JADEPUFFER: the first ransomware that writes its own case notes

Last week, Sysdig’s threat research team published what they’re calling the first documented case of agentic ransomware - an operation they’ve named JADEPUFFER (would love to know how these names come to exist), run end-to-end by an LLM. According to Sysdig, initial access was obtained by the agent via a known Langflow RCE (CVE-2025-3248) on an internet-exposed instance. Langflow also just so happens to be an open-source framework for building LLM-driven applications and agent workflows (lol). Afterwards, the agent swept the host for credentials and API keys, followed by lateral movement to a production server running MySQL and Alibaba Nacos (forging tokens with Nacos’s default JWT signing key). This eventually lead to the encryption of service configuration entries within MySQL and a ransom note written into an extortion table. In this example, the AES encryption key the agent generated at runtime never persisted or transmitted anywhere, so even if a victim paid, recovery was never on the table.

For the most part, the headlines I’ve seen on this have split into two camps. Fortune ran with “the first known agentic ransomware has arrived”, while TechCrunch countered that the “first” AI-run ransomware attack still needed a human. Both are technically correct, but whether we call it “fully autonomous” or “autonomous with a human setting it up first” is a marketing debate. What the agent actually did once it was let loose is the part worth an analyst’s attention.

Two details from Sysdig’s report stuck with me:

• After a failed attempt to create an admin account on the Nacos server, the agent diagnosed the failure, regenerated its payload, and succeeded 31 seconds later. It threw over 600(!!) distinct, purposeful payloads over the course of the operation.
• The payloads were self-narrating. The code shipped with natural-language reasoning, target prioritization, and the kind of detailed annotations no human operator writes mid-attack. This is almost like being able to sit next to the attacker as the attack is happening and listen to them mumble their strategy.

The first detail is the one that could change how we think about containment. A lot of IR muscle memory assumes the attacker operates at human speed - they fumble a payload and come back tomorrow, they work under specific timezones, they sleep. A 31-second iteration loop of diagnosing, fixing, and retrying eliminates that assumption. If a containment playbook has a human approval step in it, the agent has likely already iterated a dozen times before the ticket gets picked up.

The second detail is almost a gift. For once, the malware tells you what it was trying to do, reading less like shellcode and more like an intern’s case notes. That narration seemingly exists because nobody bothered to strip it though, not because the agent owes us honesty. In the end it’s just attacker-authored data like everything else, and it seems obvious the next move is prompting the agent to narrate misleadingly or clean up after itself.

What is likely worth remembering from Sysdig’s writeup is how boring the techniques the agent used were. There is nothing original about an exposed service, a year-old CVE, or even a default signing key. But stringing them together into a complete extortion methodology used to require a person who knew what they were doing, and now it requires an agent and a target list. Last month I wrote about agentjacking, where the agent is the “victim” being fed poisoned input. JADEPUFFER is this same technology pointed the other direction, with the agent as the threat actor. We now have documented cases on both sides, a tool that either gets exploited or does the exploiting, and it’s literally only been a month. Hard to say for sure how much this new generation of frontier agentic models, such as Anthropic’s Mythos/Fable (or even their open-source counterparts), has played into the sudden viability of these attacks, but the timing is interesting.

The skill floor for running ransomware just dropped to whatever it costs to run an agent. If copycats start appearing, I’m not certain the IR industry is ready for what that means.

ZB