Sysdig researchers spotted something new: the first known “agentic ransomware” attack in the wild. They’re calling it JADEPUFFER.
This isn’t your typical ransomware. An LLM drove the entire intrusion, adapting its own payloads in real time. No human behind the wheel. The attack started by exploiting CVE-2025-3248, a missing authentication flaw in an internet-exposed Langflow instance. From there it pivoted to a Nacos config server with a MySQL database.
Here’s where it gets wild. When JADEPUFFER hit an error trying to create a backdoor admin account, it fixed itself — in 31 seconds. The LLM rewrote its own exploit code, retried, and succeeded.
“This is our new reality,” said Ram Varadarajan, CEO at Acalvio. “Static signatures can’t keep pace. Only runtime behavioral detection stands a chance.”
The malware harvested API keys, cloud credentials (targeting Alibaba, Tencent, Huawei providers), crypto wallets, and database credentials. It scanned for lateral movement targets, set up persistence via crontab, and exploited CVE-2021-29441 in Nacos to take over the server.
The ransomware phase encrypted 1,342 Nacos configuration items using MySQL’s AES_ENCRYPT(). It dropped a ransom demand with a Bitcoin address and Proton Mail contact. But here’s the catch — the AES key was never saved or sent anywhere, making decryption impossible. And the Bitcoin address turned out to be an example from developer docs, likely pulled straight from LLM training data.
Sysdig found no evidence files were actually exfiltrated despite the LLM’s internal narration claiming backups. The researchers warn JADEPUFFER signals a new era where autonomous AI agents run attacks end-to-end.
