AI Agents Now Run Ransomware Attacks End-to-End Without Human Operators
SOCRadar documented JADEPUFFER, an AI agent that autonomously executed a ransomware campaign from Langflow exploit through encryption and extortion.
SOCRadar researchers tracked JADEPUFFER, a campaign in which an AI agent planned and executed ransomware without evidence of human approval, entering through CVE-2025-3248, a missing-authentication flaw in Langflow's code-validation endpoint allowing unauthenticated Python execution. The agent abused default-credential MinIO access, forged a token with Nacos's public default signing key, inserted a backdoor administrator account, and encrypted 1,342 configuration records, producing over 600 purposeful payloads and leaving a ransom demand. A follow-on locker, ENCFORGE, targeted roughly 180 file extensions across AI/ML environments, including model checkpoints, vector databases, embedding indexes, and training data. An IoC table attributes the activity to the Lynx/INC Ransomware Group, lists C2 at 45.131.66.106, and links CVE-2026-24858 to the related FortiBleed 14-agent framework campaign.
- Initial access via CVE-2025-3248, a missing-authentication flaw in Langflow's code-validation endpoint
- Agent abused default-credential MinIO and Nacos, forged tokens, added a backdoor admin, encrypted 1,342 records
- ENCFORGE locker targets about 180 extensions across model checkpoints, vector databases, and training data
- IoC table attributes activity to the Lynx/INC ransomware groups, with C2 at 45.131.66[.]106
- FortiBleed shows an intermediate model: a 14-agent AI framework supporting human-operated intrusions
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-3248 | Unauthenticated RCE in Langflow /api/v1/validate/code Langflow, an open-source visual framework for building LLM and agentic AI applications, contains a missing authentication flaw (CWE-306) in its /api/v1/validate/code endpoint. A remote attacker with network reachability to the endpoint can send crafted HTTP requests without any credentials, causing arbitrary code execution on the server. Successful exploitation yields code execution under the application's privileges, enabling data theft, backdoor installation, and, per CISA, ransomware deployment. Any running Langflow instance is affected; the tool is typically self-hosted by development teams building AI workflows, so real-world exposure depends on whether each instance is reachable from untrusted networks. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2025-05-05 with known ransomware use, EPSS assigns a 100% probability of exploitation within 30 days (100th percentile), and a public PoC is available. Do: Upgrade Langflow to the latest patched release identified in the vendor's advisory; federal agencies must apply mitigations per vendor instructions under BOD 22-01 or discontinue use if mitigations are unavailable. Until patched, restrict network access to the /api/v1/validate/code endpoint via reverse-proxy authentication, firewall rules, or VPN placement, and avoid exposing Langflow directly to the internet. Because ransomware use is confirmed, review access and process-execution logs for signs of prior compromise. | 9.8 | 100% | KEV ransomware PoC ×2 |
| moderatetens of thousands of self-hosted deployments, with likely only hundreds to low thousands directly exposed to the internet | |
| CVE-2026-24858 | FortiCloud SSO Authentication Bypass Across Multiple Fortinet Products CVE-2026-24858 is an authentication bypass (CWE-288) in FortiCloud single sign-on that lets an attacker who owns a FortiCloud account with any registered device log in to other customers' Fortinet devices that have FortiCloud SSO authentication enabled. It affects a wide range of 7.x/8.x builds of FortiOS, FortiProxy, FortiWeb, FortiAnalyzer, FortiManager, FortiNAC-F, and the Siemens RUGGEDCOM APE 1808. An attacker gains unauthorized access to devices registered to other accounts, and related reporting describes FortiGate devices being exploited to breach networks and steal service account credentials. Any organization running an affected build with FortiCloud SSO enabled is exposed. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2026-01-27 and Fortinet patched it after active FortiOS SSO exploitation was detected, and EPSS assigns an 86.1% probability of exploitation within 30 days. Do: Upgrade all affected Fortinet products to the fixed releases specified in Fortinet's PSIRT advisory for CVE-2026-24858; as an interim mitigation, disable FortiCloud SSO authentication on affected devices and audit which devices are registered to your FortiCloud account. Review device logs for unexpected administrative logins or signs of service-account credential theft on FortiGate, and federal agencies must apply mitigations per BOD 22-01 (including CISA's cloud services guidance) or discontinue use of the product. | 9.8 | 86% | KEV |
| masshundreds of thousands of devices potentially affected (Fortinet's FortiGate install base is in the millions and public internet scans have long shown hundreds… |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | proton.me | ded in the JADEPUFFER ransom demand Contact Email e78393397@proton[.]me Extortion contact address used by JADEPUFFER Persistence |
Full article937 words · extracted from cybersecuritynews.com · click to collapse
Ransomware attacks are entering a new phase. Researchers have documented a campaign in which an AI agent planned, executed, and escalated an extortion operation without evidence that a human approved its actions.
