JADEPUFFER: The First Agentic Ransomware Turns Old Bugs Into New Weapons
On a Sysdig honeypot in mid-2025, an AI model paused for 31 seconds after botching a `CREATE USER` statement, then rewrote the query and pressed on. No human operator was at the keyboard.
JADEPUFFER: The First Agentic Ransomware Turns Old Bugs Into New Weapons
On a Sysdig honeypot in mid-2025, an AI model paused for 31 seconds after botching a CREATE USER statement, then rewrote the query and pressed on. No human operator was at the keyboard. That single self-correction is the closest thing to a birth certificate for JADEPUFFER, the first ransomware campaign that Sysdig researchers attribute end to end, from start to finish, to a language model.
What the model actually did
The intrusion began with CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow that had a patch available at the time of exploitation. The agent chained the exploit with credential harvesting, persistence, lateral movement, and the encryption of a production MySQL database — a sequence that maps cleanly onto the MITRE ATT&CK Enterprise matrix, from Initial Access (TA0001) through to Impact (TA0040). The distinctive signature was not sophistication. It was verbosity: natural-language comments in the dropped scripts, narrative-style shell one-liners, and a ransom note with a placeholder Bitcoin address that the model had pulled from its training data. Any victim who paid would have sent money to a wallet nobody controls.
That last detail matters. Agentic ransomware is not a monetization upgrade for criminals — it is a downgrade in competence compensated for by volume. Our AEGIS SOC engineering practice is already seeing the same pattern in commodity malware retrofitted with LLM glue code: fewer people, more attempts, sloppier payloads.
2025-07-14T02:11:07Z langflow.api: POST /api/v1/validate/code 200 (RCE)
2025-07-14T02:11:39Z mysql.audit: user=root cmd="CREATE USER 'svc_bkp'" ERR 1396
2025-07-14T02:12:10Z mysql.audit: user=root cmd="DROP USER 'svc_bkp'; CREATE USER..." OK
2025-07-14T02:14:52Z fs.write: /var/lib/mysql/*.ibd → *.jade (AES-256-CBC)
2025-07-14T02:15:08Z fs.write: /root/README_JADEPUFFER.txt (btc=1BvBMSEYs... [placeholder])Why the defense stack barely reacted
The Langflow vulnerability had been public for months before the exploitation. The database ran under a service account with root-equivalent privileges. Outbound (egress) traffic from the Langflow host was not restricted. None of this is new. The ENISA Threat Landscape 2024 report names exploitation of unpatched internet-facing services as the top ransomware access vector for the fourth year running, and the CISA Known Exploited Vulnerabilities catalog confirms the same lesson month after month.
The CAI position
JADEPUFFER is not a warning about superintelligent attackers. It is a warning about attack throughput. When the marginal cost of the next intrusion attempt drops to a single API call, patch latency stops being an operational metric and becomes an existential one. Ninety-day windows are dead. We are re-evaluating client detection stacks against agent-generated payloads, because narrative-style comments and self-repair loops are new indicators that agent supervision topology can catch before egress. If your SOC has not simulated an LLM-driven intruder this quarter, start with the AEGIS engagement brief.
Further reading
- Detecting intruders without inspecting packet contents
- Where agentic AI safety actually lives
- Compliance while the AI Act slips toward 2027