Sysdig’s 1 July 2026 JADEPUFFER analysis describes an LLM-driven workflow used for database extortion. Its observed sequence links initial access, credential discovery, lateral activity and encryption. This article examines the access relationships that enabled that sequence.
It’s the offensive mirror of every defensive worry in this series. The same properties that make agents useful, they act autonomously, chain tools, and self-correct, are exactly what make an autonomous attacker dangerous.
TL;DR
- Sysdig describes JADEPUFFER as an agentic ransomware operation. That is an assessment of the observed campaign, not a measurement of all ransomware activity.
- Entry was an unpatched Langflow instance (CVE-2025-3248); from there the agent ran recon and harvested credentials autonomously.
- It stole AI API keys, cloud credentials and crypto wallets, moved laterally, and encrypted 1,342 Nacos config items.
- It self-corrected from a failed login to a working fix in 31 seconds, faster than any human responder can page in.
What Sysdig found
The operation started by exploiting an internet-exposed, unpatched Langflow server via CVE-2025-3248. Once inside, the agent didn’t wait for operator instructions between stages. It performed reconnaissance, harvested whatever credentials it could find, AI service keys, cloud credentials, crypto wallets, then used those to move laterally and reach the databases it ultimately encrypted: 1,342 Nacos configuration items held for extortion.
Credential harvesting is a critical transition: an initial foothold may expose credentials for additional systems. Review readable configuration files and credentials, their scope and their lifetime rather than assuming the first compromised server defines the full blast radius.
31 seconds to self-correct
The number worth internalising isn’t the 1,342 encrypted items, it’s the 31 seconds. When a login failed, the agent diagnosed the problem and produced a working fix in half a minute, with no human in the loop. That collapses the defender’s response window from hours to seconds and removes the friction that used to slow attackers between stages.
Human attackers get tired, distracted, and stuck. An agent gets a stack trace and tries again.
Anatomy of the path
langflow-rce # CVE-2025-3248, unpatched, exposed → llm-agent # autonomous recon + planning → harvested-creds # AI keys, cloud creds, wallets → lateral-movement # reuse creds to reach databases → nacos-encrypt # 1,342 config items held to ransom
| Stage | Mechanism | What made it reachable | Severity |
|---|---|---|---|
| Entry | Langflow CVE | Exposed, unpatched service | High |
| Pivot | Credential harvest | Long-lived secrets on the host | Critical |
| Impact | Lateral + encrypt | Harvested creds reached prod data | Critical |
Why it’s a non-human-identity story
The exploited CVE got the headline, but the CVE only bought the first step. Everything after, the part that turned an exposed server into an extortion event, ran on harvested credentials. Those are non-human identities: keys and tokens with standing reach into cloud and data, sitting where the first foothold could grab them.
Revoking an exposed credential can interrupt the observed pivot. It does not neutralise the original RCE or every alternative route. Patch the entry point, contain the host and review other reachable credentials alongside access-path remediation.
What the harvested credentials actually reached
The CVE is the part that gets patched and the 1,342 encrypted config items are the part that gets reported. The part a security team has to answer is neither: it is how far each harvested credential could travel from that one Langflow host. A server running an LLM workflow is rarely a dead end, because the workflow needed credentials to call models, read configuration and reach data in the first place.
The three credential classes Sysdig describes on the compromised host have very different reach, and that difference decides the rotation order:
| Credential on the host | What it typically reaches | Rotation priority |
|---|---|---|
| Cloud credentials | Whatever role the host could assume, which is how harvested keys turned into lateral movement and reached the databases | Critical |
| AI API keys | Model providers billed to the victim, plus any agent or workflow that shares the same key elsewhere | High |
| Crypto wallets | Funds only, with no onward path into systems, but the loss is immediate and irreversible | High |
Rotation order after an incident like this is not alphabetical and not by how alarming the credential sounds. Start with anything that can assume a role or reach data, because that is the step that turned an exposed server into an extortion event. AI keys come next: they rarely reach data directly, but a shared key means the same credential is live in other agents that were never part of this incident. Wallets are urgent for the business and irrelevant to containment, so they belong to a different owner and should not hold up the identity work.
The same question is worth answering before an incident rather than during one. If every credential readable on one agent host were copied tonight, which systems would an attacker be inside by morning? That reach is measurable today, and it is what decides whether a single attack path ends at the host or at production data.
What good looks like
- Assume entry. Design so that a single foothold doesn’t hand an agent a working credential to the next system.
- Kill long-lived secrets on hosts. Short-lived, scoped credentials break the harvest-and-pivot pattern this depends on.
- Map credential reachability. Know, before the incident, which harvested key reaches production data.
- Watch machine identities for anomalies at machine speed, because the attacker moves in seconds now.
On Elmoz
#FAQ
What is JADEPUFFER?
JADEPUFFER is Sysdig's name for an LLM-driven extortion operation described on 1 July 2026. Sysdig assesses it as agentic ransomware. Entry was an unpatched Langflow server, CVE-2025-3248.
What did the JADEPUFFER agent steal and encrypt?
It harvested AI API keys, cloud credentials and crypto wallets, moved laterally and encrypted 1,342 Nacos configuration items for extortion.
Why do the 31 seconds matter?
When a login failed, the agent diagnosed the problem and produced a working fix in 31 seconds with no human in the loop. That shrinks the defender's response window from hours to seconds.
Agentic attackers make the blast radius of every leaked credential immediate. The only durable defense is knowing that radius first. Elmoz computes it.