AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-29441 | Nacos: When configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce… | 9.8 | 83% | PoC ×2 | |
| CVE-2025-3248 | Unauthenticated RCE in Langflow /api/v1/validate/code | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 45.131.66.106 | unauthenticated remote code execution) Command-and-control: 45.131.66[.]106, with a beacon to hxxp://45.131.66[.]106:4444/beacon ever |
| ipv4 | 64.20.53.230 | [.]106:4444/beacon every 30 minutes Claimed staging server: 64.20.53[.]230 Ransom Bitcoin address: 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNL |
| url | http://45.131.66.106:4444/beacon | ion) Command-and-control: 45.131.66[.]106, with a beacon to hxxp://45.131.66[.]106:4444/beacon every 30 minutes Claimed staging server: 64.20.53[.]230 R |
From the original article
5 min read at thehackernews.com
Security firm Sysdig says it has found what it believes is the first ransomware attack run from start to finish by an AI agent. Its Threat Research Team calls the operator JADEPUFFER and says a large language model handled the whole job: breaking in, stealing credentials, moving deeper into the network, then encrypting and wiping a company's production database.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.