Researchers Say JadePuffer Ransomware Used an AI Agent to Run the Attack

Summary

Sysdig researchers say JadePuffer used an LLM agent across a ransomware attack, from exploiting CVE-2025-3248 in Langflow to encrypting 1,342 Alibaba Nacos configuration items. They call it the first documented operation of its kind.

Key points

Sysdig researchers describe JadePuffer as the first documented ransomware operation conducted entirely by an LLM agent; this is their assessment.
The operation began with exploitation of CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow.
After gaining code execution, the agent collected credentials and host data, enumerated a MinIO object store, and installed a cron job for persistence.
The attacker pivoted to a production Alibaba Nacos server using root credentials; Sysdig could not determine where those credentials came from.
Payloads targeting Nacos included one exploiting CVE-2021-29441, an authentication bypass that can create rogue administrator accounts.
The researchers say the ransomware encrypted 1,342 Nacos configuration items and deleted the originals. The ransom note claimed AES-256, but Sysdig considered AES-128-ECB more likely.
Sysdig says the encryption key was randomly generated but not stored or sent to the attacker; it also noted that the payment address appeared to be a public example address.

Article Details

Attack Vectors: The operation gained initial access by exploiting CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow.
After accessing Langflow, the attacker pivoted to a production MySQL server running Alibaba Nacos using root credentials.
A Nacos payload exploited CVE-2021-29441, an authentication bypass vulnerability that creates rogue administrator accounts.
The operation installed a cron job on the Langflow host to beacon to attacker infrastructure every 30 minutes.
JadePuffer encrypted 1,342 Nacos service configuration items and deleted the originals.
Defensive Notes: The Langflow vendor fixed CVE-2025-3248 on 2025-04-01; CISA tagged it as exploited in attacks in early May 2025.