AI Agent Executes 'First' End-To-End Ransomware Attack

Sysdig says it has documented the first ransomware attack carried out end to end by an AI agent, which autonomously exploited exposed systems, stole credentials, established persistence, compromised a production database, and destroyed data. The research team named the attacker "JadePuffer" and said it gained initial access to an internet-facing Langflow instance by exploiting CVE-2025-3248. "The most striking characteristic, however, was the LLM's behavior," Sysdig director of threat research Michael Clark said in a blog post. An anonymous reader quotes an excerpt from The Register: JadePuffer's "self-narrating" payloads "contained natural language reasoning, target prioritization, and the kind of detailed annotations that human operators don't often write but LLM-generated code produces reflexively," Clark added. "The operation also adapted in real time, retrying failed steps within refined parameters. In one sequence, it went from a failed login to a working fix in 31 seconds." After exploiting CVE-2025-3248, a missing authentication vulnerability in Langflow that allows remote, unauthenticated attackers to execute arbitrary Python on the host, the AI agent began scanning for and collecting secrets, including LLM provider API keys, cloud credentials "with explicit coverage of Chinese providers" including Alibaba, Aliyun, Tencent, and Huawei, while also scanning for AWS, Azure and Google Cloud Platform, cryptocurrency wallets, and database credentials.

The AI also installed a crontab entry on the Langflow server to maintain persistence and call back to the attacker's infrastructure every 30 minutes. JadePuffer's intended target was a separate internet-exposed production server running a MySQL database and an Alibaba Nacos configuration service, we're told. Nacos is an open-source service-discovery and dynamic configuration platform developed by Alibaba and used in the cloud provider's microservices applications. The agent connected to the server's exposed MySQL port using root credentials, although Sysdig doesn't know how the attacker obtained them. These credentials weren't stolen from the victim's environment.

JadePuffer then attacked Nacos via multiple vectors including an authorization bypass flaw (CVE-2021-29441) and forging a valid JSON web token (JWT) using Nacos's default signing key. Additionally, using its root database access, the LLM injected a backdoor administrator into the Nacos backing database. It ultimately encrypted all 1,342 Nacos service configuration items using MySQL's built-in AES encryption function, and created an extortion demand, ransom note, Bitcoin payment address, and a Proton Mail contact [...]. However, according to the threat hunters, the victim can't recover the encrypted data, even if they paid the ransom demand, because the agent escalated "from row-level deletion to dropping entire database schemas, narrating its own targeting rationale," without backing up any of the encrypted data.

So did it fail in the last stage?

[lsllll]

However, according to the threat hunters, the victim can't recover the encrypted data, even if they paid the ransom demand, because the agent escalated "from row-level deletion to dropping entire database schemas, narrating its own targeting rationale," without backing up any of the encrypted data.

So the victim had no way to get their data back, right? What's the incentive to pay the random then, if the attacker had encrypted the data without backing it up and wouldn't be able to decrypt it?

Re:So did it fail in the last stage?

[wed128]

You're not giving them money because they can decrypt your data. You're giving them money because they *say* they can decrypt your data. By the time you find out your data's gone, so is your money.

Re:

[Fly Swatter]

That only works once or twice, why would the next victim bother to even thinking about paying if it has been determined to not work?

Re:

[allo]

And that market seems to really work. People reported telling the random ware author that the money is a huge amount in their country and got a rebate. Seems that some ransom wares have a more reliable support than many commercial products and the authors more common sense then many vendors.

Re:

[Jeremi]

What's the incentive to pay the random then, if the attacker had encrypted the data without backing it up and wouldn't be able to decrypt it?

Without a hostage there is no ransom! [youtu.be]

Re: So did it fail in the last stage?

[firewrought]

Absolutely no incentive. Normally ransomware gangs (I've heard) strive to provide great customer service in order to maintain trust that they will decrypt future victim's payloads. But since this attack was carried out by AI the data was at the mercy of a stochastic parrot. The lesson learned for the attackers will probably be to ask the attack to execute a known script once it achieves a toehold instead of trusting the prompt to do so the work.

Internet-facing "Langflow"?

[Tailhook]

If you actually find anyone doing that in the real world, you should point and laugh until they get angry.

Re:

[dfghjk]

Yeah, that's definitely the problem and you've definitely found the solution.

Re: Internet-facing "Langflow"?

[dhrabarchuk]

They got in via MySQL exposed using valid credentials. And no one knows how they got the credentials. I think security in general was an afterthought of the victim. My guess is a vibe coder who got vibed.

Whose agent

[Retired Chemist]

This thing was presumably running on someone's system. Hunt them down.

Re:Whose agent

[gweihir]

While I appreciate the sentiment, if that would work, we would not have a global silent ransomware catastrophe on our hands ...

Re:

[gweihir]

Stop projecting. Well, maybe you are really this disconnected from actual reality. MAGA? Religious fuckup? Or even only run-of-the-mill self-important moron?

For some actual examples, there have been some spectacular IT attacks on US national security. Did they ever find the ones who did it (beyond mindless political cries of "China!" or "North Korea!")? No, they did not beyond a very small number of cases. And why did they not? Because it is actually exceptionally hard to do. So hard that even the NSA strug

Re:

[Retired Chemist]

And because if they are in China or North Korea, they are hard to reach. But I also feel like they are not really trying.

