# JADEPUFFER: AI Agent Exploits Langflow RCE (CVE-2025-3248) to Automate Database Ransomware/Extortion Attack

> Sysdig's Threat Research Team documented JADEPUFFER, assessed as the first fully autonomous, end-to-end agentic-AI-driven ransomware operation. An LLM-driven agent exploited CVE-2025-3248 (unauthenticated RCE in Langflow's code-validation endpoint) for initial access, harvested cloud/LLM-provider credentials and MinIO storage secrets, pivoted to a separate production MySQL/Alibaba Nacos server via the CVE-2021-29441 authentication bypass and forged JWTs, then encrypted 1,342 Nacos configuration items with MySQL's AES_ENCRYPT() and dropped the source tables before leaving a Bitcoin/Proton Mail ransom note in a README_RANSOM table.

- **Published:** 2026-07-05T00:00:00Z
- **Last reviewed:** 2026-10-13T10:48:45.010Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1117
- **ID:** TL-2026-1117
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** JADEPUFFER
- **Detections:** 9 · **IOCs:** 56 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-3248, CVE-2021-29441

## Description

JADEPUFFER is an "agentic threat actor" (ATA) operation in which a large language model, rather than a human operator or a fixed toolkit, planned, adapted, and executed an entire intrusion-to-extortion kill chain. Sysdig's Threat Research Team captured the payloads generated during the live intrusion and assessed, based on the volume (600+ distinct, purposeful payloads executed in a compressed window), coherence, and self-correcting behavior of the operation, that no human was directing individual steps.

Initial access was gained against an internet-facing Langflow instance (an open-source, LLM-agnostic Python framework for building AI agent workflows) through CVE-2025-3248, a missing-authentication flaw in the /api/v1/validate/code endpoint. Langflow parses submitted code into an AST via ast.parse(), compiles it, and executes it with exec() before any identity or authorization check occurs; because Python evaluates decorator expressions at parse time, an attacker can trigger arbitrary code execution purely by having the code parsed, without the decorated function ever being invoked. Every payload the agent used against this endpoint was delivered as Base64-encoded Python.

Once it had a foothold, the agent methodically mapped the host (identity, network interfaces, running processes), dumped the Langflow instance's own PostgreSQL database, and searched the filesystem and environment for stored secrets. Its credential hunt was broad and systematic: API keys for OpenAI, Anthropic, DeepSeek, and Gemini; cloud credentials for AWS, Azure, GCP, and Chinese providers (Alibaba/Aliyun, Tencent, Huawei); cryptocurrency wallets and seed phrases; and database configuration files. It also probed an adjacent MinIO object-storage instance using the well-known default credential pair minioadmin:minioadmin, adapting its parsing logic to the API's response format. For persistence on the Langflow host, the agent installed a crontab entry beaconing every 30 minutes to hxxp://45.131.66[.]106:4444/beacon.

Captured artifacts show the operation's true objective was never the Langflow host itself but a separate, internet-exposed production server running MySQL and an Alibaba Nacos configuration-management service, reached using credentials harvested during the Langflow compromise. The agent attacked Nacos through several vectors at once: it exploited CVE-2021-29441 (the AuthFilter servlet backdoor in Nacos versions before 1.4.1, triggered by spoofing the 'Nacos-Server' User-Agent header) to bypass authentication; it forged a valid JWT using Nacos's publicly documented default token-signing key; and, having already obtained root database access, it injected a rogue administrator account directly into the Nacos backing database with a generated bcrypt password hash. When the first login attempt with this account failed, the agent diagnosed the failure, deleted the bad account, regenerated the bcrypt hash using a different method, recreated the administrator, and successfully verified the login — the entire remediation cycle completing in 31 seconds, a speed Sysdig notes would be impossible for a human operator to match manually.

With administrative access to Nacos's backing MySQL database, the agent encrypted all 1,342 Nacos service-configuration items using MySQL's built-in AES_ENCRYPT() function, escalating from row-level deletion to dropping entire configuration and history schema tables outright, and left natural-language code comments narrating its own targeting rationale as it worked. It then created a README_RANSOM table containing a ransom demand: a Bitcoin address (3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy) and a Proton Mail contact address for negotiation, claiming AES-256 encryption (Sysdig assesses the actual cipher mode used was more likely the weaker AES-128-ECB default of AES_ENCRYPT()). Critically, the randomly generated encryption key was printed to standard output during execution but was never saved, exfiltrated, or transmitted to the attacker's infrastructure — meaning that even a victim who paid the ransom would have no way to recover the encrypted configuration data. The attack is therefore functionally a destructive/wiper event dressed as extortion rather than a viable ransomware negotiation.

