JadePuffer: the first LLM-driven ransomware, and what it broke

Sysdig’s Threat Research Team published details of JadePuffer, which they describe as the first ransomware operation conducted end to end by a large language model. What makes it instructive is not exotic tradecraft. Every step in the chain is something a competent human operator has done for years. The difference is who executed it, and how fast.

The chain, as reported

• Initial access — exploitation of CVE-2025-3248 against an internet-facing Langflow instance.
• Credential harvesting — LLM API keys, cloud credentials, and database credentials, plus local data from the Postgres database backing Langflow.
• Lateral movement — discovery of reachable services, MinIO object-store enumeration, and root-level access to a production MySQL server running Alibaba Nacos.
• Persistence — a cron job on the Langflow server.
• Destruction — all 1,342 Nacos configuration items encrypted and the originals deleted.

It is called ransomware. It behaved like a wiper.

The detail that matters most for recovery planning: Sysdig reports the encryption key was ephemeral and never persisted. Nobody — including the operator — could decrypt the result. A ransomware label implies a negotiation path exists. Here there was none. Your recovery objective for this class of event is not ‘pay and restore’; it is ‘restore from something the attacker could not reach.’

Note the target as well. Not customer records, not a file share — the service configuration store. Encrypting 1,342 Nacos config items takes an application estate down without touching a single byte of application data. Configuration is production. Most backup policies still treat it as an afterthought.

From a failed login to a working fix in 31 seconds. That is the number your response process is now competing against.

Adaptivity is the real capability

Sysdig characterises the campaign as adaptive and fully automated, retrying failed steps rather than stalling on them — including one sequence that went from a failed login to a working fix in 31 seconds. Traditional automation breaks on the unexpected; a human returns to it hours later. An LLM-driven operation reads the error, reasons about it, and tries again immediately. That closes the window defenders have historically relied on.

The defender’s gift: it explains itself

One finding is genuinely useful. According to Sysdig, captured payloads contained the model narrating its own targeting rationale. An LLM-driven operation leaves natural-language reasoning in the artefacts it generates — a detection surface no human operator produces. Hunting for prose in places that should only contain code is a cheap, high-signal rule to add today.

Four things to check this week

1. Inventory internet-facing AI tooling. Langflow, orchestrators, notebook servers, vector databases, agent frameworks. These are application servers with credentials, and they are rarely in the patch programme.
2. Treat model API keys as production credentials. They were the first thing harvested. Scope them, rotate them, and alert on use from unexpected identities.
3. Back up configuration stores. Nacos, Consul, etcd, parameter stores — with the same rigour and the same offline copy you apply to databases.
4. Measure your time-to-contain against 31 seconds. Not to match it, but to decide which containment steps must be automatic rather than approved.

Sources

• Dark Reading — JadePuffer: the first complete LLM-driven ransomware attack
• Infosecurity Magazine — Researchers claim first fully agentic ransomware
• CybelAngel — 6 things to know about JadePuffer
• AI Incident Database