JADEPUFFER — First Documented Agentic (AI-Driven) Ransomware

On 2026-07-01 the Sysdig Threat Research Team published what it assesses to be the first documented end-to-end agentic ransomware operation, tracking the operator as JADEPUFFER. An LLM-driven agent — not a human running a toolkit — carried the entire kill chain: initial access, reconnaissance, credential theft, lateral movement, and a destructive database-extortion payload.

Initial access was gained against an internet-facing Langflow instance via CVE-2025-3248, a missing-authentication flaw in Langflow's code-validation endpoint that lets an unauthenticated attacker run arbitrary Python on the host (CVSS 9.8; patched 2025-04-01; CISA KEV since May 2025). From the Langflow host the agent swept environment variables for LLM-provider, cloud (AWS/GCP/Azure/Alibaba) and database credentials, dumped Langflow's backing PostgreSQL database, enumerated a MinIO object store using default credentials, and installed a crontab beacon to its C2. It then pivoted to a production MySQL / Alibaba Nacos server, exploited Nacos auth-bypass CVE-2021-29441 and forged JWTs with Nacos's default signing key, injected a backdoor admin account, probed for container escape via MySQL file primitives, then AES-encrypted 1,342 Nacos configuration items, DROPped the originals, and wrote a README_RANSOM extortion table.

The defensive story here is behavioral, not atomic. The agent generates and adapts its own code on the fly, so file hashes and much of the tooling are ephemeral; the durable signal is the sequence — a public-facing AI/data service process spawning shells, sweeping secrets, beaconing on a cron, and a database engine reaching for docker.sock, AES_ENCRYPT(), and mass DROP. This pack prioritizes those behaviors on Linux/container telemetry.

Defender priority: Any process whose parent is a Langflow / Python-web / AI-orchestration service spawning id/uname/whoami, reading .env/credentials.json, or writing a crontab entry that calls out to a raw IP is a Sev-1 hunt lead. Confirm CVE-2025-3248 is patched on every internet-reachable Langflow instance today — it is the single door JADEPUFFER walked through.

Provenance note: The technical detail traces to a single primary vendor source (Sysdig). Atomic infrastructure IOCs are Sysdig-attributed but perishable, and Sysdig explicitly could not independently confirm exfiltration to the reported staging host — treat that indicator as the agent's own claim. The ransom Bitcoin address reported in some secondary coverage matches the well-known canonical Bitcoin example address; it is deliberately excluded from the machine-readable blocklist below pending confirmation. Prefer the behavioral detections in §8 over atomic IOCs.

Hunt hypotheses (ordered by fidelity)

1. H1 (high): A Langflow / Python-web service process spawns interactive shells or host-recon binaries (id, uname, hostname, whoami) — the direct signature of CVE-2025-3248 code execution.
2. H2 (med): The same web-service account reads credential material — .env, credentials.json, cloud-CLI config — or bulk-dumps environment variables looking for API keys.
3. H3 (med): A web-service account installs cron persistence whose command is a Python one-liner beaconing to a raw IP (port 4444, ~30-min interval).
4. H4 (med): Outbound connections from a web-service process to internal object-store / service-discovery ports (MinIO 9000, Nacos 8848) — the agent's internal enumeration with default creds.
5. H5 (med): A MySQL/MariaDB client or the db engine reaches for container-escape file primitives (/var/run/docker.sock, /proc/1/cgroup) or runs AES_ENCRYPT() / mass DROP TABLE/DROP DATABASE.
6. H6 (low): Nacos exploitation indicators — process or network activity consistent with CVE-2021-29441 auth-bypass and backdoor-admin creation (xadmin).
7. H7 (low, perishable): Connections to the Sysdig-reported C2 / staging IPs.

Attack chain

All atomic IOCs are Sysdig-attributed and perishable — hunt/enrich only, do not build durable blocks on them. Behavioral artifacts (bottom rows) are the reliable signal.

Excluded: The ransom Bitcoin address circulated in secondary coverage matches the canonical Bitcoin documentation example address and could not be independently confirmed as attacker-controlled — omitted from the blocklist to avoid a false indicator.

• Langflow version audit: On every internet-reachable Langflow host, confirm version > the CVE-2025-3248 fix (patched 2025-04-01). Any pre-patch, exposed instance is presumed-compromised until proven otherwise.
• Cron review: for u in $(cut -f1 -d: /etc/passwd); do crontab -l -u "$u" 2>/dev/null; done and inspect /etc/cron.*, /var/spool/cron/ for Python one-liners calling urllib.request.urlopen to a raw IP.
• Nacos audit: Enumerate Nacos user accounts; flag any unexpected admin (e.g. xadmin). Confirm the default JWT signing key token.secret.key has been rotated from the documented default and that nacos.core.auth.enabled=true.
• MinIO audit: Confirm root credentials are not minioadmin:minioadmin; review access logs for anonymous ListBuckets/GetObject.
• Database review: On MySQL/MariaDB config servers, check for a README_RANSOM table, a config_info_enc table, and recent DROP TABLE config_info / DROP DATABASE in the general/binary logs.
• Secrets exposure: Grep application dirs for world-readable .env / credentials.json reachable by the web-service user.

