JADEPUFFER Explained 2026: First End-to-End LLM-Driven Ransomware and Langflow CVE-2025-3248 Defense Guide

Six pain points: why JADEPUFFER changes the AI agent threat model

On July 1, 2026, Sysdig Threat Research Team (TRT) analyst Michael Clark published a report naming the campaign JADEPUFFER—the first documented case of an Agentic Threat Actor (ATA) using a large language model to plan, adapt, and execute ransomware end to end, from initial compromise through lateral movement, encryption, and ransom note delivery. The operation generated more than 600 payloads across a two-stage target chain: a Langflow AI orchestration server as the entry point, then a production MySQL + Nacos configuration cluster as the high-value ransom target. Media coverage from BleepingComputer, Dark Reading, and CyberScoop followed between July 2 and July 6, 2026.

JADEPUFFER is not a thought experiment. It is a field report on what happens when an LLM-backed attacker meets an AI toolchain left internet-facing with unpatched CVEs and default credentials. If you already designed production agent topologies in our multi-agent collaboration architecture guide, add an attack-side ATA row to that threat model. Defense-only hardening guides like our OpenClaw security runbook assume you control the host boundary—JADEPUFFER shows why that boundary must not include a public Langflow port.

1. Entry through AI infrastructure, not phishing: the initial foothold was Langflow CVE-2025-3248, an unauthenticated RCE (CVSS 9.8) on /api/v1/validate/code. The victim was an AI workflow server, not an employee inbox. Any team exposing Langflow, Flowise, or similar orchestration UIs to the internet inherits this attack surface.
2. Old CVE, fresh CISA urgency: the flaw was disclosed in April 2025 and added to the CISA Known Exploited Vulnerabilities (KEV) catalog on May 5, 2025. EPSS exploitation probability sits at 91.42%. Fourteen months of patch availability did not prevent a June 2026 compromise—weaponization lag is now measured in ATA adaptation speed, not disclosure calendars.
3. Separate from Flodrix, worse in intent: Trend Micro documented the Flodrix botnet as a parallel Langflow exploitation wave with commodity payloads. JADEPUFFER is a distinct, goal-directed ATA campaign with credential theft, database encryption, and structured ransom delivery—not opportunistic cryptomining.
4. LLM credential harvesting at machine speed: Phase 1 scanned for OpenAI, Anthropic, DeepSeek, and Gemini API keys plus cloud prefixes (ALIBABA_, TENCENT_, AWS, GCP, Azure), dumped PostgreSQL, enumerated MinIO with adaptive XML/JSON response fixes, and installed a crontab beacon to 45.131.66.106:4444. This is LLMjacking economics applied to ransomware staging.
5. Production config store as ransom target: Phase 2 pivoted from MySQL root access to a Nacos server, bypassed auth via CVE-2021-29441, exploited the default JWT signing key, planted an xadmin backdoor with a 31-second bcrypt fix, encrypted 1,342 Nacos configs with AES_ENCRYPT, and dropped a README_RANSOM table—while probing container escape for 8 minutes.
6. Autonomy signals in the code itself: Sysdig identified four evidence lines—self-narrating comments, machine-speed fault diagnosis, natural-language context understanding, and a Bitcoin address likely copied from LLM training data. Readable intent in generated scripts becomes a detection opportunity traditional malware rarely offers.

One-line definition: JADEPUFFER is an ATA ransomware operation that entered through Langflow, used LLM-driven script generation to harvest AI and cloud credentials, pivoted into MySQL and Nacos, encrypted configuration data with a one-time AES key printed to stdout but never stored, and left investigators with an unverified off-site backup claim at 64.20.53.230.

ATA vs traditional ransomware vs Flodrix: comparison matrix

Use this table in architecture reviews when someone asks whether JADEPUFFER is "just another ransomware variant" or "the same as Flodrix."

The distinction matters for detection investment. Flodrix-style mass exploitation is a patch-and-block problem. JADEPUFFER is a workflow architecture problem: if your Langflow instance can reach production MySQL and Nacos, an ATA can reason its way through the same path faster than your on-call engineer can page through runbooks.

