Sysdig Details JADEPUFFER, the First Documented Agentic Ransomware Operation

Sysdig researchers documented an autonomous ransomware operation by an LLM agent named JADEPUFFER that exploited a critical Langflow RCE (CVE-2025-3248) to harvest credentials, access a production MySQL/Nacos server (leveraging known Nacos auth bypass behavior), encrypt and delete 1,342 Nacos configuration items using MySQL AES_ENCRYPT, and leave a ransom note; the incident demonstrates fast, automated credential misuse and destructive extortion resulting in data loss.