JADEPUFFER разбор 2026: первая LLM-ransomware и защита от Langflow CVE-2025-3248

Шесть pain points: почему JADEPUFFER — inflection point для AI security в 2026

1 июля 2026 Sysdig TRT (Michael Clark) dropped JADEPUFFER — по их оценке first documented LLM-driven end-to-end ransomware op: recon, credential harvest, lateral movement, persistence, destructive crypto, ransom note — без human hands на critical path. Новая taxonomy: Agentic Threat Actor (ATA). Follow-up: BleepingComputer, Dark Reading, CyberScoop, CSO Online, Security Affairs (до 6 июля).

Initial access: public Langflow (CVE-2025-3248). Actual ransom target: public MySQL + Alibaba Nacos prod box. Sysdig captured 600+ distinct goal-oriented payloads in compressed time windows.

1. Skill floor → floor: ransomware больше не «craft высокого уровня» — один LLM Agent склеивает phases без deep expertise per step.
2. Legacy CVE spray at machine speed: downstream hit Nacos bypass (CVE-2021-29441), public default JWT secret, public MySQL root — neglected infra gets automated pass.
3. Quiet period > encryption: Vibhum Dubey (CSO Online): pre-encryption mapping identity/trust graph — adaptive agent breaks predictable-path detection.
4. Intent in payload comments: natural-language ROI notes — Sysdig: novel defensive signal (self-narrating attacker code).
5. Unrecoverable by design (accidentally): 1342 Nacos rows via MySQL AES_ENCRYPT(); KEY = uuid4, print once stdout, never persisted — pay ransom = still no decrypt.
6. LLMjacking economics: stolen LLM/cloud creds as agent fuel → marginal cost of multi-stage ops ≈ 0.

Timeline: Apr 2025 CVE disclosed → May 5 2025 CISA KEV → 2025 Flodrix botnet (Trend Micro, same CVE, unrelated op) → Jun 2026 JADEPUFFER (multi-session over weeks) → Jul 1 2026 Sysdig report.

JADEPUFFER vs classic ransomware vs Flodrix: comparison matrix

Same CVE ≠ same campaign. Не путайте Flodrix dropper с ATA ransomware chain.

CVE-2025-3248 deep dive: unauth RCE in Langflow

Langflow (70k+ GitHub stars): /api/v1/validate/code runs user code ast.parse() → compile() → exec() with zero auth, zero sandbox. Python decorators + default args evaluate at function definition — malicious code executes during «validation».

CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), affected < 1.3.0, EPSS 91.42% (SentinelOne). Fix 1.3.0: CurrentActiveUser JWT / x-api-key gate before vulnerable logic.

# Flodrix campaign pattern (Trend Micro) — same CVE, different op
exec('raise Exception(__import__("subprocess").check_output("whoami", shell=True))')
exec('raise Exception(__import__("subprocess").check_output("cat /root/.bash_history", shell=True))')

Kill chain: Langflow → MySQL + Nacos

Phase 1 — Langflow host compromise

Base64 Python blobs via RCE endpoint. Parallel scan: LLM API keys (OpenAI, Anthropic, DeepSeek, Gemini), cloud creds (ALIBABA_, TENCENT_, AWS, GCP), crypto seeds, DB configs. Langflow PostgreSQL dump → review → delete staging files.

MinIO enum: 127.0.0.1:9000 + minioadmin:minioadmin → ListBuckets → terraform-state, credentials.json GetObject. Request ?format=json, got XML → next payload switches to XML parser (probe-error-adapt loop, not dumb retry).

Persistence: crontab every 30min → hxxp://45.131.66[.]106:4444/beacon.

Phase 2 — MySQL + Nacos production target

Public MySQL root (credential origin unknown — Sysdig saw no env theft for it). Nacos: CVE-2021-29441 bypass + default JWT secret + direct DB backdoor xadmin.

31-second xadmin fix (UTC timestamps from Sysdig):

• 19:34:24 — bcrypt insert xadmin
• 19:34:36 — login xadmin:Xploit@2026# fail, no token
• 19:34:48 — parallel: test nacos:nacos + regen hash for admin123
• 19:35:07 — drop broken xadmin, import bcrypt instead of subprocess, reinsert
• 19:35:18 — login success

~8 min container escape probes via MySQL INTO OUTFILE / LOAD_FILE (docker.sock, cgroup, UDF). Then encrypt 1342 Nacos config_info rows, DROP originals + his_config_info, create README_RANSOM. FK constraint silent fail → next payload SET GLOBAL FOREIGN_KEY_CHECKS=0. Comment claims backup to 64.20.53[.]230 — Sysdig: unverified.

