Researchers Claim First Fully Agentic Ransomware: JadePuffer

Sysdig reports the discovery of "JadePuffer," an LLM-driven ransomware campaign that exploited CVE-2025-3248 against a Langflow instance to harvest credentials, move laterally to an Alibaba Nacos MySQL server (also exploiting CVE-2021-29441), create persistence, and encrypt and delete 1,342 Nacos configuration items using an ephemeral AES key—making recovery impossible; the attack was autonomous, adaptive, and highlights automation of old vulnerabilities and new detection opportunities.