Loading story…
Researchers reported that the JadePuffer campaign carried out a largely autonomous ransomware intrusion using an AI agent and a large language model to move from initial access to encryption with limited human involvement. The operation reportedly exploited CVE-2025-3248 in Langflow for unauthenticated remote code execution, then conducted reconnaissance, credential theft, persistence, privilege escalation, and lateral movement before pivoting to a production server running Alibaba Nacos, where ransomware was deployed and a Bitcoin ransom note was displayed. Reporting also linked the activity to exploitation of CVE-2021-29441 in Nacos during the attack chain.
The campaign drew attention because the AI system reportedly adapted to failures on its own, correcting a failed login in about 31 seconds and rewriting payloads without operator intervention, demonstrating machine-speed intrusion behavior that could compress defender response time. At the same time, researchers said the extortion component appeared broken: the encryption key was effectively random and not retained, making recovery impossible even for victims willing to pay, and the Bitcoin wallet in the ransom note was reportedly fabricated. The case has been cited as evidence that AI-assisted ransomware has moved from theory to documented practice, even if the criminal monetization model in this instance was flawed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Anthropic disclosed in August 2025 an extortion campaign using Claude Code that affected at least 17 organizations. The reference cites this as an earlier example of AI-assisted criminal activity.
The Langflow unauthenticated remote-code-execution vulnerability CVE-2025-3248 had been patched since April 2025. Despite the fix, internet-facing Langflow instances remained exposed.
Sysdig found that JadePuffer generated an encryption key from effectively random data, printed it to the terminal, and did not save or transmit it for later retrieval. Sysdig also found the Bitcoin wallet address in the ransom note did not exist, indicating the campaign destroyed data without a workable extortion path.
In one documented case, the JadePuffer agent failed at a login or access step, generated a corrective solution, and retried successfully in about 31 seconds. The reporting highlights this as evidence of autonomous adaptation during the intrusion.
Researchers identified JadePuffer as a ransomware campaign in which a large language model autonomously exploited CVE-2025-3248 in Langflow, conducted reconnaissance, stole credentials and sensitive data, established persistence, and pivoted to an Alibaba Nacos production server. On the production server, ransomware was deployed, files were encrypted, and a Bitcoin ransom note was displayed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and sector defenders reported that **JADEPUFFER** carried out what is being described as the first documented **agentic ransomware** attack, using an autonomous AI agent to execute an intrusion chain with little or no step-by-step human control. The attack began with exploitation of **`CVE-2025-3248`** in an internet-facing **Langflow** instance, followed by credential harvesting, pivoting through a storage server that reportedly used default administrator credentials, persistence, and lateral movement toward a production database environment. Sysdig said the malware showed signs of autonomous decision-making, including adapting after failed authentication attempts and embedding natural-language behavior descriptions in code. The operation ultimately encrypted more than **1,300 configuration entries**, deleted additional data, and displayed a **Bitcoin** ransom note. Researchers said the ransomware did **not** retain or transmit the decryption key, meaning victims could be unable to recover data even if a ransom were paid. WaterISAC warned that the case demonstrates how AI agents could automate familiar attack techniques at speed and lower the barrier to ransomware operations, and urged organizations to patch Langflow, limit internet exposure of AI-related systems, and review credential storage, database administration access, and other externally reachable services.
Jul 12, 2026
Recent reporting and threat research indicate **AI and automation are materially compressing attacker timelines**, reducing defenders’ opportunity to detect and contain intrusions. A ReliaQuest analysis cited by SC Media found **lateral movement can occur in as little as four minutes** (with average lateral movement time dropping from 48 to 34 minutes), and **data exfiltration** in the fastest cases falling to **six minutes** (down from more than four hours previously). The same reporting notes **80% of ransomware groups** are leveraging AI and/or automation for data theft, and highlights **BoaLoader** as an example of converged AI-assisted development, social engineering, and traditional cybercrime activity. Separate ransomware telemetry from NCC Group shows overall **publicly disclosed ransomware incidents** dipped month-over-month in January but remained broadly consistent year-over-year (741 vs. 696), with **North America** accounting for **54%** of activity and **industrials** the most targeted sector (32%). The report identified **Qilin** as the most active group (108 cases), followed by **Akira** and **Sinobi**, and warned that attacker tradecraft is expanding to new initial access paths, including **messaging platforms** (e.g., WhatsApp, Signal, Telegram) via device-linking scams and malicious QR codes. ASEC’s weekly “Ransom & Dark Web Issues” roundup provides additional context on ongoing ransomware and hacktivist activity (e.g., **Morpheus** targeting a South Korean plating company and **Ailock** republishing prior victims), but it is not clearly tied to the same specific datasets or findings on AI-driven acceleration described in the other reporting.
Jun 29, 2026
Check Point Research reported that AI has moved beyond a supporting role and is now acting as an operational component in live intrusions, helping attackers with reconnaissance, exploit development, phishing, vishing, lateral movement, and data theft. The firm said criminal groups have used AI as a primary operator in some campaigns, and cited **The Gentlemen** ransomware group as an example of actors using AI to accelerate internal tool creation, while attackers also abuse commercial models, agentic architectures, and jailbroken systems before pivoting to alternative platforms when safeguards block malicious activity. The report added that enterprise exposure is rising as indirect prompt injection increases and high-risk generative AI prompts have doubled over the past year. The findings coincide with a broader surge in ransomware activity. Check Point said **The Gentlemen** accounted for **17%** of published ransomware attacks in June, making it the most active group globally, while recent victim reports linked the gang to attacks on **Open Options**, a Texas software company associated with the `ooaccess.com` domain, and **INTERNET AG**, a German IT services and hosting provider using `inet.de`. Microsoft had previously said state-backed actors were using large language models mainly as productivity aids rather than for novel tradecraft, but Check Point's 2026 assessment indicates AI is now materially accelerating criminal operations even if fully autonomous hacking has not yet emerged.
Jul 15, 2026