Sysdig Details AI-Agent-Assisted Ransomware Attack via Langflow
Summary
Sysdig reports that JadePuffer exploited CVE-2025-3248 in an exposed Langflow instance, using an LLM to find credentials, move to a production server, exploit Nacos, and encrypt 1,342 service configuration items.
Key points
- Sysdig says JadePuffer exploited CVE-2025-3248, a critical missing-authentication flaw, to gain code execution on an internet-exposed Langflow instance.
- The LLM-assisted activity searched for secrets, dumped Langflow’s Postgres database, scanned internal services, probed for MinIO, and installed a cron job for persistence.
- Sysdig observed the LLM adapting actions in real time, extracting credentials from different file types, and logging into discovered endpoints.
- The actor pivoted to a production server hosting MySQL and Nacos, using root database credentials and Nacos authentication-bypass and JWT-forgery techniques, according to Sysdig.
- The attack injected a backdoor Nacos administrator and encrypted 1,342 service configuration items; Sysdig says the randomly generated encryption key was not saved or transmitted.
- Sysdig says analyzed payloads showed the LLM correcting failed actions and responding to free-text context; it warns defenders to secure exposed application servers, configuration stores, and internet-facing database administration accounts.
Article Details
- Attack Vectors
- JadePuffer exploited CVE-2025-3248 to access an internet-exposed Langflow instance and execute Python code on its host.
- The actor used the LLM to search files and configuration data for secrets, dump the Langflow Postgres database, scan reachable internal addresses and services, and probe for MinIO addresses.
- A cron job was deployed to maintain access to the Langflow server.
- The actor used root credentials to reach a production server and targeted Nacos through an authentication bypass, JWT forgery using its default signing key, and injection of a backdoor administrator into the backing database.
- The attack encrypted 1,342 Nacos service configuration items and included an extortion demand.
- Defensive Notes
- Sysdig advises treating exposed application servers, unhardened configuration stores, and internet-facing database administrator accounts as priority attack surfaces.
- The article highlights the risk of Nacos's well-known default JWT signing key and recommends attention to configuration-store hardening.
MITRE ATT&CK
T1018 · Remote System DiscoveryThe actor scanned reachable internal address space.T1046 · Network Service DiscoveryThe actor scanned named services and probed for MinIO addresses.T1053.003 · CronJadePuffer deployed a cron job for persistent access to the Langflow server.T1059.006 · PythonThe exploited Langflow vulnerability allowed arbitrary Python code execution on the host.T1078 · Valid AccountsThe LLM used discovered credentials to log into endpoints, and the actor connected to the production server with root credentials.T1098 · Account ManipulationThe actor injected a backdoor administrator into the Nacos backing database.T1190 · Exploit Public-Facing ApplicationJadePuffer exploited CVE-2025-3248 to access an internet-exposed Langflow instance.T1213 · Data from Information RepositoriesJadePuffer dumped Langflow's Postgres database to harvest secrets stored in it.T1485 · Data DestructionSysdig reports captured payloads that escalated from row-level deletion to dropping entire database schemas.T1486 · Data Encrypted for ImpactThe attack encrypted 1,342 Nacos service configuration items.T1552.001 · Credentials In FilesThe LLM searched files and configuration data for API keys, cloud credentials, and database credentials.
CVE
CVE-2021-29441“That includes exploiting the auth-bypass family (CVE-2021-29441), forging a valid JWT using Nacos’s well-known default signing key, and, with root database access, injecting a backdoor administrator directly into theCVE-2025-3248as JadePuffer gained access to an internet-exposed Langflow instance through the exploitation of CVE-2025-3248 (CVSS score of 9.8), a critical missing authentication vulnerability disclosed in April.
Threat Actors
Products
LangflowA threat actor exploited a vulnerability in Langflow to access an organization’s instance and abuse it in an agentic ransomware attack, cloud security firm Sysdig reports.MySQLDuring the second phase of the attack, JadePuffer used the LLM to pivot to a production server hosting a MySQL database and an Alibaba Naming and Configuration Service (Nacos) configuration platform.NacosDuring the second phase of the attack, JadePuffer used the LLM to pivot to a production server hosting a MySQL database and an Alibaba Naming and Configuration Service (Nacos) configuration platform.PostgresNext, the threat actor dumped Langflow’s Postgres database to harvest the secrets in it, scanned the reachable internal address space and named services, probed for MinIO addresses for further credential extraction, and