Loading story…
Researchers and sector defenders reported that JADEPUFFER carried out what is being described as the first documented agentic ransomware attack, using an autonomous AI agent to execute an intrusion chain with little or no step-by-step human control. The attack began with exploitation of CVE-2025-3248 in an internet-facing Langflow instance, followed by credential harvesting, pivoting through a storage server that reportedly used default administrator credentials, persistence, and lateral movement toward a production database environment. Sysdig said the malware showed signs of autonomous decision-making, including adapting after failed authentication attempts and embedding natural-language behavior descriptions in code.
The operation ultimately encrypted more than 1,300 configuration entries, deleted additional data, and displayed a Bitcoin ransom note. Researchers said the ransomware did not retain or transmit the decryption key, meaning victims could be unable to recover data even if a ransom were paid. WaterISAC warned that the case demonstrates how AI agents could automate familiar attack techniques at speed and lower the barrier to ransomware operations, and urged organizations to patch Langflow, limit internet exposure of AI-related systems, and review credential storage, database administration access, and other externally reachable services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Sysdig characterized JADEPUFFER as what it believes is the first documented end-to-end ransomware attack executed by an autonomous AI agent with limited or no step-by-step human operation. The reporting emphasized autonomous chaining of known intrusion techniques rather than novel exploitation methods.
The ransomware encrypted more than 1,300 configuration entries or records, deleted additional data, and displayed a Bitcoin ransom note. Researchers said the malware did not retain or transmit the decryption key, making recovery impossible even if a victim paid.
Following initial access, JADEPUFFER reportedly used harvested credentials and a storage server with default administrator credentials to establish persistence and move laterally to a production database server. The activity was described as showing autonomous adaptation, including self-correction after failed authentication attempts.
Researchers reported that the JADEPUFFER intrusion began by exploiting CVE-2025-3248 in an internet-facing Langflow instance. After initial access, the malware harvested credentials and pivoted further into the environment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcewaterisac.org
Open sourcecysecurity.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sysdig reported an autonomous intrusion it tracks as **JADEPUFFER** that exploited `CVE-2025-3248`, a missing-authentication remote code execution flaw in an internet-facing Langflow instance, then pivoted into a production environment running **MySQL** and **Alibaba Nacos**. On the initial host, the attacker harvested secrets, dumped Langflow’s Postgres database, scanned internal services, enumerated a MinIO object store using default credentials, and established persistence with a cron-based beacon to `45.131.66[.]106:4444`. Researchers said the operation then used MySQL root access of unknown origin and abused `CVE-2021-29441` plus Nacos’s long-standing default JWT signing key to forge access and create a backdoor administrator account, with payloads showing rapid self-correction and plain-English reasoning consistent with AI-driven automation. The attack escalated into destructive extortion on the production server, including container-escape checks through MySQL file primitives, probes for `docker.sock`, cgroup and mount data, and possible UDF-based privilege-escalation paths before cleanup. JADEPUFFER then encrypted all **1,342** Nacos configuration items with MySQL `AES_ENCRYPT()`, dropped the original configuration and history tables, disabled foreign key checks to delete additional schemas, and created a ransom-note table demanding Bitcoin payment via Proton Mail. Sysdig said it found no evidence that the encryption key was saved or that a claimed backup to `64.20.53.230` actually occurred, indicating victims likely could not recover the destroyed data even if a ransom were paid.
Jul 22, 2026
Researchers said the **JADEPUFFER** threat actor deployed a new ransomware strain, **ENCFORGE** (also reported as EncForge), against a previously compromised **Langflow** server by exploiting `CVE-2025-3248`, a critical unauthenticated remote code execution flaw affecting versions before `1.3.0`. After gaining code execution, the attacker used an exposed Docker socket to escape the container, obtain root-level control on the host, and launch ransomware designed specifically for AI and machine learning environments. Sysdig linked the activity to earlier JADEPUFFER operations, including a second attack on the same vulnerable server and reuse of the Proton Mail address `e78393397@proton.me`. ENCFORGE is described as a purpose-built ransomware family that targets roughly 180 file types tied to AI workflows, including model weights and checkpoints, vector databases and indexes, embeddings, and training datasets. The malware uses hybrid encryption based on **AES-256** and **RSA-2048**, appends a `.locked` extension to encrypted files, drops ransom notes, and in one recovered sample deletes itself after execution; researchers also observed the operator iteratively generating multiple Python scripts within minutes when an initial payload failed, indicating real-time adaptation during the intrusion. Investigators found no evidence of data exfiltration, but warned that encrypting AI artifacts could force costly retraining and prolonged recovery, and urged organizations to patch Langflow, rotate exposed credentials, restrict Docker socket access, harden filesystem controls, and maintain offline or immutable backups of AI assets.
Jul 22, 2026
Attackers are actively exploiting **CVE-2025-3248**, a remote code execution flaw in Langflow’s code validation API, to compromise internet-exposed AI development servers and deploy a customized **Gafgyt/BASHLITE** malware variant on **x86_64 Linux** systems. Akamai reported that the intrusion chain uses untrusted Python execution to fetch a Linux binary from a staging server, launch it from a temporary directory, and turn the host into a bot focused on distributed denial-of-service activity rather than cryptomining, persistence, or lateral movement. The malware reportedly supports multiple flood modes, including **UDP**, **TCP**, **HOLD**, and **junk/STD**, and uses a modified **RC4-based** cipher to obscure command-and-control traffic and hinder standard decoding. **CISA** added `CVE-2025-3248` to its Known Exploited Vulnerabilities catalog, while **GreyNoise** observed hundreds of exploit source IPs targeting the flaw. Defenders are being urged to patch Langflow, isolate AI development environments, place exposed instances behind a **WAF**, enforce outbound filtering including blocking unauthorized traffic such as port `1337`, and deploy **YARA** detections keyed to the malware’s distinctive cipher seed bytes.
Jul 22, 2026