Inside JADEPUFFER: Defending Against the First Agentic Ransomware

Key Takeaways

• JADEPUFFER is the first documented agentic ransomware, run end to end by an LLM with no human operator.
• Initial access came from exploiting CVE-2025-3248, a missing-authentication flaw in an internet-facing Langflow instance.
• The agent pivoted to a production server, then encrypted and destroyed a MySQL database and Nacos configuration service.
• The agent diagnosed and fixed a failed login at machine speed, moving from error to correction in 31 seconds.
• Defenders should shrink internet-facing surfaces, add behavioral detection, and hunt for AI integration artifacts like embedded API keys.

Ransomware has always had a human somewhere in the loop, either at the keyboard or writing the script that runs the attack. JADEPUFFER breaks that pattern. It is the first documented case of agentic ransomware, a complete extortion operation driven end to end by a large language model (LLM) with no human operator diagnosing errors or deciding the next move.

Below is a breakdown of what JADEPUFFER is, how it moved from initial access to database destruction, how it differs from earlier LLM-assisted malware like LameHug and MalTerminal, and what defenders can do to reduce their exposure to agentic threats.

What Is JADEPUFFER: The First Agentic Ransomware Explained

JADEPUFFER is an agentic threat actor (ATA), meaning its attack capability is delivered by an autonomous AI agent rather than a human-driven toolkit or a fixed malware binary.

Instead of a person running commands, an LLM reasoned about the environment, chose targets, harvested credentials, moved laterally, established persistence, and finally encrypted and destroyed a production database [1].

The operator gained initial access through an internet-facing Langflow instance by exploiting CVE-2025-3248, a missing-authentication flaw in Langflow's code validation endpoint that lets an unauthenticated attacker execute arbitrary Python on the host. From there, the agent pivoted to its true objective, a separate internet-exposed production server running a MySQL database and an Alibaba Nacos configuration service.

The defining characteristic was the LLM's behavior. Its payloads were self-narrating, packed with natural-language reasoning, target prioritization, and step-by-step annotations that human operators rarely write on disposable one-liners but that LLM code generation produces by default.

The operation also adapted in real time. In one sequence, it went from a failed login to a working fix in just 31 seconds.

How Do We Know JADEPUFFER Is Agentic: The LLM Signs in Its Code

JADEPUFFER is classified as agentic because its payloads reveal a model reasoning, deciding, and correcting on its own, with no human at the keyboard [1].

Here are the four behaviors, all visible in the captured code:

1. It narrates its own reasoning.

LLM-generated code explains why each step is taken, something human operators rarely do on disposable one-liners. In the extortion payload, an inline comment even flags that the random key is printed once and never stored, which is why the data stays unrecoverable:

2. It diagnoses and fixes failures at machine speed.

In the phase of injecting an administrator account into the database, the first attempt generated the password hash by shelling out to a subprocess, which silently returns an empty hash if bcrypt is not on the subprocess PATH. That broke the account, and the login failed:

A corrective payload landed only 31 seconds later. It pinpointed that exact cause, switched to importing bcrypt directly, printed the version to confirm the import worked, then rebuilt the account:

Later, when a drop failed on a foreign key constraint, the agent understood why and disabled the check rather than blindly retrying:

These fixes target specific failures and do this at machine-speed.

3. It makes its own targeting decisions.

The agent chose what to destroy on its own, ranking databases by value and narrating the rationale directly in code:

4. It produces potential hallucination artifacts.

The ransom note's Bitcoin address, "3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy", is a well-known Pay-to-Script-Hash example copied across Bitcoin documentation and saturating LLM training data.

Its appearance here hints that the model emitted a familiar example rather than a wallet the operator controls. It is also a live wallet that instantly sweeps deposits, so whether the address was hallucinated or deliberately configured stays unresolved.

How Does JADEPUFFER Differ from LameHug and Other LLM-Assisted Malware?

Earlier AI-enabled threats such as LameHug (also called PROMPTSTEAL), MalTerminal, and the PromptLock proof-of-concept are best described as LLM-assisted malware. In these cases, a human still built the malware and defined the workflow, and the LLM was used as a component to generate specific commands or payloads on the fly.

LameHug, for example, runs a decoy image-generation thread while a background thread contacts a public LLM, pretends to be a Windows systems administrator, and asks for reconnaissance and data-theft commands:

The differences come down to who is driving the attack and how it is doing this:

• The LLM's role: In LameHug, MalTerminal, and PromptLock, the LLM is a subroutine that fills in a predefined blank, such as generating a single reconnaissance command string. In JADEPUFFER, the LLM is the operator, making high-level decisions about targets, sequencing, and recovery from failure.
• Adaptability: LameHug's prompts are hardcoded and fixed. JADEPUFFER diagnosed specific failures such as a PATH issue and a foreign key constraint, and wrote corrections tailored to each cause rather than blindly retrying.

The through-line is that none of JADEPUFFER's individual techniques were novel. What is new is that a model combined multiple steps together into one coherent operation, executing more than 600 distinct, purposeful payloads in a compressed window.

How to Mitigate JADEPUFFER and Agentic Malware

Two layers matter here: closing the specific gaps this campaign exploited, and reducing the broader surface any agent will target.

Mitigations for the Vulnerabilities JADEPUFFER Exploited

The below mitigations are for the specific vulnerabilities or weaknesses exploited by JADEPUFFER:

• Patch and isolate Langflow. Update Langflow to a release that fixes CVE-2025-3248, and never expose its code-execution or validation endpoints to the internet.
• Harden Nacos. Change the default JWT signing key, which ships unchanged in many deployments; upgrade to a release that forces a custom key; keep Nacos off the public internet, and never let it connect to its backing database as root.
• Replace default service credentials. The agent walked into the MinIO object store with minioadmin:minioadmin. Change default logins on MinIO and every similar service.
• Lock down database admin access. Never expose a database server's administrative account to the internet, and enforce strong, unique credentials with source-IP restrictions on management ports.

Defenses Against Agentic Malware

Here are a few recommendations you can apply to defend against agentic malware:

• Shrink the internet-facing attack surface. Because agents try the whole back-catalogue of known bugs.
• Detect behavior alongside signatures. Agent-generated code changes on every run, so signatures alone will miss it. Keep signature-based tools, but pair them with runtime and behavioral detection.
• Turn self-narration into a detection opportunity. Because an agent may narrate its own objectives in its payloads, that natural-language commentary is a triage signal defenders did not previously have.
• Validate your defenses continuously. An agent is still an attacker, and it leans on known TTPs like credential probing, lateral movement, persistence, and mass deletion. Regularly test whether your controls actually detect and block those techniques instead of assuming they do.
• Hunt for AI integration artifacts. Watch for embedded API keys (such as strings resembling "sk-ant-api03" for Anthropic or Base64 containing "T3BlbkFJ" for OpenAI), unexpected outbound traffic to AI platforms like api.openai.com or router.huggingface.co, and hardcoded prompt signatures.

References

[1] M. Clark, “JADEPUFFER: Agentic ransomware for automated database extortion.” Accessed: Jul. 07, 2026. [Online]. Available: https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion