JADEPUFFER: The First Fully Agentic
LLM Ransomware Attack Chain Explained

Overview: ransomware with an AI operator

Why OpenClaw / Langflow users should care

1. 01

   AI orchestration hosts often store LLM API keys in environment variables—the first thing JADEPUFFER scanned.

2. 02

   Teams rush prototypes online with Langflow/OpenClaw Gateway exposed without access controls.

3. 03

   CVE-2025-3248 has been in CISA KEV since May 2025; agents make weaponizing old bugs nearly free.

4. 04

   LLMjacking: stolen cloud/model credentials drive agents at near-zero marginal cost.

CVE-2025-3248: full Langflow unauthenticated RCE analysis

Root cause in five steps:

1. 01

   Langflow exposes a “code validation” API so users can syntax-check custom function nodes in the visual editor.

2. 02

   Implementation path: user code → ast.parse() → compile() → exec().

3. 03

   Critical flaw: no authentication and no sandbox isolation.

4. 04

   Exploit trick: Python decorators and default arguments are evaluated at function definition time; attackers embed malicious code in defaults or decorators—once Langflow “validates,” the code already ran.

5. 05

   Attackers need no login and no privileges—only a crafted HTTP POST for RCE.

exec('raise Exception(__import__("subprocess").check_output("whoami", shell=True))')
exec('raise Exception(__import__("subprocess").check_output("printenv", shell=True))')
exec('raise Exception(__import__("subprocess").check_output("cat /root/.bash_history", shell=True))')

Important distinction: Flodrix botnet delivery and JADEPUFFER are two independent campaigns sharing the same entry CVE. Flodrix is traditional script-driven delivery; JADEPUFFER is Sysdig’s “AI agent–driven” ransomware case.

Patch (1.3.0): post_validate_code gains _current_user: CurrentActiveUser dependency injection; FastAPI checks JWT Bearer Token or x-api-key first—401/403 on failure, request never reaches vulnerable logic.

Attack chain Phase 2: MySQL + Nacos production server

The real target was another equally internet-exposed server running MySQL and Alibaba Nacos. Nacos has auth-bypass history (CVE-2021-29441 and variants), and the default JWT signing secret has been documented publicly since 2020—many deployments never rotated it.

The agent connected to the exposed MySQL port with root credentials—source unclear; Sysdig did not observe them stolen from the victim environment, suggesting one of few possibly human-prepared steps.

Nacos backdoor admin: 31-second repair loop

Container escape probes (~8 minutes)

Used MySQL INTO OUTFILE / LOAD_FILE to test write/read, /var/run/docker.sock, /proc/1/cgroup, /etc/hostname, and UDF escalation paths. Before ransomware, wrote a “completion marker”—Sysdig says this looks like an agent signaling stage completion, not a fixed script behavior.

Destructive encryption and ransom note

Encrypted all 1,342 Nacos service config entries with MySQL AES_ENCRYPT(), dropped original config_info and his_config_info, created ransom table README_RANSOM.

KEY = base64.b64encode(uuid.uuid4().bytes + uuid.uuid4().bytes).decode()
print("Encryption key:", KEY)  # printed once, never stored or exfiltrated
# CREATE config_info_enc → DROP config_info → CREATE README_RANSOM
# Bitcoin: 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy
# Contact: e78393397[@]proton[.]me

Key detail: ransom note claims AES-256, but MySQL AES_ENCRYPT() defaults to AES-128-ECB; the key was random, printed only to stdout, never stored or transmitted—unrecoverable even if ransom is paid. Two minutes later another payload refined the count to “all 1,342 items encrypted.”

Mass destruction and diagnostic fixes

Escalated to DROP DATABASE with code comments claiming “high-ROI databases, backed up to 64.20.53[.]230”—Sysdig found no independent evidence of exfiltration. One DROP DATABASE failed silently on foreign-key constraints; the next payload added SET GLOBAL FOREIGN_KEY_CHECKS=0—fixing requires understanding why it failed, not blind retries.

The Bitcoin address mystery

Ransom Bitcoin address 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy is the standard P2SH format example repeated in Bitcoin developer docs and the Bitcoin Core repository—also abundant in LLM training corpora.

On-chain data: 737 confirmed transactions, ~46 BTC received historically, current balance zero (each deposit immediately swept elsewhere).

Sysdig’s two indistinguishable readings: (a) LLM “hallucinated” the address from training data and the wallet belongs to a third party that sweeps mistaken deposits; (b) attacker configured a real wallet that coincidentally matches the doc example. Without JADEPUFFER’s system prompt, both remain possible.

Official defense recommendations (Sysdig)

1. 01

   Upgrade Langflow past CVE-2025-3248; never expose code execution/validation endpoints to the public internet.

2. 02

   Use runtime threat detection to spot malicious behavior inside database processes.

3. 03

   Do not store LLM API keys or cloud credentials in AI orchestration host environment variables—use dedicated secret management isolated from internet-facing processes.

4. 04

   Harden Nacos: rotate default token.secret.key, upgrade to versions requiring custom secrets; never expose Nacos publicly; do not connect backend DB as root.

5. 05

   Never expose database admin accounts publicly; enforce strong unique credentials and source-IP restrictions on admin ports.

6. 06

   Apply egress control so compromised hosts cannot beacon freely or reach external staging servers.

7. 07

   Monitor the IOCs above; watch crontab jobs calling external URLs and anomalous parenthesized User-Agent strings.

Sysdig’s four conclusions

1. 01

   Ransomware is no longer “skilled-operator craft”: an LLM agent can chain recon, theft, lateral movement, persistence, and destruction without deep operator expertise.

2. 02

   Old bugs are being automated: downstream targets hit 2021-era Nacos issues and never-rotated default secrets; agents make spraying historical CVEs nearly free.

3. 03

   Intent became readable—a defender opportunity: LLMs narrate goals inside payloads, offering a new detection and analysis handle.

4. 04

   “Backed up” was agent self-talk: encryption keys were ephemeral and unrecoverable—payment cannot restore configs.

The report closes: none of the individual techniques are new; what matters is an AI model chaining them into a complete ransom operation against neglected public infrastructure. The skill floor is now “the cost of running an agent.”

Five-step secure deployment checklist (remote Mac + VNC)

1. 01

   Provision isolated node: choose Mac Mini M4 plan; do not map OpenClaw Gateway (18789) or Langflow validate endpoints directly to the public internet—use Nginx/Caddy reverse proxy + HTTPS if external access is required.

2. 02

   Patch: Langflow ≥ 1.3.0; rotate Nacos JWT; no root DB reachable from the internet.

3. 03

   Keys out of env vars: LLM API keys in secret managers or OpenClaw SecretRef, isolated from RCE-capable processes.

4. 04

   VNC graphical verification: check Gateway console, plugin approvals (/approve), macOS Screen Recording/Accessibility—steps SSH cannot complete require VNC.

5. 05

   Egress and IOC monitoring: limit outbound beacons; watch crontab external calls and README_RANSOM IOCs; export backup and stop rental when done.