\n<\/p>\n
\n<\/p>\n
Nefarious actors are becoming adept<\/a> at deploying Large Language Models (LLMs) in their malware campaigns<\/a>. Case in point, the threat research team at security firm Sysdig has discovered what looks to be the first instance of an attack using agentic ransomware. The researchers say it\u2019s a \u201ccomplete extortion operation driven end-to-end\u201d by an LLM.<\/p>\n This malicious software, which has been named Jadepuffer, leverages a vulnerability in the Longflow framework that\u2019s used by developers who create software using LLMs. Once the malware gains access to the system it begins to search for valuable data that\u2019s often found in AI assisted development environments, such as API keys and credentials, that can be used to compromise other systems used by victims for deploying ransonmware.<\/p>\n The silvering lining is that there are telltale signs found by the researchers that point to this being an LLM driven attack, which can provide defenders with something to key in on to prevent attacks in the future. Its codebase is full of \u201cself-narrating code\u201d that is common in LLM written software, and this is something defensive tooling can look for in order to block this kind of attack before it compromises any systems.<\/p>\n As the researchers point out, this is a \u201cmarker of where extortion tradecraft is heading.\u201d Developers will need to be more mindful going forward, ensuring their development tools are up-to-date and properly configured to lessen the risk of falling victim to this kind<\/a> of attack.
\n <\/p>\n","protected":false},"excerpt":{"rendered":"Nefarious actors are becoming adept at deploying Large Language Models (LLMs) in their malware campaigns. Case in point,…\n","protected":false},"author":2,"featured_media":96777,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[179,7493,24,313,317,314],"class_list":["post-96776","post","type-post","status-publish","format-standard","has-post-thumbnail","category-agentic-ai","tag-agentic-ai","tag-agentic-artificial-intelligence","tag-ai","tag-cybersecurity","tag-malware","tag-security"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/96776","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=96776"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/96776\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/96777"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=96776"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=96776"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=96776"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"jadepuffer](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/07\/jadepuffer-agentic-ransomware-body.jpeg\"\/)
Something that stood out to the researchers about Jadepuffer is that the malware is capable of adapting in real time. It initially failed to create a new account with administrative access on a target device. However, it was able to pivot to a different kind of payload, which ultimately allowed it to create the account with the permissions it needed to continue the attack. All of this happened without any intervention from a human threat actor and occurred in the span of 31 seconds.<\/p>\n