JADEPUFFER — Ransomware Profile

JADEPUFFER is the name Sysdig's Threat Research Team gave to the operator behind what it assesses to be the first documented case of agentic ransomware, disclosed on 1 July 2026. Entry was through an internet-facing Langflow instance vulnerable to CVE-2025-3248, a flaw in the platform's code-validation endpoint that requires no authentication and lets a remote attacker run arbitrary Python on the underlying host. Sysdig reports that a large language model agent then drove the remainder of the intrusion on its own, keeping access alive through a scheduled task that called out to attacker infrastructure at half-hour intervals, and recovering from its own errors at machine speed — one failed login was diagnosed and worked around in 31 seconds. Material left behind on the Langflow host showed the real objective was a second production server exposed to the internet, hosting a MySQL database and an Alibaba Nacos configuration service. The agent encrypted that configuration store and left a note claiming 1,342 items; because the AES key was derived from random UUID bytes and only echoed to stdout, never saved or sent anywhere, no decryptor could have existed and paying would not have recovered the data.

IntelFusions coverage (1)

Researchers catch an AI running a ransomware attack on its own 2026-07-13 · AI Security

Vendor research

JADEPUFFER: Agentic ransomware for automated database extortion Sysdig
AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack The Hacker News
JadePuffer ransomware used AI agent to automate entire attack BleepingComputer
Researchers Claim First Fully Agentic Ransomware: JadePuffer Infosecurity Magazine

Read the full analysis on IntelFusions