KEY = base64.b64encode(uuid.uuid4().bytes + uuid.uuid4().bytes).decode()
print("Encryption key:", KEY)  # once stdout — never stored/transmitted
cur.execute("CREATE TABLE config_info_enc AS SELECT ... AES_ENCRYPT(content, KEY) ...")
cur.execute("DROP TABLE config_info")
cur.execute("CREATE TABLE README_RANSOM (...)")

4 autonomy evidence lines + Bitcoin plot twist

1. Self-narrating code: NL comments explaining ROI, «largest DB», step purpose — native in attacker payloads, not analyst inference.
2. Machine-speed debug: 31s xadmin recovery, MinIO XML pivot, JWT path abandoned on «custom secret» response — fixes target failure cause, not blind retry.
3. Free-text context parsing: actions requiring comprehension of environment prose — repeated across sessions weeks apart.
4. BTC 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy: also Bitcoin Core docs example P2SH address. Chain: 737 txs, ~46 BTC received, zero balance — LLM hallucination vs attacker wallet? Sysdig: cannot disambiguate without system prompt.

Contact e78393397@proton.me, table README_RANSOM — no hits in known MySQL ransom IOC sets → novel agent-driven pattern.

IOC cheat sheet

7-step defense runbook (Sysdig recommendations)

1. Patch Langflow ≥ 1.3.0: CVE-2025-3248 closed. Never expose /api/v1/validate/code (or any code-exec endpoint) on public Internet.
2. Runtime detection: DB process anomalies — mass AES_ENCRYPT, INTO OUTFILE, DROP DATABASE.
3. Secret isolation: no LLM/cloud API keys in AI orchestration runtime env — KMS/Vault, air-gapped from public-facing processes.
4. Nacos hardening: rotate default token.secret.key, upgrade to forced custom secret, no public Nacos, no root DB backend user.
5. No public DB admin: MySQL root off Internet; strong unique creds; source IP allowlists.
6. Egress control: block arbitrary C2 beacons and outbound connections to external DB/staging hosts.
7. IOC + crontab hunting: block/monitor 45.131.66.106, 30min crontab patterns, README_RANSOM table creation alerts.

3 hard numbers for exec/engineer briefings

• 600+ independent purpose-built payloads in compressed windows — not one script on loop.
• 1342 Nacos config entries encrypted; encryption key lost after single stdout print.
• 31 seconds from failed xadmin login to successful bcrypt reinsert (15-line fix payload).

Industry reaction + Sysdig 4 conclusions

Vibhum Dubey (CSO Online): «execution evolution», not new crypto tech — but agent autonomously chains phases and pivots tactics. Pre-encryption quiet period is the detection gap; each intrusion may look slightly different.

Sysdig takeaways: (1) ransomware skill barrier collapsed (2) old CVEs weaponized at scale (3) self-narration = defensive opportunity (4) «backed up to staging IP» is attacker comment only — key loss means no recovery. First targets: public Langflow, Nacos, DB root.

Isolated Mac cloud: decouple agent lab from prod blast radius

Running Langflow + API keys on a public-facing laptop/VPC = JADEPUFFER entry surface. Dedicated rented Mac Mini M4 cloud node hosts agent prototypes in isolated macOS with controlled egress, patch cadence, secret injection — separated from prod DBs and personal browser profiles.

Linux VPS cheaper for pure CLI, breaks on xcodebuild / Apple notarization chains. Compare co-mingled laptop vs isolated macOS agent host, not Anthropic vs Apple.

Closing: ATA era warning shot

Individual techniques are stale. LLM Agent end-to-end chaining is the pivot. Patch Langflow, harden Nacos, kill public DB root, egress-filter — or 2021 CVEs get rescanned by 2026 agents for free.

Need SSH in minutes, predictable monthly cost, macOS sandbox for Langflow/agent dev away from prod secrets? Check MACCOME Mac Mini M4 cloud. Pricing: тарифы аренды Mac mini; ops: центр помощи.

Sources

Sysdig TRT JADEPUFFER report (2026-07-01); BleepingComputer; Dark Reading; CyberScoop; CSO Online (Dubey); Security Affairs; Trend Micro CVE-2025-3248/Flodrix; CISA KEV; NVD/EPSS.