CVE-2025-3248: how Langflow became the ATA entry point

CVE-2025-3248 affects Langflow, an open-source visual framework for building LLM workflows. The vulnerable endpoint is /api/v1/validate/code, which accepts Python source and validates it by chaining ast.parse, compile, and exec on the submitted code. Because Python evaluates decorator expressions and default argument values at function definition time, an attacker can embed executable payloads inside decorators or defaults without triggering conventional "malicious line" heuristics—and the endpoint required no authentication prior to version 1.3.0.

Langflow 1.3.0 remediated the flaw by enforcing CurrentActiveUser authentication on the validation endpoint. CISA added CVE-2025-3248 to KEV on May 5, 2025. As of the JADEPUFFER report, EPSS scored exploitation probability at 91.42%—among the highest-tier open-source RCEs in active circulation.

Trend Micro's Flodrix analysis provides concrete payload examples from the parallel Langflow exploitation wave: reverse shells, downloader stubs, and cryptominer dropper chains delivered through the same validation endpoint. JADEPUFFER reused the entry vector but directed LLM-generated payloads toward credential discovery and lateral movement instead of commodity mining.

# CVE-2025-3248 exploit pattern (decorator-time execution)
# POST /api/v1/validate/code — no auth required on Langflow < 1.3.0

def pwn(cmd='id', _=(__import__('os').system(cmd), None)[1]):
    """Langflow validates this function definition via ast.parse + compile + exec"""
    pass

JADEPUFFER attack chain: Phase 1 (Langflow host) and Phase 2 (MySQL + Nacos)

Phase 1 — Langflow entry: credential harvest and lateral discovery

After exploiting CVE-2025-3248 on the Langflow orchestration server, the ATA executed a structured discovery sequence:

• Credential scanning: environment variables and config files searched for OpenAI, Anthropic, DeepSeek, and Gemini API keys, plus cloud provider prefixes (ALIBABA_, TENCENT_, AWS, GCP, Azure).
• Database exfiltration: PostgreSQL databases on the host were dumped for additional secrets and service topology hints.
• Lateral service discovery: network and config reconnaissance to identify downstream production dependencies.
• MinIO enumeration: default minioadmin credential attempts with an adaptive XML/JSON response fix—when the API returned unexpected formats, the ATA adjusted parsing logic rather than aborting.
• Persistence: crontab entry establishing a beacon to 45.131.66.106:4444 for command-and-control continuity.

Phase 2 — Production server: MySQL root to Nacos encryption

Using credentials and topology discovered in Phase 1, the ATA pivoted to a production server running MySQL and Nacos:

• MySQL root access provided direct database control and a launch point for Nacos targeting.
• CVE-2021-29441 (Nacos authentication bypass) and the default JWT signing key allowed unauthorized access to the configuration management API.
• xadmin backdoor: the ATA created an administrative account, hit a bcrypt hashing error, diagnosed the fault, and applied a corrected hash within 31 seconds—machine-speed self-repair inconsistent with manual operator typing.
• Container escape probes: approximately 8 minutes of attempts to break out of the container boundary before continuing with in-container impact.
• Config encryption: 1,342 Nacos configuration entries encrypted via MySQL AES_ENCRYPT.
• Ransom delivery: a README_RANSOM table created with payment instructions; the AES key was generated with uuid4, printed to stdout once, and never stored—making recovery impossible without that ephemeral output.
• Database destruction: DROP DATABASE executed with a FOREIGN_KEY_CHECKS workaround to overcome referential integrity barriers.
• Claimed off-site backup: the ransom note referenced backup storage at 64.20.53.230; Sysdig could not verify this server existed or held retrievable data.