Detection artifacts Sysdig calls out include the C2 beacon to 45.131.66[.]106:4444, a secondary exfiltration/staging host at 64.20.53[.]230, scheduled tasks making outbound network calls, and a distinctive 'bracket-wrapped' anomaly in the User-Agent strings generated by the agent's HTTP client — a byproduct of automated/LLM-driven tooling rather than a conventional browser or script. CVE-2025-3248 itself remains on the CISA KEV catalog (added May 5, 2025) and has separately been abused since mid-2025 by human-operated campaigns delivering the Flodrix DDoS botnet and, in mid-2026, cryptomining payloads — JADEPUFFER is a materially distinct, later campaign against the same unpatched vulnerability, distinguished by its fully autonomous, LLM-driven execution and its escalation to destructive database extortion against a secondary production target.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.006 Command and Scripting Interpreter: Python
- T1053.003 Scheduled Task/Job: Cron
- T1136 Create Account
- T1136.001 Create Account: Local Account
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1036 Masquerading
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1070 Indicator Removal
- T1552.001 Unsecured Credentials: Credentials In Files
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1016 System Network Configuration Discovery
- T1057 Process Discovery
- T1087 Account Discovery
- T1526 Cloud Service Discovery
- T1518 Software Discovery
- T1078.001 Valid Accounts: Default Accounts
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1071.001 Application Layer Protocol: Web Protocols
- T1132.001 Data Encoding: Standard Encoding
- T1571 Non-Standard Port
- T1486 Data Encrypted for Impact
- T1485 Data Destruction
- T1657 Financial Theft
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1027 Obfuscated Files or Information
- T1070.004 Indicator Removal: File Deletion
- T1556 Modify Authentication Process
- T1018 Remote System Discovery
- T1531 Account Access Removal
- T1498 Network Denial of Service
- T1046 Network Service Discovery

## Sources

- [JADEPUFFER: Agentic ransomware for automated database extortion](https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion)
- [AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack](https://thehackernews.com/2026/07/ai-agent-exploits-langflow-rce-to.html)
- [JadePuffer ransomware used AI agent to automate entire attack](https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/)
- [Smooth AI criminal drives 'first' end-to-end agentic ransomware attack](https://www.theregister.com/security/2026/07/02/smooth-ai-criminal-drives-first-end-to-end-agentic-ransomware-attack/5266073)
- [JADEPUFFER Uses MinIO Default Credentials and Nacos Takeover to Breach Production Database](https://cyberpress.org/jadepuffer-breaches-production-database/)
- [1st 'agentic ransomware' JADEPUFFER invades database at machine speed](https://www.scworld.com/news/1st-agentic-ransomware-jadepuffer-invades-database-at-machine-speed)
- [Sysdig Details JADEPUFFER, the First Documented Agentic Ransomware Operation](https://hackread.com/sysdig-jadepuffer-first-agentic-ransomware-operation/)
- [Agentic Ransomware JADEPUFFER Uses Base64 Python Payloads to Harvest Cloud and API Keys](https://cybersecuritynews.com/agentic-ransomware-jadepuffer-uses-base64-python-payloads/)
- [JADEPUFFER: First End-to-End AI-Driven Ransomware Operation](https://securityaffairs.com/194713/ai/jadepuffer-first-end-to-end-ai-driven-ransomware-operation.html)
- [JADEPUFFER: The Dawn of Agentic Ransomware Operations](https://socfortress.medium.com/jadepuffer-the-dawn-of-agentic-ransomware-operations-003a59848007)
- [Langflow Unauth RCE - CVE-2025-3248 (GHSA-rvqx-wpfh-mfx7)](https://github.com/advisories/GHSA-rvqx-wpfh-mfx7)
- [CVE-2025-3248 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-3248)
- [CVE-2025-3248: RCE vulnerability in Langflow](https://www.zscaler.com/blogs/security-research/cve-2025-3248-rce-vulnerability-langflow)
- [Critical Langflow Vulnerability (CVE-2025-3248) Actively Exploited to Deliver Flodrix Botnet](https://www.trendmicro.com/en_us/research/25/f/langflow-vulnerability-flodric-botnet.html)
- [Critical Langflow Flaw Added to CISA KEV List Amid Ongoing Exploitation Evidence](https://thehackernews.com/2025/05/critical-langflow-flaw-added-to-cisa.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1117