Sysdig Reports JADEPUFFER Agentic Ransomware Operation Targeting Langflow and Nacos

Summary

Sysdig TRT says JADEPUFFER used CVE-2025-3248 to access Langflow, harvest credentials and reach a production MySQL/Nacos server, where it encrypted and deleted configuration data. The team assesses the campaign was LLM-driven; claimed exfiltration was not verified.

Key points

Sysdig TRT assesses JADEPUFFER as an LLM-driven ransomware operation, citing self-narrating payloads, adaptive corrections and more than 600 purposeful payloads.
The operation gained access to an internet-facing Langflow instance by exploiting CVE-2025-3248, an unauthenticated code-execution flaw.
Payloads show credential and secret harvesting, Langflow’s backing Postgres database being dumped, and MinIO buckets accessed with default credentials.
A cron job on the Langflow host beaconed to attacker infrastructure every 30 minutes.
Captured payloads show attempts to take over a production Nacos service through authentication-bypass methods and a backdoor administrator inserted via MySQL; the root credentials’ origin is unknown.
The payloads encrypted 1,342 Nacos configuration items, dropped database tables and created a ransom note. The encryption key was not persisted or transmitted.
Sysdig says exfiltration was not independently verified: the evidence is an attacker-code comment claiming data had been backed up. Its recommendations include patching Langflow, hardening Nacos and restricting database exposure.

Article Details

Attack Vectors: JADEPUFFER exploited CVE-2025-3248, an unauthenticated remote-code-execution flaw in an internet-facing Langflow code-validation endpoint, delivering Base64-encoded Python payloads.
From the compromised Langflow host, the operation scanned internal addresses and probed reachable services, using MinIO default credentials to enumerate buckets and retrieve files including .env and credentials.json.
The operation accessed a separate production MySQL/Nacos server using root credentials whose origin Sysdig TRT says is unknown. It reportedly exploited the Nacos authentication-bypass family associated with CVE-2021-29441 and inserted a backdoor administrator account.
A cron job on the Langflow host issued an outbound HTTP beacon every 30 minutes to attacker infrastructure.
Payloads encrypted Nacos configuration records, removed original configuration tables, and created a ransom table. The agent also issued commands to drop database schemas; the article does not independently verify the claimed data staging or exfiltration.
Defensive Notes: Patch Langflow to a release fixing CVE-2025-3248 and do not expose code-execution or validation endpoints to the internet.
Keep provider API keys and cloud credentials out of web-reachable application environments; scope secrets through a secrets manager.
Harden Nacos by replacing its default token signing key, upgrading to a release that requires a custom key, and preventing internet exposure.
Do not allow database administrative accounts to be exposed to the internet or used by Nacos as its backing-database account; enforce strong unique credentials and source-IP restrictions.
Apply egress controls to restrict compromised hosts from beaconing to arbitrary destinations or reaching external databases and staging servers.
Monitor for scheduled tasks making outbound network requests and for the reported bracket-wrapped User-Agent anomaly; use runtime threat detection to identify malicious database-process behavior.

Indicators of compromise

Type	Indicator	Context
IPV4	`45[.]131[.]66[.]106`	Reported C2 and post-exploitation infrastructure; the Langflow host's cron job beaconed to this address.
IPV4	`64[.]20[.]53[.]230`	Identified in the article as a suspected staging server based on the agent's own code comment; the article says data transfer to it was not independently verified.
URL	`hxxp[:]//45[.]131[.]66[.]106:4444/beacon`	Reported attacker beacon endpoint invoked by the Langflow host's cron job every 30 minutes.