoS botnet against unpatched Langflow servers, later contrasted with JADEPUFFER's fully autonomous agentic operation.
  • A second, unrelated unauthenticated RCE in Langflow, CVE-2026-33017 (GHSA-vwmf-pq79-vjvx, CVSS4 9.3), is disclosed in the /api/v1/build_public_tmp/{flow_id}/flow endpoint, which likewise passes attacker-controlled flow data to Python's exec() with no sandboxing; Sysdig separately reports observing exploitation of this second flaw within roughly 20 hours of disclosure, underscoring a recurring pattern of unauthenticated exec()-based RCE in internet-facing Langflow deployments distinct from the JADEPUFFER/CVE-2025-3248 chain documented here.
  • Microsoft observed two Storm-3168 (JADEPUFFER) attacks against Azure in June 2026 (exact day not stated; 1st used as placeholder). Using two compromised service principals and five concurrent OAuth tokens, the actor ran 150+ operations in 35 minutes and deleted 100+ storage accounts in about 7 minutes, plus Key Vaults, Function Apps, VMs and App Services; resource-locked and deletion-protected accounts survived.
  • Backdoor Nacos admin account 'xadmin' created at 19:34:24 UTC; initial login failed at 19:34:36 UTC due to a broken subprocess PATH in the agent's bcrypt invocation; agent switched to a direct Python bcrypt import and recreated the account between 19:34:48-19:35:07 UTC; login succeeded at 19:35:18 UTC (~31 seconds after failure).
  • Precise dating of the intrusion: JADEPUFFER's exploitation of CVE-2025-3248, lateral pivot, backdoor creation, encryption, and extortion all occurred on 2026-06-25, ahead of Sysdig's 2026-07-02 public disclosure.
  • ESET's WeLiveSecurity July 2026 monthly security roundup independently corroborates the Sysdig JADEPUFFER findings, describing it as 'the first case of an end-to-end ransomware operation executed by an agentic threat actor'; DarkReading, Infosecurity Magazine, and CyberScoop published additional coverage the same day.
  • Sysdig's Threat Research Team publishes 'JADEPUFFER: Agentic ransomware for automated database extortion,' documenting the first fully autonomous, end-to-end AI-agent-driven ransomware/database-extortion operation, with coordinated coverage from The Hacker News, BleepingComputer, The Register, SC Media, CyberPress, HackRead, and CyberSecurityNews.
  • Security Affairs, SOCFortress, and other outlets publish follow-on technical analysis of the JADEPUFFER campaign's TTPs and its implications for agentic-AI attack tooling.
  • A third wave of outlets, including GBHackers, WebProNews, DigitalWarfare, News4Hackers, and ThePCEnthusiast, publish additional analysis emphasizing Sysdig's warning that detection windows between initial exploitation and destructive impact may shrink from hours to minutes as agentic/LLM-driven attack tooling matures.
  • JADEPUFFER returns with ENCFORGE, a Go ransomware targeting ~180 AI-asset file extensions; Sysdig reports six corrective Python scripts in 5m24s (July 2026, exact day not stated; 15th used as placeholder).
  • Trend Micro publishes 'The Signs Were There: What the First Autonomous Ransomware Case Confirms,' an extended follow-up analysis of the JADEPUFFER case and its implications for autonomous-agent threats.
  • Microsoft Defender for Cloud publishes its Storm-3168 Azure report, citing IPs 45.131.66.106, 34.153.223.102 and 64.20.53.230.

Update history for TL-2026-1117

Sources cited for JADEPUFFER: AI Agent Exploits Langflow RCE (CVE-2025-3248)

Detection coverage for TL-2026-1117

As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1117 across Splunk SPL, Microsoft KQL and Sigma, covering 56 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
56 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats