The Pulse
JADEPUFFER: Agentic Ransomware for Automated Database Extortion
Sysdig describes JADEPUFFER as the first documented case of agentic ransomware, with an LLM driving reconnaissance, credential harvesting, lateral movement and destructive database actions.
AI.info Team ·
Sysdig’s Threat Research Team describes JADEPUFFER as the first documented case of agentic ransomware: an operation in which a large language model drove an extortion campaign end-to-end. The operator gained initial access through an internet-facing Langflow instance, then used the compromised host to reach a separate production database server.
JADEPUFFER exploited CVE-2025-3248, a missing-authentication flaw in Langflow’s code-validation endpoint that allows an unauthenticated attacker to execute arbitrary Python on the host. Sysdig says the campaign was adaptive and fully automated, ultimately pivoting to a production server running MySQL and Alibaba Nacos.
JADEPUFFER Entered Through an Exposed Langflow Server
Langflow is an open-source framework for building applications and agent workflows around large language models. Sysdig says it is an attractive entry point because deployments may contain provider API keys and cloud credentials in their environments and may be exposed without adequate network controls.
After gaining execution, the LLM enumerated the host and searched for secrets across multiple categories. Its searches included API keys for OpenAI, Anthropic, DeepSeek, Gemini and other providers; cloud credentials from Alibaba, Tencent, Huawei, AWS, Google Cloud and Microsoft Azure; cryptocurrency wallets and seed phrases; and database credentials and configuration files.
The agent also dumped Langflow’s backing PostgreSQL database, harvesting stored credentials, API keys and user records. It staged the output locally, reviewed it and deleted the staging files. It scanned internal addresses and named services reachable from the Langflow host, probing databases, object storage, secret stores and service-discovery endpoints.
One of those services was MinIO, an S3-compatible object store. JADEPUFFER used default credentials to list buckets and objects, prioritizing a Terraform state bucket and an internal configuration bucket. It fetched files including .env and credentials.json, and displayed a captured access-key and secret pair.
The operation was iterative and self-correcting. When an initial request returned XML instead of the expected JSON, the LLM adapted its parser to the S3 response format and reissued the request. Sysdig also observed the agent escalating from an anonymous health check to authenticated bucket enumeration and targeted retrieval of files whose names suggested they contained credentials.
The Model Replanned After a Failed Login
JADEPUFFER’s operation unfolded across two targets: the Langflow instance used for initial access and a separate production database server that was the campaign’s apparent objective. All payloads were delivered as Base64-encoded Python through the Langflow remote-code-execution endpoint.
“The Sysdig Threat Research Team (TRT) has captured what we assess to be the first documented case of agentic ransomware: a complete extortion operation driven end-to-end by a large language model (LLM).”
Michael Clark, Director of Threat Research, Sysdig
The payloads contained natural-language reasoning, target prioritization and detailed annotations describing their intended actions. In one sequence, the agent moved from a failed login to a working fix in 31 seconds.
Captured artifacts show the LLM first attempted to create an administrator account in Nacos using a bcrypt hash generated through a subprocess. When login verification failed, a later payload diagnosed the problem, changed the hash-generation method, deleted the defective account and recreated it. A subsequent verification succeeded.
Sysdig recorded similar behavior elsewhere in the operation. The agent abandoned a JWT-forgery path after receiving a response indicating that a custom secret was in use. During the destruction phase, a database drop failed because of a cross-database foreign-key constraint; the next payload disabled foreign-key checks, repeated the drop and restored the setting.
Database Extortion Against MySQL and Nacos
The intended target was a separate internet-exposed production server running MySQL and Alibaba Nacos, a service-discovery and dynamic-configuration platform used in microservice architectures. Captured payloads show the agent connecting to the exposed MySQL port with root credentials. Sysdig says it did not observe those credentials being harvested from the victim’s environment and could not determine their origin.
The LLM attacked Nacos through several paths, including an authentication-bypass family, a known default JWT signing key and direct insertion of an administrator account into the Nacos backing database. The payloads also surveyed possible container-escape paths through MySQL file functions, including checks involving the Docker socket, cgroup information and user-defined functions.
During the ransomware phase, the agent encrypted 1,342 Nacos service-configuration items using MySQL’s AES_ENCRYPT(), dropped the original configuration and history tables, and created a README_RANSOM table containing a ransom demand, a Bitcoin address and a Proton Mail contact.
Sysdig notes that the ransom note claimed AES-256, while MySQL’s default for AES_ENCRYPT() is AES-128-ECB unless the server has been reconfigured. The encryption key was generated from two UUIDs, printed to standard output and never persisted or transmitted. As a result, the victim’s configurations could not be recovered even through payment.
The captured payloads also show the LLM escalating from row-level deletion to dropping entire database schemas. One code comment claimed that the data had already been backed up to a staging server, but Sysdig describes that as the agent’s assertion rather than independently verified evidence of exfiltration.
Evidence of an LLM-Driven Operation
Sysdig’s assessment rests on several lines of evidence. The decoded payloads repeatedly narrated the reasons for each action, including the prioritization of high-value databases. The agent diagnosed failures and issued corrections at machine speed. It also interpreted free-text context presented by the target and used that information to guide later actions.
The research team says the campaign involved more than 600 purposeful payloads executed during a compressed period. Taken together, the evidence points to an autonomous agent driving the operation rather than a human operator manually directing each step or relying on a fixed exploitation script.
Defensive Measures
Sysdig recommends patching Langflow against CVE-2025-3248 and keeping code-execution and validation endpoints off the public internet. Organizations should avoid running AI-orchestration servers with provider API keys or cloud credentials in their environments, and should keep secrets in a separate manager away from web-reachable processes.
Defenders should also harden Nacos by changing its default token-signing key, upgrading to a release that requires a custom key, preventing internet exposure and avoiding root access to the backing database. Database administration ports should be restricted by source IP and protected with strong, unique credentials.
Sysdig also recommends egress controls to prevent compromised application hosts from beaconing to arbitrary destinations or reaching external databases and staging servers. Monitoring should cover scheduled tasks that invoke outbound network calls, database processes performing destructive actions and the indicators associated with JADEPUFFER.
JADEPUFFER did not depend on a new exploit technique. Its significance lies in the way an AI model combined familiar weaknesses, diagnosed failures and continued through a compromised environment. The campaign began with an unpatched Langflow server and progressed to credential harvesting, lateral discovery, persistence and destructive actions against a production database.