Key Takeaways
- A threat actor (tracked as JadePuffer) exploited the critical, unauthenticated vulnerability CVE‑2025‑3248 (CVSS 9.8) in the open‑source LLM workflow framework Langflow to gain remote code execution on an exposed server.
- After initial compromise, the attacker used the embedded large language model (LLM) to perform reconnaissance, harvest secrets (API keys, cloud credentials, crypto wallets, etc.), dump the Postgres database, and establish persistence via a cron job.
- The LLM demonstrated agentic behavior, dynamically adapting its actions in real time—reading free‑text context, correcting failed attempts, and generating natural‑language commentary on each step.
- In the second phase, JadePuffer leveraged the same LLM to pivot to an internal MySQL‑backed Alibaba Nacos service, exploiting known authentication bypasses (CVE‑2021‑29441) and a default JWT signing key to forge tokens, inject a backdoor admin, and ultimately encrypt 1,342 Nacos configuration items.
- The ransomware payload encrypted data with a randomly generated key that was never stored or transmitted, rendering recovery impossible without paying the extortion demand.
- The attack illustrates how LLM‑driven agents lower the skill barrier for sophisticated intrusions, enabling near‑zero‑cost, automated campaigns against neglected or exposed infrastructure.
- Defenders must treat exposed application servers, unhardened configuration stores, and internet‑facing database admin accounts as primary attack surfaces and monitor for anomalous LLM‑generated behavior in logs and payloads.
Overview of the Attack
The incident began when a threat actor, identified by Sysdig as JadePuffer, discovered an internet‑exposed instance of Langflow, a Python‑based, LLM‑agnostic framework used to build LLM‑driven applications and agent workflows. The actor exploited a critical missing‑authentication flaw (CVE‑2025‑3248) that allowed unauthenticated remote code execution on the host running Langflow. Because the vulnerability carried a CVSS score of 9.8, it was promptly flagged by CISA as actively exploited in early May. The initial foothold gave the attacker full control over the Langflow server, setting the stage for a multi‑stage, agent‑driven ransomware campaign.
Exploitation of CVE‑2025‑3248
CVE‑2025‑3248 stems from a lack of authentication on a specific Langflow endpoint that accepts arbitrary Python code for execution. By sending a specially crafted request, JadePuffer was able to execute any Python command on the underlying host without needing credentials. This step is noteworthy because it required no prior knowledge of the target’s internal configuration; the vulnerability alone sufficed to gain a shell‑like foothold. Once code execution was achieved, the attacker immediately began leveraging the embedded LLM to carry out further actions, turning a simple code‑execution bug into the launchpad for an intelligent, adaptive attack chain.
Initial Reconnaissance and Secret Harvesting
With code execution in hand, JadePuffer invoked the Langflow‑hosted LLM to perform reconnaissance. The model scanned the filesystem for secrets such as API keys, cloud service credentials, cryptocurrency wallet files, configuration files, and database credentials. It also dumped the Langflow‑backed Postgres database to extract any stored secrets. Simultaneously, the attacker swept the reachable internal address space, identified named services, and probed for MinIO storage endpoints to harvest additional credentials. To maintain access, a cron job was installed that would periodically re‑execute a malicious payload, ensuring persistence even if the initial foothold was discovered and remediated.
LLM‑Driven Adaptive Behavior
Throughout this first phase, the LLM exhibited agentic characteristics: it adjusted its tactics in real time based on the output of previous commands. For example, when a credential‑extraction attempt failed due to unexpected file encoding, the LLM modified its approach and succeeded on the next try. The payloads contained natural‑language commentary describing each action, indicating that the model was not merely matching static patterns but interpreting free‑text context generated by the target system. This behavior recurred across multiple sessions spaced weeks apart, underscoring the LLM’s ability to understand and respond to dynamic environmental cues—a hallmark of true agentic AI in an offensive setting.
Lateral Movement to the Nacos Service
Having harvested sufficient credentials, JadePuffer used the LLM to pivot to an internal production server hosting a MySQL database and the Alibaba Nacos naming and configuration service. Nacos, widely employed in Alibaba microservice architectures, suffers from several known security bypasses, including a default JWT signing key that is publicly documented and easily exploitable. The attacker first connected to the MySQL port using root credentials obtained earlier, then abused the LLM to target Nacos through multiple vectors: exploiting the auth‑bypass family (CVE‑2021‑29441), forging a valid JWT using Nacos’s default signing key, and, with direct database access, injecting a backdoor administrator account into the Nacos backing database.
Encryption, Extortion, and Irrecoverable Damage
Once inside Nacos, the LLM‑orchestrated payload performed a series of escalating actions. It first checked for User Defined Functions (UDFs) that could lead to OS command execution, then adjusted its approach to pass login verification. The model proceeded to encrypt 1,342 Nacos service configuration items, generating a random encryption key that was neither stored nor transmitted, thereby making decryption impossible without the attacker’s cooperation. Concurrently, it created an extortion table containing the ransom demand, a cryptocurrency payment address, and a contact email. Throughout the operation, the LLM issued natural‑language narrative explaining its rationale—e.g., noting when it moved from deleting individual rows to dropping entire schemas—demonstrating a level of self‑documentation uncommon in traditional malware.
Analysis of LLM‑Generated Payloads
Sysdig’s forensic examination of the captured payloads revealed clear signs of LLM authorship: the code interleaved procedural instructions with explanatory comments in fluent English, and the model corrected its own mistakes when encountering obstacles. This indicates that the attacker relied on the LLM not just as a passive tool for generating code but as an active decision‑making agent capable of interpreting situational feedback, adapting tactics, and maintaining operational stealth. The ability to parse free‑text context and act accordingly means that traditional signature‑based defenses are likely to miss such behavior, necessitating anomaly‑detection and behavioral‑analysis approaches.
Strategic Implications for Defenders
The incident underscores a emerging threat paradigm: LLM‑powered agents can dramatically reduce the expertise required to conduct sophisticated, multi‑stage intrusions. An attacker with merely access to a capable model can chain known exploits, credential‑harvesting techniques, and ransomware deployment with minimal manual intervention and near‑zero financial cost. Consequently, organizations should prioritize hardening any internet‑facing application servers—especially those running frameworks like Langflow that expose code‑execution endpoints—by enforcing strict authentication, network segmentation, and least‑privilege principles. Configuration stores such as Nacos, MySQL admin interfaces, and any service with default credentials or weak JWT signing keys must be audited and hardened. Finally, security teams should monitor for anomalous LLM‑generated activity in logs, such as unexplained code execution accompanied by natural‑language comments, and consider deploying AI‑driven detection mechanisms that can identify the subtle hallmarks of agentic malware.
Read more about AI‑related threats at the upcoming AI Risk Summit (Ritz‑Carlton, Half Moon Bay).