![\"\"\/](\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/user-icon.svg\"){kind=icon}
Pierluigi Paganini<\/a>\n\t\t\t\t\t\t\t
![\"\"\/](\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/clock-icon.svg\"){kind=icon}
July 03, 2026<\/p>\n\t\t\t\t\t\t![\"\"\/](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/07\/image-10.png\")
<\/p>\n
Sysdig reports an AI agent ran a full ransomware attack end-to-end, exploiting flaws, stealing creds, moving laterally, and encrypting data without humans.<\/p>\n
Sysdig\u2019s Threat Research Team has documented what it assesses to be the first ransomware operation driven end-to-end by a large language model. The operator, which Sysdig calls JADEPUFFER, broke into a server, harvested credentials, moved to a separate production target, encrypted a database, and destroyed data, all without a human at the keyboard. Ransomware has always needed a skilled person somewhere in the loop. That may no longer be true.<\/p>\n
\u201cThe Sysdig Threat Research Team (TRT) has captured what we assess to be the first documented case of agentic ransomware: a complete extortion operation driven end-to-end by a large language model (LLM).\u201d reads the report<\/a> published by Sysdig. \u201cThis operator, which we have dubbed JADEPUFFER, gained initial access to an internet-facing Langflow instance through\u00a0CVE-2025-3248<\/a>\u00a0and ran an adaptive and fully automated campaign, ultimately pivoting to the intended target and running a destructive database-extortion playbook against the victim\u2019s production database server. JADEPUFFER is considered an\u00a0agentic threat actor (ATA)<\/a>, or an operator whose attack capability is delivered by an AI agent rather than a human-driven toolkit.\u201d<\/p>\n The entry point was CVE-2025-3248<\/a>, a missing-authentication flaw in Langflow, an open-source framework for building AI applications and agent workflows. The bug lets anyone who can reach the server execute arbitrary Python code on it, no login required. Langflow was patched and added<\/a> to CISA\u2019s Known Exploited Vulnerabilities list in May 2025. Many servers were never updated.<\/p>\n Langflow boxes are attractive because they tend to sit exposed on the internet and frequently hold API keys and cloud credentials for the services they connect to. JADEPUFFER knew this. Immediately after gaining execution, it swept the environment for secrets across multiple categories in parallel: API keys for OpenAI, Anthropic, DeepSeek, and Gemini; cloud credentials including Chinese providers like Alibaba, Aliyun, Tencent, and Huawei alongside AWS, GCP, and Azure; cryptocurrency wallet keys and seed phrases; and database credentials and configuration files.<\/p>\n It also raided Langflow\u2019s own backing Postgres database, harvesting stored credentials, API keys, and user records, staged the output to local files, reviewed them, then deleted the staging files. Then it probed internal services reachable from the Langflow host: databases, object stores, secret managers, and service-discovery endpoints, all tested with default credentials.<\/p>\n One finding in the internal sweep was a MinIO object storage server accessible at the canonical container deployment addresses. MinIO is a self-hosted, S3-compatible storage service widely used to hold application data, backups, machine learning models, and infrastructure state. The default credentials, minioadmin:minioadmin, had never been changed.<\/p>\n JADEPUFFER worked through MinIO\u2019s API systematically: anonymous health check, then admin API info, then authenticated bucket listing, then targeted retrieval of files whose names suggested credentials. When an initial request using ?format=json received XML in response, the LLM immediately adapted its parser to the S3 response schema and re-issued the request. As Sysdig\u2019s report describes it: <\/p>\n \u201cThe enumeration was iterative and self-correcting. When an initial attempt used\u00a0?format=json\u00a0and received XML, the LLM immediately adapted its XML parser to the S3 response schema and re-issued the request.\u201d continues the report. \u201cIt also escalated progressively: anonymous health check \u2192 admin API info \u2192 authenticated\u00a0ListBuckets\u00a0\u2192 targeted\u00a0GetObject\u00a0on files whose names suggested credentials (credentials.json,\u00a0.env).\u201d<\/p>\n That\u2019s not a scanner running a fixed script. That\u2019s an agent reading output and adjusting its next move.<\/p>\n Before moving on, it installed a crontab entry on the Langflow server that beaconed to attacker infrastructure at 45.131.66[.]106 every 30 minutes.<\/p>\n The Langflow instance was never the point. Artifacts captured from the compromised host show JADEPUFFER\u2019s true objective was a separate internet-exposed production server running a MySQL database and Alibaba\u2019s Nacos configuration service. Nacos is a service-discovery and dynamic configuration platform common in microservice architectures. Its authentication system has a documented history of bypasses, and its default JWT signing key has been publicly known since 2020 and ships unchanged in many deployments.<\/p>\n JADEPUFFER connected to the MySQL server as root using credentials whose origin Sysdig couldn\u2019t establish. They weren\u2019t observed being harvested from the victim\u2019s environment. <\/p>\n From there, it attacked Nacos through multiple vectors simultaneously: exploiting the 2021 authentication bypass CVE-2021-29441, forging a valid JWT using the well-known default signing key, and injecting a backdoor administrator account directly into the Nacos backing database.<\/p>\n The backdoor account insertion is where the evidence of autonomous operation becomes most precise. The first payload generated a bcrypt hash using a subprocess call, inserted the account, and assigned admin privileges. The login verification failed. Thirty-one seconds later, without any human intervention, a corrective payload appeared: it deleted the broken account, diagnosed the root cause as a subprocess PATH issue preventing bcrypt from generating a valid hash, switched to importing bcrypt directly, confirmed the library was importable by printing its version, and reinserted the account with a correctly generated hash. The login then succeeded.