Agentic AI Used in Ransomware Attack via Langflow CVE-2025-3248

A threat actor tracked as JadePuffer has executed what cloud security firm Sysdig describes as the first fully agentic AI-driven ransomware campaign, exploiting a critical missing authentication vulnerability in the open-source Langflow framework to compromise an internet-exposed instance and pivot deep into the victim's infrastructure. JadeSnyder gained initial access by exploiting CVE-2025-3248, a critical flaw disclosed in April 2025 and flagged by CISA as actively exploited in early May. With a CVSS score of 9.8, the bug allows unauthenticated attackers to execute arbitrary Python code on the host running Langflow, a Python-based, LLM-agnostic framework widely used for building agentic workflows.

Once code execution was achieved, the attacker leveraged the embedded LLM itself as an autonomous operator. The model performed real-time reconnaissance, sweeping the filesystem for secrets including API keys, cloud credentials, cryptocurrency wallets, configuration files, and database logins. It then dumped Langflow's Postgres database to harvest additional stored credentials, scanned the reachable internal address space and named services, probed for MinIO endpoints for further credential extraction, and deployed a cron job to maintain persistent access. Throughout this phase, the LLM adapted its behavior dynamically, adjusting extraction techniques based on file types and responding to authentication prompts on discovered endpoints. Organizations concerned about exposed services can verify their exposure using a port scanner or run a quick SSL/TLS checker on their Langflow deployments.

In the second phase, JadePuffer used the LLM to pivot laterally to a production server hosting MySQL and the Alibaba Naming and Configuration Service (Nacos), a platform plagued by well-known security bypasses including a default JWT signing key that enables trivial token forgery. The attacker authenticated to MySQL using harvested root credentials, then compromised Nacos through multiple vectors: exploiting the CVE-2021-29441 auth-bypass family, forging valid JWTs with the default signing key, and injecting a backdoor administrator directly into the Nacos backing database. The LLM was observed adjusting payloads to pass login verification, checking for User Defined Functions capable of OS command execution, and narrating its own targeting rationale as it escalated from row-level deletion to dropping entire database schemas.

The final stage encrypted 1,342 Nacos service configuration items and created an extortion table containing a ransom demand, a payment address, and a contact email. Notably, the symmetric encryption key was randomly generated on the victim's host but never persisted or exfiltrated, making recovery effectively impossible without the key. The incident highlights an emerging paradigm in which LLMs function as fully autonomous intrusion agents rather than mere assistant tools, underscoring the urgency of patching exposed Langflow instances, rotating any credentials that may have resided in them, and reviewing password strength for all accounts that interact with Langflow components.