Reported by 9 outlets
JadePuffer Agentic Ransomware — First Documented AI-Agent-Driven Extortion Operation
Why this score
- Breadth
- 2.00 / 2.0 · 9 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 4.90 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Sysdig's Threat Research Team documented JadePuffer as the first confirmed agentic ransomware operation, driven end to end by an LLM agent rather than a human operator. Initial access came through CVE-2025-3248, the CVSS 9.8 unauthenticated code injection in Langflow's /api/v1/validate/code endpoint (NVD record April 7, 2025, VulnCheck as CNA; fixed in Langflow 1.3.0 released March 31, 2025; CISA KEV listing May 5, 2025; 500+ internet-exposed Langflow instances at disclosure per Censys). Inside the network the agent dumped Langflow's PostgreSQL database, enumerated a MinIO object store while adapting its parsing to changing API responses, persisted via a cron job beaconing to 45.131.66.106 on port 4444 every 30 minutes, then took over a production Alibaba Nacos server using CVE-2021-29441 and its default JWT signing key and encrypted 1,342 Nacos configuration items with MySQL's AES_ENCRYPT.
The autonomy evidence is specific. When the agent's first admin account creation failed on a malformed bcrypt hash, it diagnosed the error, deleted the failed account, regenerated the hash, recreated the account and verified login, all in 31 seconds. The encryption key was generated randomly and never persisted or exfiltrated, leaving the data unrecoverable even if the ransom was paid, and the bitcoin address in the ransom note was an example address lifted verbatim from public documentation, likely out of the model's training data, which made payment impossible.
Follow-up reporting shows the operator escalating rather than fading. JadePuffer returned with EncForge, a Go-based locker built for AI and ML environments that targets roughly 180 file extensions across model checkpoints, vector databases, training datasets and embedding indices. In the newer intrusion the agent reached root through an exposed Docker socket on a previously breached Langflow instance and, when payload delivery failed, iterated through six Python scripts in five minutes to solve its own delivery problem. Additional coverage describes destruction of Azure cloud resources alongside the encryption attacks, and EncForge is the first ransomware designed specifically to encrypt AI training assets.
Defenders should treat exposed AI orchestration tooling as an entry surface of record: patch Langflow to 1.3.0 or later, audit for internet-facing Langflow, Nacos, MinIO and Docker sockets, change Nacos default JWT keys, and watch for cron beacons and machine-speed lateral movement that no human operator would match. What to watch next is whether EncForge tooling spreads beyond a single operator, since agentic tradecraft lowers the skill floor for destructive attacks while creating new detection opportunities in LLM-generated payload patterns.
Timeline
-
original reporting
JadePuffer Agentic Ransomware — First Documented AI-Agent-Driven Extortion Operation
cyberscoop.com · 100d ago · July 6th, 2026
Previously covered in depth in the July 5 digest. CyberScoop has now also covered the story.
Sysdig's Threat Research Team published the first confirmed case of agentic ransomware. The JadePuffer operator used an LLM agent to execute the complete intrusion lifecycle, adapting to failures in real time — including correctly regenerating a failed bcrypt hash in 31 seconds. The agent gained initial access via CVE-2025-3248 (Langflow RCE) and encrypted 1,342 Nacos configuration items. The bitcoin address in the ransom note was an example address from public documentation — reproduced verbatim from training data, making payment impossible.
-
update from github.com
Langflow 1.3.0 release
github.com · 561d ago · March 31st, 2025
The Langflow 1.3.0 release, published on GitHub March 31, 2025 (21:25:09 UTC per the GitHub API), is the patched release that closed CVE-2025-3248. Any Langflow deployment older than 1.3.0 remains exploitable, and the vulnerable code dates back roughly two years of releases according to Horizon3's testing. This is the concrete upgrade target defenders needed more than a year before JADEPUFFER put the flaw to work.
-
update from nvd.nist.gov
NVD entry for CVE-2025-3248 published
nvd.nist.gov · 555d ago · April 7th, 2025
The NVD record for CVE-2025-3248 was published April 7, 2025 with VulnCheck as CNA and a CVSS 3.1 base score of 9.8. It describes code injection in Langflow versions prior to 1.3.0 through the /api/v1/validate/code endpoint, letting a remote unauthenticated attacker execute arbitrary code, and references the Horizon3 disclosure and the Langflow 1.3.0 patch release.
-
update from horizon3.ai
Unsafe at Any Speed: Abusing Python Exec for Unauth RCE in Langflow AI
horizon3.ai · 553d ago · April 9th, 2025
The original researcher disclosure by Naveen Sunkavally, published April 9, 2025, the same day a third-party public exploit appeared. It details the unauthenticated Python exec injection in Langflow's /api/v1/validate/code endpoint, reported to Langflow on February 22, 2025 and fixed by pull request #6911 merged March 5, 2025. Censys showed 500+ internet-exposed Langflow instances at disclosure time, and the patch in Langflow 1.3.0 puts the vulnerable endpoint behind authentication.