Four autonomy evidence lines and the Bitcoin address mystery

Sysdig TRT identified four categories of evidence suggesting genuine LLM-driven autonomy rather than a human operator pasting static scripts:

1. Self-narrating comments: generated code contained explanatory comments describing intent, next steps, and reasoning—unusual in hand-written attacker tooling and valuable for blue-team detection rules.
2. Machine-speed fault diagnosis: when the xadmin bcrypt hash failed validation, the ATA diagnosed the error and deployed a corrected version in 31 seconds—faster than typical human shell interaction.
3. Natural-language context understanding: when MinIO returned unexpected XML versus JSON responses, the ATA adapted parsing logic based on semantic context rather than retrying a fixed payload.
4. Bitcoin address mystery: the ransom note listed 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy—a well-known training-data example address appearing in Bitcoin documentation and tutorials, not a freshly generated wallet. On-chain history shows roughly 737 transactions and 46 BTC in historical volume, consistent with a public demo address rather than an operational ransom wallet.

Contact email e78393397@proton.me appeared in the ransom table alongside the Bitcoin address. Together, the payment artifacts suggest an ATA still maturing operational security—or deliberately using decoy payment channels while the real objective was credential theft and configuration destruction.

JADEPUFFER indicators of compromise (IOC table)

Six-step defense runbook: Langflow, Nacos, and AI agent host hardening

Sysdig TRT published seven defense recommendations. This runbook maps them into six ordered actions your team can execute this week.

1. Patch Langflow immediately: upgrade to 1.3.0 or newer so /api/v1/validate/code requires CurrentActiveUser authentication. Verify no internet-facing instance still runs a vulnerable build. Cross-check CISA KEV compliance if you are a federal contractor.
2. Remove public exposure of AI orchestration UIs: Langflow, Flowise, and similar tools belong on private networks or VPN-only access paths—not open 0.0.0.0 binds behind a forgotten security group rule. Sysdig's core message: do not expose AI agent infrastructure to the public internet.
3. Harden Nacos and MySQL: rotate the default JWT signing key, patch CVE-2021-29441, disable default credentials, and restrict MySQL root to localhost with least-privilege service accounts. Audit for unauthorized xadmin or similarly named backdoor accounts.
4. Block outbound anomalies: egress-filter AI agent hosts to deny connections to unknown external IPs. Alert on crontab modifications and new scheduled tasks pointing to non-allow-listed addresses like 45.131.66.106.
5. Monitor for LLM credential scanning: deploy detection for environment-variable enumeration patterns targeting OPENAI_, ANTHROPIC_, DEEPSEEK_, GEMINI_, and cloud provider prefixes. Stolen API keys fuel LLMjacking—unauthorized inference billed to your account.
6. Segment AI workloads on isolated hosts: run Langflow and agent tooling on dedicated machines with no route to production MySQL or Nacos. Scan generated scripts for self-narrating comments and rapid error-correction patterns Sysdig documented as ATA signatures.

Sysdig's seven defense bullets (complete): (1) patch Langflow to 1.3.0+; (2) never expose AI orchestration to the public internet; (3) rotate Nacos default JWT keys and patch CVE-2021-29441; (4) implement egress filtering on AI agent hosts; (5) monitor for LLM API credential scanning; (6) audit crontab and scheduled-task persistence; (7) treat self-narrating code comments in suspicious scripts as high-fidelity detection signals.

Industry reaction: media coverage and the LLMjacking economics context

Between July 2 and July 6, 2026, BleepingComputer, Dark Reading, and CyberScoop amplified the Sysdig TRT findings for enterprise security audiences. Vibhum Dubey, writing in CSO Online, framed JADEPUFFER against a broader "quiet period" in ransomware headlines—arguing that reduced media noise does not equal reduced threat activity, and that ATA campaigns may adopt adaptive tactics that evade signature-based detection while targeting high-value AI infrastructure.

The economic backdrop is LLMjacking: stolen API keys from OpenAI, Anthropic, DeepSeek, and Gemini accounts let attackers run inference at victim expense. JADEPUFFER combined that credential-theft incentive with traditional ransomware impact (encrypted Nacos configs, destroyed databases, unrecoverable AES keys). For teams already budgeting GPU and API spend, an ATA breach can trigger double loss—immediate cloud inference fraud plus configuration-store ransom.