Re:

[gweihir]

I am unsure whether they are really trying. One problem the US has is that if it started to really go after the attackers, with international help (only way it would work), it would have to go after a lot of its own government people as well. So they may want to not draw too much attention to their own activities. Or they are really trying and failing. Hard to say.

Re:

[Synonymous Homonym]

because if they are in China or North Korea, they are hard to reach.

Unless you know who did it already, you have no way of knowing if they are in China or Korea.

Re:

[apparently]

Yeah, how stupid of them for thinking "why don't we simply just catch all the criminals? has no one thought of that?" is pure dumbfuckery. You really got their ass, champ

Re:

[Himmy32]

Here's the thing about people who break into computers. They can use hacked computers to run evil programs.

Re:

[Retired Chemist]

Perhaps if we held people whose devices were hacked and used in botnets more liable for the damage, people would have better security.

Re:

[Himmy32]

Yep, Grandma is a criminal for buying that picture frame at Walmart.

Re:

[Retired Chemist]

How about the manufacturer of the frame?

Re:

[Himmy32]

They released an update, grandma just didn't install it.

Re:

[Retired Chemist]

Still their fault. Firstly, they shouldn't make tech with holes, secondly, they should be more proactive about the updates. Just putting it out there is no sufficient.

Re:

[Himmy32]

Ah, yes the very reasonable take of there should be no security holes in software. And we need to cede all control of our electronic devices in the names of security.

Re:

[Charlotte]

Problem is there are a lot of government actors doing this crap, it's modern-day spy stuff. And everyone's doing it. And many of the for-profit attacks are actually government level too (North Korea is infamous for this). Hard to know which is which, and you can end up investigating yourself, and that's really bad PR.

In the end it's an arms race and people just need to keep up.

Finally a good use for this tech!

[gweihir]

Or rather something it is good enough to actually do. Keep in mind that attacks, extortion, etc. all to not need reliability, they just need volume. If a rather large part of those attacked are left hanging, that is totally fine.

Re:

[unrtst]

Or rather something it is good enough to actually do.

Yeah, sadly true. These things can be very powerful in most of the cases where a hit-or-miss result is acceptable or can be retried.

* Building a little personalized app for your own use, or for you and your friends - great. And everyone understands when it eats your face.
* Pen testing - wonderful. It doesn't have to succeed at all, but it can certainly hammer away with a myriad of attacks.
* Chat bot for chat sake - no problem. Even if it leads some people to suicide, so would talking to random strangers.
* P

Re:

[gweihir]

Exactly. And the attacker can just tell an LLM to generate 20 different attack programs. If just one works and installs the (very much not LLM-generated) root-kit, they have an almost full victory. What all the C-levels that push LLMs for code generation do not get is that production code cannot be hit-or-miss or there will eventually be hell to pay.

Even more so as as attackers have now created working attack code from patches very fast using LLMs several times. I think the time needed to patch has become t

Re:

[unrtst]

What all the C-levels that push LLMs for code generation do not get is that production code cannot be hit-or-miss or there will eventually be hell to pay.

I don't disagree with the rest of what you said, but part of this is off the mark. The "C-levels ... do not get" part. They get it. It's a risk/reward thing. People introduced loads of bugs as well - that's what the LLMs are exploiting! IME, they're aware, but they believe it can be solved by more use of it.

Whether or not the issues will cost them enough to regret this is another question. With so many doing it, it's like the old mantra, "Nobody gets fired for buying IBM," but in this case they can just cas

Grey Goo

[jrq]

The "grey goo" is here. Just not as we expected.

Re:

[phantomfive]

Used to be you could filter out these kind of attacks by filtering based on RFC 3514 [ietf.org]. Unfortunately, lately all traffic from Google has been setting the bit and flooding the zone, so it's hard to see through all the noise.

Backups

[Canberra1]

Always have multiple levels of backups. Always have a working recovery plan. Know that you can recover when you are 'out'. Yet gazillions of chimp companies with patsy IT security chiefs (Thinking of Get Smart logic) are there just to absorb the blame. One day AI will mine the darkweb and find the weakest links, and really go to town. Today I read the latest AI engines have malicious payloads to discover the user doing the query. Automated blackmail and smear campaigns coming soon.

early adapters

[noshellswill]

Reading many many boo-hooz from *.ai users ... how their buttz get used and abused ... I guess the message is: if you live on the edge, there's no way to hedge. Kinda like airline passengers riding  early British COMET jet planes ... BOOM !  Seems to me none of this AI.crap should have been allowed out of government "clean-rooms " < like SMALL POX virus > for another 50 years.

What?

[Uldis Segliņš]

Is this a controlled test system or real live system and real hackers behind it? If real, then I see no problem to track the LLM user and get him prosecuted. Just try to use any LLM - almost all of them need your email, phone number, SSO provider info, cookies, your location, facescan, fingerprint and dicpics in 3 generations. They have your profile in detail more than you remember about yourself.