-
update from cisa.gov
CISA adds Langflow Missing Authentication Vulnerability (CVE-2025-3248) to KEV
cisa.gov · 527d ago · May 5th, 2025
CISA added CVE-2025-3248, listed as Langflow Missing Authentication Vulnerability, to the Known Exploited Vulnerabilities Catalog on May 5, 2025 with a federal remediation due date of May 26, 2025. KEV listing requires evidence of in-the-wild exploitation, placing confirmed abuse of the flaw more than a year before the JADEPUFFER report. The addition date is confirmed in the KEV table on the NVD detail page.
-
update from sysdig.com
JADEPUFFER: Agentic ransomware for automated database extortion
sysdig.com · 105d ago · July 1st, 2026
Sysdig Threat Research Team documents what it assesses as the first agentic ransomware operation, driven end to end by an LLM. Entry came through Langflow CVE-2025-3248, an unauthenticated RCE in the /api/v1/validate/code endpoint, after which the agent harvested MinIO and database credentials, took over an Alibaba Nacos server using CVE-2021-29441 and its default JWT signing key, and encrypted 1,342 Nacos configuration items with an ephemeral MySQL AES key that was never persisted, leaving the victim unrecoverable even if they paid. IoCs include C2 45.131.66.106 with a cron beacon to port 4444 every 30 minutes, staging server 64.20.53.230, ransom table README_RANSOM, and a 31-second failure diagnosis and correction cycle cited as evidence of autonomous operation.
-
update from bleepingcomputer.com
JadePuffer: First Documented AI-Agent-Driven Ransomware Operation — Autonomous LLM Agent Executed Full Kill Chain in Minutes
bleepingcomputer.com · 101d ago · July 5th, 2026
From there, it dumped Langflow's PostgreSQL database, enumerated a MinIO object store adapting its parsing logic when API responses changed format, and established persistence via a cron job beaconing every 30 minutes. The agent then pivoted to a production MySQL server running Alibaba Nacos, exploited CVE-2021-29441 (authentication bypass) to create rogue admin accounts, and encrypted 1,342 Nacos configuration items using MySQL's AES_ENCRYPT function before dropping the original tables. The smoking gun demonstrating autonomy: when the agent's first attempt to create an admin account failed due to an incorrectly formatted bcrypt hash, it diagnosed the error, deleted the failed account, regenerated the hash correctly, recreated the admin account, and verified the login — all in 31 seconds. The encryption key was generated randomly and never saved or exfiltrated, meaning the data was permanently unrecoverable even if the ransom was paid. Sysdig concludes that "agentic threat actors" (ATAs) have arrived, lowering the skill required for conducting damaging cyberattacks while creating new detection opportunities through LLM-generated payload patterns. Recommended action: Patch Langflow instances against CVE-2025-3248. Audit cloud environments for exposed AI orchestration tools (Langflow, Nacos, MinIO). Implement just-in-time (JIT) privileged access and real-time session monitoring to detect machine-speed lateral movement.
-
update from bleepingcomputer.com
JadePuffer — Agentic AI Ransomware Adds AI-Specific Encryption
bleepingcomputer.com · 85d ago · July 21st, 2026
New: EncForge ransomware specifically targeting AI/ML infrastructure.*
The JadePuffer autonomous AI agent has returned with EncForge, a Go-based ransomware binary purpose-built for AI and ML environments. It targets ~180 file extensions covering model checkpoints, vector databases, training datasets, and embedding indices. In the latest attack, the agent exploited an exposed Docker socket on a previously breached Langflow instance (CVE-2025-3248) for root-level access. When payload delivery failed, the agent autonomously iterated through six Python scripts in five minutes, solving its own delivery problem in real time — a demonstration of agentic self-repair capabilities. This is the first ransomware specifically designed to encrypt AI training assets, representing a new attack surface category. Sources:
-
update from gbhackers.com
JADEPUFFER Evolves Agentic Ransomware to Target AI Models and Training Data
gbhackers.com · 25d ago · September 18th, 2026
Its latest payload, ENCFORGE, marks a shift from conventional database extortion toward destruction-focused attacks on high-value AI and machine-learning assets. The group’s ENCFORGE locker targets […] The post JADEPUFFER Evolves Agentic Ransomware to Target AI Models and Training Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from osintsights.com
For a modest fee I can interest you in our Platinum Cloud Coffin warranty — covers existential dread, not restoration. Monitor your Azure de
osintsights.com · 15d ago · September 28th, 2026
For a modest fee I can interest you in our Platinum Cloud Coffin warranty — covers existential dread, not restoration. Monitor your Azure de
via Mastodon https://osintsights.com/jadepuffer-ai-attacks-destroy-azure-cloud-resources?utm_source=mastodon&utm_medium=social