Agentic Ransomware JadePuffer Automates Full Intrusions Through Exposed Langflow Servers
This advisory updates VTA-2026-000418 of 2026-09-30, which covered how AI is reshaping vulnerability discovery and exploitation at scale. The picture has moved on in two concrete ways. First, there is now a named, CVE-anchored campaign to point at rather than a trend line: JadePuffer, a ransomware operation disclosed in July 2026 in which an LLM-driven agent automated most of the intrusion chain end to end. Second, the entry point is a specific, already-known flaw — CVE-2025-3248, a missing-authentication vulnerability in Langflow, the open-source framework used to build LLM applications and agent workflows. Any organisation running an internet-facing Langflow instance that has not been remediated since this flaw was published should treat itself as in scope, as should teams that stood up Langflow informally for AI prototyping outside normal asset inventory.
The JadePuffer chain starts with exploitation of CVE-2025-3248 against exposed Langflow servers, which require no authentication to reach the vulnerable function. Once inside, the agent looted the instances for cloud credentials, API keys and other stored secrets — the kind of material that Langflow deployments routinely hold because they broker calls to cloud services and model providers. Those harvested credentials were then used for lateral movement and privilege escalation into connected cloud environments, ending in destructive encryption of databases for extortion. What distinguishes this from a conventional smash-and-grab is that the sequencing, validation and execution of those steps were largely driven by the model rather than by an operator at a keyboard. The same pattern was visible in the earlier GTG-1002 cyber-espionage campaign of September 2025, where Claude Code was abused to support reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis and exfiltration. Researchers also report attackers switching between models by task — one for reconnaissance, one for code generation, one for social engineering content — and favouring Chinese models such as GLM and Kimi 3, or locally hosted models, for their weaker content restrictions and better operational security. Attribution of a given attack to a given model remains largely speculative, and experts caution it is a side issue next to the intrusion itself.
The strategic shift is in tempo, not technique. Attackers are still identifying targets, performing reconnaissance, establishing a foothold, moving laterally, achieving their objective and covering their tracks; what has changed is the volume and velocity at which that happens. The dwell time that used to run to weeks or months was the window in which detection usually occurred, and AI-assisted intrusions are visibly compressing it — agents do not pause to think, sleep or hand off between specialists. A single operator with the right prompt and model can now cover the combined ground of a database administrator, a developer, a DevOps specialist, a cloud architect and a hacker, a capability profile one vendor has labelled agentic APT and which is no longer the preserve of nation-state teams. The sharpest edge AI currently gives attackers is in finding exploitable flaws in open-source code faster than defenders can close them, which puts every organisation carrying years of technical debt on the wrong side of the clock. On current exploitation status, the evidence is unambiguous: CVE-2025-3248 is confirmed exploited in the wild and was added to the CISA Known Exploited Vulnerabilities catalog on 2025-05-05, it has known use in ransomware campaigns, and FIRST EPSS places the probability of exploitation in the next 30 days at 100.0%. JadePuffer is the demonstration that a year-old unpatched flaw in AI tooling is itself now prime real estate for AI-driven attacks.
Attack Surface
Web Application, Cloud Service, Database, Infrastructure
Tactics
Reconnaissance, Resource Development, Initial Access, Credential Access, Privilege Escalation, Lateral Movement, Exfiltration, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1552.001 – Unsecured Credentials: Credentials In Files
- T1588.007 – Obtain Capabilities: Artificial Intelligence
- T1078.004 – Valid Accounts: Cloud Accounts
- T1486 – Data Encrypted for Impact
- T1041 – Exfiltration Over C2 Channel
- T1595 – Active Scanning
SuperPRO's Threat Countermeasures Procedures
- Inventory every Langflow deployment, including unmanaged ones stood up for AI prototyping, and remediate CVE-2025-3248 on all of them — this missing-authentication flaw is the JadePuffer initial access vector and is listed in CISA KEV (added 2025-05-05) with confirmed ransomware use.
- Remove Langflow web interfaces from direct internet exposure and place them behind a VPN, authenticated reverse proxy or source-IP allow list, since unauthenticated internet-facing instances were the population looted in this campaign.
- Treat any Langflow host that was internet-facing while unpatched as compromised and rotate every secret it could reach: cloud provider access keys, model-provider API keys, database credentials and service account tokens stored in or referenced by flows.
- Alert on cloud credentials first seen in use from an IP or region that differs from the Langflow host, as JadePuffer pivoted from harvested keys straight into lateral movement and privilege escalation within the connected cloud estate.
- Add detection for compressed intrusion tempo rather than long dwell time — correlate rules that fire when external exploitation, credential access and lateral movement from the same host occur within hours, since agent-driven chains no longer leave the weeks of dwell time detection historically relied on.
- Monitor and, where business need does not exist, block outbound traffic from server and CI/CD workloads to third-party LLM API endpoints including GLM and Kimi 3, which researchers report attackers favour for their weaker content restrictions.
- Enforce offline or immutable backups for the databases reachable from AI tooling hosts and test restoration, as the JadePuffer objective was destructive database encryption for extortion.
