Threat video1:00
JADEPUFFER Langflow-to-Nacos Pivot: Detection & IOCs
An LLM agent exploited Langflow CVE-2025-3248, then pivoted to Nacos and encrypted 1,342 configs. 9 detection rules, 52 IOCs and a free Splunk SPL rule.
Read the full threat intel for JADEPUFFER Langflow-to-Nacos Pivot: Detection & IOCs →
Chapters
- 0:00The hookLangflow ransomwares, rated CVSS 9.8.
- 0:05The storyAn LLM-driven agent exploited.
- 0:11Attack pathExploit Langflow RCE.
- 0:24AttributionAttributed to JADEPUFFER.
- 0:29Indicators of compromise9 indicators to hunt: 3 IPs, 2 URLs and 1 file name, and more.
- 0:37MITRE ATT&CK techniques59 ATT&CK techniques, from reconnaissance to impact.
- 0:42Remediation6 steps now: Patch every internet-facing Langflow instance to version.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Langflow ransomwares, rated CVSS 9.8.
0:05An LLM-driven agent exploited.
0:07For persistence on the Langflow host.
0:12Exploit Langflow RCE.
0:13Execute Python malware.
0:15Map host and environment.
0:25Attributed to JADEPUFFER. Confidence: medium.
0:309 indicators to hunt: 3 IPs, 2 URLs and 1 file name, and more.
0:3759 ATT&CK techniques, from reconnaissance to impact.
0:426 steps now: Patch every internet-facing Langflow instance to version.
0:509 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.