Blog Published: Jul 6, 2026

JADEPUFFER Shows Agentic Ransomware Moving From AI RCE to Database Extortion

Sysdig described JADEPUFFER as an LLM-assisted ransomware campaign that exploits Langflow (a visual framework for building LLM workflows) CVE-2025-3248, runs adaptive Python payloads, harvests secrets and reachable service context, pivots toward Nacos/MySQL infrastructure, and then encrypts or drops configuration/database tables. The defender lesson is concrete: AI workflow servers need safe code-execution boundaries, authenticated exposure, segmentation, egress control, credential cleanup, destructive-action monitoring, and tested data recovery.

Remote Code ExecutionData LossRuntime IsolationOperational SecurityAI Infrastructure
9 applicable AIDEFEND defenses
Source: JADEPUFFER: Agentic Ransomware for Automated Database Extortion 
Author: Michael Clark
Original article: Jul 1, 2026

Threat Analysis

  • The entry point is an AI workflow RCE surface. JADEPUFFER targets vulnerable Langflow servers through CVE-2025-3248 and delivers Base64-encoded Python through the unauthenticated code-validation endpoint.
  • The first phase turns the AI host into a credential and service map. The payload enumerates host, process, network, and environment context; dumps Langflow backing data; probes MinIO with default credentials; fetches files such as credentials.json and .env; and installs a cron beacon.
  • The true objective is a separate Nacos/MySQL target. Sysdig observed the agent connecting to exposed MySQL as root with credentials whose origin was not observed, attacking Nacos auth-bypass/default-token paths, and inserting a backdoor administrator.
  • The payload attacks integrity and recoverability, not only confidentiality. It encrypts 1,342 Nacos configuration items into backup tables, drops original config/history tables, writes README_RANSOM, and then drops whole database schemas with retry logic.
  • The agentic element compresses time. The agent repaired failed Nacos admin creation within 31 seconds and adjusted parsing or credential paths without a human at the keyboard, so slow manual containment is a poor fit.

Applicable AIDEFEND Defenses (9)

AID-I-002.001
Internal AI Network Segmentation
Very High
Internal AI network segmentation is the clearest architectural break. If a compromised Langflow host cannot reach Nacos, MySQL, MinIO, secret stores, or service-discovery endpoints except through explicit policy, RCE does not naturally become database extortion.
AID-R-002
Data Integrity Recovery for AI Systems
Very High
JADEPUFFER encrypts Nacos configuration rows, drops config/history tables, and deletes schemas. Trusted pre-incident backups, restore drills, schema validation, and integrity checks are direct recovery controls.
AID-H-025.002
Safe Interpreter Enforcement
Very High
Langflow code-validation and similar dynamic-code surfaces should not let arbitrary Python access filesystem, network, import, or shell capability. A restricted interpreter enforced outside model or request control directly limits the payload.
AID-M-001.005
Public AI Endpoint & Agent-Service Exposure Discovery
Very High
The chain begins at an Internet-facing Langflow code-validation endpoint. Credential-free outside-in discovery identifies the exposed AI workflow service and reconciles it to an owner, exposure intent, and authentication requirement. It emits the exact unknown or policy-divergent route finding; H-003.010 and the exposure controls own remediation.
AID-H-004.002
Service & API Authentication
High
At the Langflow API or gateway, authenticate the calling workload, application, or external integration before delivering requests to code-validation and internal service paths. This machine-authentication control does not replace patching CVE-2025-3248, authorize a valid identity, or govern human administrator access under AID-H-004.001.
AID-I-001.004
Sandbox Network Egress Restrictions
High
Default-deny egress for AI workflow runtimes limits callback traffic, cron beacons, arbitrary staging, and opportunistic service probes launched from the compromised Langflow process.
AID-H-003.010
Deployed AI Software Vulnerability Remediation Lifecycle
High
Reconcile every deployed Langflow instance against CVE-2025-3248, rebuild and redeploy the fixed software through drained canary and staged rings, and independently read back the fleet to prove no vulnerable digest remains. This is the patch-and-rollout owner for the initial RCE path.
AID-E-001.001
Root & Long-Lived Credential Object Eviction
High
After this chain, revoke or rotate the exact database root passwords, Nacos administrator passwords and signing secrets, provider API keys, cloud access keys, MinIO access keys, and attacker-created root or long-lived credential objects. Removing a separate account or principal record requires its own identity-plane owner.
AID-E-004
Incident Exploit-Path Closure Verification
High
After Langflow, Nacos/MySQL, identity, and network remediations are deployed, independently replay the incident-defined JADEPUFFER entry and pivot path in an isolated clone and verify the exact route is closed across the incident-scoped population. This control proves closure; it does not perform the patch or hardening work.

What Defenders Should Do Now

  • Inventory Langflow and similar AI workflow servers, including version, exposure, authentication mode, runtime user, mounted secrets, outbound network policy, and reachable internal services.
  • Patch CVE-2025-3248, block unauthenticated access to AI workflow/code-validation endpoints, and move dynamic-code features behind restricted interpreters or disable them in production.
  • Segment AI workflow hosts from Nacos, MySQL, MinIO, secret stores, cloud metadata, and model-provider credentials; apply default-deny egress except for explicitly approved destinations.
  • Add detections for Langflow exploit paths, Base64 Python execution, host/environment secret sweeps, MinIO/default-credential enumeration, cron beacons, Nacos admin creation, MySQL file/UDF probes, README_RANSOM, and destructive DDL.
  • Rotate exposed or potentially exposed database, Nacos, provider, cloud, and object-store credentials; remove attacker-created accounts; then run restore and integrity checks for affected configuration and application databases.

Conclusion

JADEPUFFER is useful because it makes the AI infrastructure risk concrete. A Langflow server is not just a lab tool once it has secrets, network reach, and production data paths. Treat it like a production control-plane asset: patch it fast, constrain code execution, isolate it tightly, deny unnecessary egress, clean up credentials, monitor destructive actions, and prove recovery before the attack does.