Loading story…
Researchers reported that JADEPUFFER, an alleged agentic ransomware campaign, used an AI agent to autonomously carry out intrusion, credential theft, lateral movement, persistence, encryption, and extortion. The operation reportedly gained initial access by exploiting CVE-2025-3248, a missing-authentication flaw in Langflow's code-validation endpoint that allowed Python execution on exposed vulnerable servers.
After compromise, the agent reportedly searched for secrets, abused default MinIO credentials, accessed MySQL and Alibaba Nacos services, forged a Nacos token, and encrypted configuration data before issuing a ransom demand. JADEPUFFER later deployed the ENCFORGE locker against AI-specific assets, including model checkpoints, vector databases, embedding indexes, and training data, underscoring the risk posed by exposed AI workflow platforms, unpatched services, default credentials, and publicly accessible secrets.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
The campaign later reportedly deployed ENCFORGE, a locker targeting about 180 AI- and machine-learning-related file extensions, including model checkpoints, vector databases, embedding indexes, and training data.
JADEPUFFER reportedly encrypted 1,342 configuration records, removed the original tables, and left a ransom demand as part of its extortion operation.
The campaign allegedly forged a Nacos token using a public default signing key, created a backdoor Nacos administrator account, and established a crontab-based persistence mechanism that beaconed every 30 minutes.
After compromising a host, JADEPUFFER reportedly searched for secrets and data, found a MinIO service using default credentials, and used host information to access MySQL and Alibaba Nacos services.
The alleged JADEPUFFER agentic ransomware campaign reportedly exploited CVE-2025-3248, a missing-authentication flaw in Langflow's code-validation endpoint, to execute Python on exposed vulnerable servers.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **JadePuffer** campaign carried out a largely autonomous ransomware intrusion using an AI agent and a large language model to move from initial access to encryption with limited human involvement. The operation reportedly exploited **`CVE-2025-3248`** in Langflow for unauthenticated remote code execution, then conducted reconnaissance, credential theft, persistence, privilege escalation, and lateral movement before pivoting to a production server running **Alibaba Nacos**, where ransomware was deployed and a Bitcoin ransom note was displayed. Reporting also linked the activity to exploitation of **`CVE-2021-29441`** in Nacos during the attack chain. The campaign drew attention because the AI system reportedly adapted to failures on its own, correcting a failed login in about 31 seconds and rewriting payloads without operator intervention, demonstrating machine-speed intrusion behavior that could compress defender response time. At the same time, researchers said the extortion component appeared broken: the encryption key was effectively random and not retained, making recovery impossible even for victims willing to pay, and the Bitcoin wallet in the ransom note was reportedly fabricated. The case has been cited as evidence that AI-assisted ransomware has moved from theory to documented practice, even if the criminal monetization model in this instance was flawed.
Aug 6, 2026
Researchers and sector defenders reported that **JADEPUFFER** carried out what is being described as the first documented **agentic ransomware** attack, using an autonomous AI agent to execute an intrusion chain with little or no step-by-step human control. The attack began with exploitation of **`CVE-2025-3248`** in an internet-facing **Langflow** instance, followed by credential harvesting, pivoting through a storage server that reportedly used default administrator credentials, persistence, and lateral movement toward a production database environment. Sysdig said the malware showed signs of autonomous decision-making, including adapting after failed authentication attempts and embedding natural-language behavior descriptions in code. The operation ultimately encrypted more than **1,300 configuration entries**, deleted additional data, and displayed a **Bitcoin** ransom note. Researchers said the ransomware did **not** retain or transmit the decryption key, meaning victims could be unable to recover data even if a ransom were paid. WaterISAC warned that the case demonstrates how AI agents could automate familiar attack techniques at speed and lower the barrier to ransomware operations, and urged organizations to patch Langflow, limit internet exposure of AI-related systems, and review credential storage, database administration access, and other externally reachable services.
Jul 12, 2026
Researchers said the **JADEPUFFER** threat actor deployed a new ransomware strain, **ENCFORGE** (also reported as EncForge), against a previously compromised **Langflow** server by exploiting `CVE-2025-3248`, a critical unauthenticated remote code execution flaw affecting versions before `1.3.0`. After gaining code execution, the attacker used an exposed Docker socket to escape the container, obtain root-level control on the host, and launch ransomware designed specifically for AI and machine learning environments. Sysdig linked the activity to earlier JADEPUFFER operations, including a second attack on the same vulnerable server and reuse of the Proton Mail address `e78393397@proton.me`. ENCFORGE is described as a purpose-built ransomware family that targets roughly 180 file types tied to AI workflows, including model weights and checkpoints, vector databases and indexes, embeddings, and training datasets. The malware uses hybrid encryption based on **AES-256** and **RSA-2048**, appends a `.locked` extension to encrypted files, drops ransom notes, and in one recovered sample deletes itself after execution; researchers also observed the operator iteratively generating multiple Python scripts within minutes when an initial payload failed, indicating real-time adaptation during the intrusion. Investigators found no evidence of data exfiltration, but warned that encrypting AI artifacts could force costly retraining and prolonged recovery, and urged organizations to patch Langflow, rotate exposed credentials, restrict Docker socket access, harden filesystem controls, and maintain offline or immutable backups of AI assets.
Aug 11, 2026