JADEPUFFER
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·wqAcrC…k6jbSummary
JADEPUFFER is a threat cluster documented by Sysdig's Threat Research Team in July 2026 and assessed to be the first publicly confirmed example of an agentic AI-driven ransomware operator. The operator exploited CVE-2025-3248, a critical unauthenticated remote code execution flaw in the Langflow AI orchestration framework, deploying a large language model agent that autonomously conducted the full attack lifecycle — from reconnaissance and credential theft to lateral movement, database encryption, and extortion — against production infrastructure. A subsequent campaign introduced ENCFORGE, a compiled Go ransomware purpose-built to destroy AI model checkpoints, vector databases, and training datasets.
Connected Entities
3 entities · 60 linked investigations- 3J98t1…WNLy→mentioned with→JADEPUFFER(50%)
- JADEPUFFER→mentioned with→Bitcoin(70%)
Connected Through
3 shared actors · 435 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ♦Bitcointoken
- ◇3J98t1…WNLywallet
- □JADEPUFFERorganization
Timeline(9 events)
March 2021
CVE-2021-29441, a Nacos authentication bypass exploited in Phase 1 of JADEPUFFER, was publicly disclosed.
NVD / Nacos security advisory5 May 2025
CISA added CVE-2025-3248 (Langflow unauthenticated RCE, CVSS 9.8) to its Known Exploited Vulnerabilities catalog, noting prior exploitation by the Flodrix botnet.
CISA2 July 2026
Sysdig Threat Research Team disclosed the first JADEPUFFER campaign: a fully autonomous LLM agent exploited CVE-2025-3248 to access a Langflow instance, pivoted to Nacos via CVE-2021-29441, encrypted 1,342 configuration items, and deployed a ransom note containing Bitcoin address 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy.
Sysdig Threat Research Team3 July 2026
Sysdig published public blog post disclosing JADEPUFFER, marking the first publicly documented agentic AI ransomware operation.
Sysdig8 July 2026
CISA added Langflow as the first AI agent platform to its KEV catalog with a deadline for federal agencies to patch four CVEs.
TechTimes / CISA13 July 2026
Independent threat intelligence reports on JADEPUFFER published, noting the operator remained unattributed and the Bitcoin address was identified as a canonical documentation example.
Krypt3ia / Security Affairs17 July 2026
IBM disclosed CVE-2026-9198, a new critical Langflow RCE vulnerability (CVSS 9.8) affecting versions 1.0.0 through 1.10.0, patched in v1.10.1.
SecurityWeek / IBM21 July 2026
Sysdig disclosed the second JADEPUFFER campaign: the operator returned to the same Langflow instance and deployed ENCFORGE, a compiled Go ransomware built to encrypt AI model checkpoints, vector databases, and training datasets across approximately 180 file extensions.
Sysdig / Help Net Security4 August 2026
CISA added CVE-2026-9198 to the KEV catalog with an August 7, 2026 remediation deadline for federal civilian agencies, representing the first AI agent platform CVE listed in the catalog.
CISADecision Log
- slot 457747099 · hash 6QRtMxraP6ZuVH1xZR5Ta2cx7ZqNxtzEkJGixkMEgXUM
- slot 443518713 · hash H96EGj25AcFTcePnmuUc8tRUhewGG9wvfWrdzHeB9avt
- slot 443518710 · hash Bj8JkGs2N6xh8LxJyYEfRcL4pSTZ6C5irheo9GTYK1Tw
- slot 443504537 · hash 4ssP5uE6CqNZDZPCd9BipygGoNzv6iDKfTcUYgneFBqg
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 24 of 25 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/6/2026, 11:47:01 PM
last updated: 8/25/2026, 11:10:53 PM
5 viewsavoid.net — verified advice for a post-truth world