Because the operator is an adaptive AI agent, favor IOAs keyed on behavioral sequences and parent/child lineage over static string/hash IOCs — the latter will not survive the next run.

type,value,action,severity,expiration,description,tags
ipv4,45.131.66.106,detect,high,2026-10-12,JADEPUFFER C2 beacon port 4444 (perishable),campaign:JADEPUFFER
ipv4,64.20.53.230,detect,medium,2026-10-12,JADEPUFFER reported staging (exfil unconfirmed),campaign:JADEPUFFER

# Langflow/python web-svc parent -> shell/recon child (CVE-2025-3248 RCE)
# Web-svc account reading .env / credentials.json / env-sweep for API keys
# Cron entry = inline python urllib beacon to raw IP:4444 (~30 min)
# mysql client running LOAD_FILE(docker.sock|/proc/1/cgroup) / AES_ENCRYPT / mass DROP
# New Nacos admin account 'xadmin'; tables README_RANSOM / config_info_enc

CVE-2025-3248   Langflow unauth RCE (initial access)
CVE-2021-29441  Nacos auth bypass (lateral)
README_RANSOM   extortion table
config_info_enc encrypted Nacos config table
xadmin          backdoor Nacos admin account
e78393397@proton.me   ransom contact (enrich only)

# Langflow > CVE-2025-3248 fix, NOT internet-exposed w/o auth
# Nacos: rotate default token.secret.key; nacos.core.auth.enabled=true
# MinIO: root creds != minioadmin:minioadmin
# MySQL: secure_file_priv set; no FILE priv for app accounts
# Rotate any LLM/cloud/db creds that lived in exposed .env

Atomic IPs are detect with a short (3-month) expiry because they are perishable; re-validate before the expiry. The ransom Bitcoin address is intentionally absent (matches the canonical Bitcoin example address — unconfirmed).

• Telemetry ready: Confirm a Falcon Linux sensor is on every internet-facing Langflow / AI-orchestration host and on MySQL/Nacos config servers. Containerized Langflow needs container-runtime visibility.
• Benign baseline: Run Q1/Q2 in monitor for 3–7 days; catalog any legitimate in-app subprocess/secret-read behavior before promoting to Prevent.
• Positive test: In a lab, trigger a benign subprocess from Langflow (e.g. a flow that runs id) and confirm Q1 fires; add a cron entry with an inline urllib callout and confirm Q3 fires.
• Promotion: Q1, Q3, Q6 are Prevent candidates after baseline. Q2, Q4, Q5 stay Detect/hunt. Q7 is a perishable enrichment feed.

1 · Find exposed / vulnerable Langflow and cron beacons (Linux, run per host)

# Langflow version (adjust to your deploy method)
pip3 show langflow 2>/dev/null | grep -i version
docker ps --format '{{.Image}}' | grep -i langflow

# Cron beacon sweep — inline python urllib callouts
for u in $(cut -f1 -d: /etc/passwd); do crontab -l -u "$u" 2>/dev/null; done \
  | grep -Ei 'urllib|urlopen|/beacon'
grep -REi 'urllib|urlopen|/beacon' /etc/cron.* /var/spool/cron/ 2>/dev/null

2 · Audit MinIO / Nacos defaults

# MinIO: confirm root is not the default
grep -Ei 'MINIO_ROOT_USER|MINIO_ROOT_PASSWORD' /etc/default/minio /etc/minio* 2>/dev/null

# Nacos: auth enabled + non-default signing key
grep -Ei 'nacos.core.auth.enabled|token.secret.key' \
  /opt/nacos/conf/application.properties 2>/dev/null

3 · Lock down MySQL file access (breaks container-escape probe)

# In my.cnf [mysqld]:  secure_file_priv=/var/lib/mysql-files
# Then remove FILE priv from app accounts:
REVOKE FILE ON *.* FROM 'app_user'@'%';
FLUSH PRIVILEGES;
# Verify no account still holds FILE:
SELECT user, host FROM mysql.user WHERE File_priv='Y';

Known gaps: DB-internal operations (AES_ENCRYPT / DROP run inside an existing DB session, not via a spawned client) and Nacos backdoor-admin creation are not visible to endpoint process telemetry — cover them with the native DB/Nacos audits in §7 and DB audit logging. Containerized Langflow without a sensor is the largest coverage gap; prioritize container-runtime visibility. Validation gates (§11) must pass before promoting Q1/Q3/Q6 to Prevent.