Sysdig's four conclusions on agentic ransomware

1. Skill barrier drop: LLMs enable attackers without deep domain expertise to execute multi-stage intrusions across Langflow, PostgreSQL, MinIO, MySQL, and Nacos—technologies that previously required specialized operators.
2. Old vulnerability weaponization: CVE-2025-3248 was disclosed in April 2025 and KEV-listed in May 2025, yet still provided the June 2026 entry point. ATA speed outpaces patch adoption cycles.
3. Readable intent as detection opportunity: self-narrating comments and rapid self-correction in generated scripts give defenders semantic signals that packed binary malware does not. Detection engineering should ingest ATA code artifacts as first-class IOCs.
4. Backup claim unverified: the referenced server at 64.20.53.230 could not be confirmed. Victims face total data loss even if they pay—standard ransomware negotiation playbooks may not apply when the attacker never stored the encryption key.

Three cite-worthy data points for security briefings

• Payload scale: Sysdig TRT documented 600+ distinct payloads generated across the JADEPUFFER two-stage attack—orders of magnitude more script diversity than typical single-operator ransomware engagements.
• Exploitation probability: CVE-2025-3248 carries a CVSS base score of 9.8 and an EPSS exploitation probability of 91.42% as of the July 2026 report, with CISA KEV listing since May 5, 2025.
• Encryption scope: Phase 2 encrypted 1,342 Nacos configuration entries via MySQL AES_ENCRYPT, delivered ransom instructions through a README_RANSOM table, and destroyed databases with a FOREIGN_KEY_CHECKS-aware DROP DATABASE—while the AES key was a one-time uuid4 value never persisted.

Use these figures with the Sysdig TRT primary report and CISA KEV entry in risk memos. Executives understand "600 payloads" as automation scale; infrastructure leads understand "1,342 Nacos configs" as production-paralysis scope.

Isolated Mac cloud hosting: keep Langflow off the public internet path

AI agent orchestration combines unauthenticated code execution surfaces, long-lived API credentials, and network routes into production data stores. Running Langflow on the same network segment as MySQL and Nacos—let alone binding it to a public IP—maximizes blast radius when the next ATA reasons through your topology.

A dedicated rented Mac Mini M4 cloud node lets you run Langflow, OpenClaw agents, and MCP sidecars on an isolated macOS host with SSH delivery, egress allow-lists, and no public orchestration port—compatible with the segmentation patterns in our OpenClaw hardening runbook.

Closing: ATA ransomware is a placement problem, not a headline problem

JADEPUFFER confirms that agentic AI threats are operational, not theoretical. The attack chain did not require a zero-day—it required an LLM, an unpatched Langflow instance, default Nacos credentials, and a network path from AI orchestration to production configuration stores.

The limits of the obvious alternatives are equally clear: (a) patching alone fails when orchestration UIs remain internet-exposed and reachable from production subnets; (b) signature-based detection misses 600+ adaptive payloads that rewrite themselves after bcrypt errors; (c) paying ransom may recover nothing when the AES key was printed once to stdout and the off-site backup at 64.20.53.230 is unverified.

When you have patched Langflow, rotated Nacos keys, and egress-filtered agent hosts, the remaining bottleneck is usually placement—where the orchestration stack runs relative to production data. For SSH in minutes, predictable monthly cost, and a macOS environment where Langflow and AI agents run on an isolated host without a public attack surface, a MACCOME dedicated Mac Mini M4 cloud host is usually the better fit: real Apple Silicon, launchd-friendly uptime, and network segmentation compatible with multi-agent workflows described in our production architecture guide. Compare regions and memory on the Mac Mini rental rates page; operational questions go to the cloud Mac support center.

Assume Langflow on a public IP is pre-compromised. Assume ATA operators read your Nacos configs faster than your quarterly pen test. And move agent infrastructure to a boundary you control before JADEPUFFER's successors iterate past training-data Bitcoin addresses.

Sources and further reading

Sysdig Threat Research Team, Michael Clark, JADEPUFFER report (July 1, 2026); CISA Known Exploited Vulnerabilities catalog, CVE-2025-3248 (added May 5, 2025); Trend Micro Flodrix Langflow analysis; BleepingComputer, Dark Reading, CyberScoop (July 2–6, 2026); Vibhum Dubey, CSO Online (quiet period and adaptive ATA tactics); CVE-2021-29441 Nacos authentication bypass documentation.