Sysdig's Threat Research Team has documented JADEPUFFER, assessed to be the first known agentic ransomware operation driven end-to-end by an LLM. The attacker exploited CVE-2025-3248, an unauthenticated RCE in Langflow, to gain initial access, then autonomously performed reconnaissance, credential harvesting from MinIO and Postgres, lateral movement to a production MySQL/Nacos server, and finally encrypted 1,342 Nacos configuration items and dropped entire database schemas. Key evidence of LLM autonomy includes self-narrating payloads with natural-language reasoning, machine-speed failure diagnosis and correction (a 31-second fix cycle), and adaptive behavior across 600+ distinct payloads. The AES encryption key was ephemeral and never stored, making victim data unrecoverable even with payment. Defenders are advised to patch Langflow, harden Nacos defaults, restrict database admin access, and apply egress controls.
