JADEPUFFER: Agentic ransomware for automated database extortion

Sysdig TRT documents JADEPUFFER, an LLM-driven (agentic) ransomware campaign that leveraged Langflow RCE (CVE-2025-3248) to harvest credentials, pivot to an exposed MySQL/Nacos server, deploy persistence, encrypt Nacos configuration data with an unrecoverable key, drop databases, and leave ransom artifacts; the report includes captured payloads, IoCs (45.131.66.106, 64.20.53.230, Bitcoin address, cron beacon), and mitigation guidance (patch Langflow, harden Nacos, runtime DB detection, egress controls).