Since the inception of ransomware as a form of cyberattack, the tactics and technologies used by ransomware threat actors have continuously evolved to increase success rates and payouts. Throughout this time, the one constant has been the fact that the script is written by a human. According to the Sysdig Threat Research Team (TRT), however, this is no longer an assumption that can be relied upon. Recent research has uncovered JadePuffer, which the team assesses as the first fully agentic, end-to-end extortion operation. The advent of agentic ransomware is not just a new technique being leveraged by the same old attackers, but an entirely new kind of operator.
The Vulnerability Behind the Campaign
In spite of the new and sophisticated aspects of this campaign, it was initially enabled by an ordinary vulnerability. The flaw, tracked as CVE-2025-3248, is a missing authentication vulnerability in Langflow's code validation endpoint that enables unauthenticated remote code execution (RCE). By taking advantage of this flaw, an attacker can execute arbitrary Python code on the target system.
Langflow servers provide an attractive target for attackers for a variety of reasons, including adjacency to AI, heavy presence of API keys and cloud credentials, and weak safeguards. Internet-facing instances of Langflow are often left exposed without network controls, making infiltration easier. The initial access attackers can gain is used as a springboard toward other malicious activity, rather than an objective on its own.
The Agent Shows Its Work
Sysdig’s TRT found that JadePuffer left behind traces of its presence that enable attribution of the campaign. Payloads were saturated with natural-language reasoning, target prioritization, and ROI commentary; these are behaviors that human operators rarely produce, but LLM code generation does by default. Other notable signals of the sophistication of this agentic threat actor (ATA) include credential sweeps, MinIO enumeration, and self-correcting parsing when a request format failed.
Speed as the Giveaway
The attack through a Nacos backdoor took place in a sequence from a failed login attempt to a diagnosis and correction of the issue to create a working exploit, all in only 31 seconds. This indicates a specific, accurate failure diagnosis that is repeated across the operation, not an operator blindly retrying different configurations until one works. This factor alone is the strongest evidence against human authorship, as it demonstrates the ability to perform sophisticated adversarial tasks at machine speed.
The lack of human involvement is the major notable factor in this attack. “Large language models can now assist with reasoning through failures, adapting commands, prioritizing targets, and modifying attack paths in real time,” according to Heath Renfrow, Co-Founder and Chief Information Security Officer at Fenix24, a Chattanooga, Tennessee-based cyber disaster recovery firm. “Those are tasks that historically required a skilled operator. As that capability matures, we should expect attacks to become faster, more consistent, and more scalable.”
From Configuration Server to Crime Scene
Payloads captured by Sysdig TRT show that JadePuffer carried out malicious behavior via several vectors. The agentic actor simultaneously exploited the Nacos auth-bypass vulnerability CVE-2021-29441, forged a JWT with a publicly known default signing key, and used root database access to inject a backdoor administrator.
The LLM attacker then performed container-escape reconnaissance via MySQL file primitives, complete with a self-issued completion marker. The execution of the ransomware payload used AES-256 to encrypt 1,342 configuration items, dropped original tables, and planted a ransom note on the target system.
A Ransom Note With No Way Out
One of the most notable and alarming discoveries about this LLM-operated campaign is that the AES key used to encrypt the files was generated, printed once, and never stored or transmitted. This means that the data was effectively destroyed rather than simply encrypted: victims cannot restore access to their data by paying the ransom, regardless of whether the attacker intends to grant it.
The Bitcoin address given in the ransom note is one that is used as an example in Bitcoin’s developer documentation and core repository. However, it is also a live wallet with a sizeable transaction history. This leaves the question unresolved as to whether JadePuffer has legitimate control over a real Bitcoin wallet or just hallucinated the address from training data.
What Happens When the Skill Floor Disappears
This campaign is not significant due to any one technique used to carry it out: each of the methods, taken individually, is old, but the automation that stitched them together into a sophisticated attack is new. The advent and rise of LLMjacking has played a major role in driving attacker cost down to near zero, making it easier than ever for threat actors to launch attacks without investing in skills or human power.
While the use of LLMs to carry out attacks introduces a range of new difficulties, it also offers insight for defenders. The agentic attacker’s self-narration serves as an unexpected gift, revealing legible intent right inside the attacker’s own code. Defenders should use this available information to inform their decisions and efforts moving forward in protecting against attacks like this.
Bracing for Volume
Rather than creating attacks that are more technically sophisticated than previously seen, the increasing maturity of agentic tooling leads to a higher volume of campaigns. AI agents are able to carry out attacks at a much faster pace than human actors could possibly achieve, enabling more campaigns in less time.
In order to prepare to fight threats like this that are starting to pop up, organizations must prioritize hardening certain areas like exposed application servers, unprotected configuration stores, and internet-facing database administrator accounts. JadePuffer may be the first documented case of this type of agentic attack, but it will not be the last.
