Sysdig Reports First Documented Agentic Ransomware Operation

Summary

Sysdig says JadePuffer used an AI agent in a ransomware operation against an unnamed production server, exploiting Langflow CVE-2025-3248. Researchers describe more than 600 payloads, rapid adaptation, and continued human involvement.

Key points

Sysdig reports JadePuffer as the first documented case of agentic ransomware; the victim was not named.
The operation gained initial access by exploiting CVE-2025-3248 in Langflow and targeted a production server running MySQL and Alibaba Nacos.
The AI agent handled stages including reconnaissance, credential theft, lateral movement, persistence, encryption, destruction, and ransom-note delivery.
Researchers observed more than 600 purposeful payloads; the agent reportedly corrected and redeployed a failed payload within 31 seconds.
Sysdig found evidence that the operation used multiple AI models and accessed keys for OpenAI, Anthropic, DeepSeek, and Gemini.
A human set up and directed the operation, provisioned infrastructure, and chose the victim, according to Sysdig.

Article Details

Attack Vectors: JadePuffer gained initial access by exploiting CVE-2025-3248 in Langflow.
The AI agent carried out reconnaissance, credential theft, lateral movement, persistence, encryption, destruction, and ransom-note delivery.
The agent accessed the victim's MySQL server using root credentials that Sysdig said were obtained through a prior compromise, not from the victim's environment.
A human operator set up and directed the operation and provisioned its command-and-control and stolen-data staging infrastructure.