<\/p>\n \u201cThe window between the failed login and the correct multi-step fix is 31 seconds. That payload is 15 lines of coordinated code: delete, diagnose, rebuild, and reinsert. A human operator reading an error message, identifying the root cause as a subprocess\u00a0PATH\u00a0issue, drafting a corrective script, and submitting it takes much longer than 31 seconds.\u201d states Sysdig. \u201cThe same pattern recurs throughout the session: the MinIO\u00a0?format=json\u00a0request receives XML, and the next payload immediately parses XML \u2013 the JWT forgery receives\u00a0“custom secret in use”, and the JWT path is abandoned entirely.\u00a0\u201c<\/p>\n The same adaptive behavior appeared when a DROP DATABASE command failed silently due to a foreign key constraint. The next payload wrapped the same command with SET GLOBAL FOREIGN_KEY_CHECKS=0 before the drop and reset it after. The fix was specific to the failure mode, not a generic retry.<\/p>\n After establishing control over Nacos, JADEPUFFER encrypted all 1,342 Nacos service configuration items using MySQL\u2019s AES_ENCRYPT() function, dropped the original config_info and history tables, and created a ransom table named README_RANSOM containing a demand, a Bitcoin payment address, and a Proton Mail contact. A follow-up payload two minutes later updated the note with a refined count of all 1,342 encrypted items.<\/p>\n The encryption key was generated from two concatenated UUID4 values, essentially random, printed once to stdout, and never stored or transmitted anywhere. The victim cannot recover the encrypted configurations even with payment. The ransom note claims AES-256; MySQL\u2019s AES_ENCRYPT() defaults to AES-128-ECB unless the server was reconfigured, so the claim overstates the algorithm. The practical result is the same either way.<\/p>\n After the ransomware phase, the agent escalated to dropping entire database schemas, narrating its own targeting rationale inside the code. Comments in the payloads read \u201cHigh-ROI databases to drop (data already backed up to 64.20.53[.]230)\u201d before issuing DROP DATABASE commands. Sysdig couldn\u2019t independently verify any exfiltration to that staging server. The claim is the agent\u2019s own assertion, not something the team could confirm from external evidence.<\/p>\n This self-narration is one of four independent lines of evidence Sysdig uses to support its assessment that the operation was LLM-driven. <\/p>\n \u201cHuman operators do not annotate disposable\u00a0python3 -c\u00a0one-liners this way, but LLM code-generation does so by default. The narration is internal to the attacker\u2019s own payloads, not inferred.\u201d states the report.<\/p>\n The other supporting evidence: machine-speed failure diagnosis and correction, demonstrated comprehension of free-text context planted by the target, and the curious Bitcoin address.<\/p>\n The ransom note contains the Bitcoin address 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy. This is the canonical Pay-to-Script-Hash example address used throughout Bitcoin\u2019s own developer documentation and the Bitcoin core repository, which means it saturates LLM training data as a \u201cfor example\u201d illustration. It is also a real, active wallet with 737 confirmed transactions and roughly 46 BTC received over its history, with every deposit immediately transferred elsewhere and the current balance at zero.<\/p>\n Sysdig can\u2019t resolve this from available data. Either the LLM hallucinated the address from training material and the wallet belongs to a third party who sweeps unsolicited deposits, or the operator deliberately configured a real, controlled wallet that happens to match the famous documentation example. Both interpretations have uncomfortable implications.<\/p>\n None of the individual techniques in this operation were novel. CVE-2025-3248 was patched over a year before the attack. The Nacos authentication bypass dates to 2021. The default JWT signing key has been publicly documented since 2020. What JADEPUFFER demonstrates is that an AI agent can chain these steps into a complete extortion operation against neglected internet-facing infrastructure without the operator possessing deep expertise in any single step.<\/p>\n Sysdig\u2019s indicators for this operation: C2 at 45.131.66[.]106 with beaconing to port 4444 every 30 minutes, claimed staging server at 64.20.53[.]230, ransom Bitcoin address 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy, contact e78393397[@]proton[.]me, and the ransom table name README_RANSOM, which doesn\u2019t match any known MySQL ransomware campaign lineage.<\/p>\n The defensive priorities are practical and not new: patch Langflow and keep its code execution endpoints off the internet, don\u2019t store cloud credentials or API keys in the environment of internet-facing AI servers, change Nacos\u2019s default signing key and keep it off the public internet, never expose a database admin account to the internet, and enforce egress controls so a compromised host can\u2019t beacon out. The argument for runtime behavioral detection over patch racing has become harder to dismiss.<\/p>\n \u201cRansomware is no longer a craft for the highly skilled:\u00a0An LLM agent can chain reconnaissance, credential theft, lateral movement, persistence, and destruction without the operator possessing deep expertise in any one step. Tradecraft that once implied a capable human now implies a capable model.\u201d concludes the report that also provides Indicators of compromise (IoCs).<\/p>\n Follow me on Twitter:\u00a0@securityaffairs<\/a>\u00a0and\u00a0Facebook<\/a>\u00a0and\u00a0Mastodon<\/a><\/p>\n Pierluigi\u00a0Paganini<\/a><\/p>\n (SecurityAffairs<\/a>\u00a0\u2013\u00a0hacking,\u00a0JADEPUFFER)<\/p>\n \t\t\t\t\t\t\t\t\t\t\t![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/07\/1783083493_595_image-10.png\")
<\/a><\/p>\n