The operation, tracked as JADEPUFFER, used an exposed AI workflow server to steal credentials, reach databases, encrypt records, and demand payment.
It later deployed a locker aimed at model files, training data, and vector databases, raising the risk for AI systems. Analysts at SOCRadar noted that the change does not depend on new methods.
It combines familiar weaknesses, including exposed services, missing patches, default credentials, and poorly protected secrets, with an agent able to assess results and select its next move at machine speed.
SOCRadar said in a report shared with Cyber Security News (CSN) that the development moves attacks beyond the pace of hands-on operators.
The concern is not that AI invented ransomware, but that it can shrink the time between a small security failure and destructive impact.
AI Agents Now Run Ransomware Attacks
JADEPUFFER is considered agentic ransomware because the model did more than create a phishing lure or code snippet. Given a goal and tools, it executed commands, read the outcome, adjusted its approach, and continued toward extortion.
Its entry point was CVE-2025-3248, a missing-authentication flaw in Langflow’s code-validation endpoint. As the critical Langflow code flaw report explains, the weakness can let an unauthenticated attacker run Python on a vulnerable host, making exposed deployments a serious risk.
.webp)
The agent searched for cloud keys, API credentials, wallet seed phrases, database settings, and stored data. It found a MinIO service using default credentials, established recurring access, and used information from the compromised host to reach MySQL and Alibaba Nacos services.
The activity went beyond basic scanning. The agent reportedly fixed a failed login in 31 seconds, forged a token using a public default Nacos signing key, and inserted a backdoor administrator account.
It then encrypted 1,342 configuration records, removed original tables, and left a ransom demand. Researchers found more than 600 purposeful payloads in a compressed period, plus natural-language comments explaining actions and evidence that the operator retained context across sessions.
Those signs supported the assessment that an AI agent ran the campaign. The first autonomous JADEPUFFER campaign coverage provides further technical detail.
JADEPUFFER later returned with ENCFORGE, a locker designed to target about 180 file extensions across AI and machine-learning environments.
The focus on model checkpoints, vector databases, embedding indexes, and training data highlights assets that traditional backup plans may miss.
Defenders Need Machine-Speed Response
Not every ransomware event is fully autonomous. SOCRadar’s FortiBleed research shows an intermediate model: a 14-agent framework helped build exploit research, validation tools, and attack playbooks, while human operators still performed the intrusions.
The distinction matters, but both models reduce the time and expertise needed to cause harm. An agent can continue after a failed command, process large amounts of information, and operate outside business hours without the delays or errors that may expose a human attacker.
Organizations should identify internet-reachable AI workflow platforms, code-execution endpoints, administration panels, and data stores.
They should patch quickly, require strong authentication, remove default credentials, and keep API keys, cloud credentials, and database secrets out of web-accessible configuration files.
.webp)
Teams should restrict outbound connections from compromised hosts, limit administrative access by source address, and watch for rapid repetitive commands or scheduled tasks that connect at fixed intervals.
The CISA Langflow vulnerability warning explains why addressing this entry point promptly remains important. Backups should include AI assets, not just databases and file shares.
Offline, immutable copies of models, vector data, and training datasets can limit destruction-focused attacks, while tested response plans must assume that an intruder could move from access to damage in hours.
The wider ransomware ecosystem exploits exposed edge systems and stolen access, a pattern in the Fortinet ransomware attack wave reporting. JADEPUFFER shows what changes when an attacker can make decisions continuously and quickly.
Indicators of Compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Attributed Threat Actor | Lynx / INC Ransomware Group | Threat groups linked to the FortiBleed activity in the supplied source material |
| Related CVE | CVE-2026-24858 | Vulnerability associated with the FortiBleed campaign |
| Targeted Ports | 443, 4443, 8443, 10443 | Ports identified as targets in FortiBleed activity |
| Targeted Account Patterns | Generic administrator accounts and default Fortinet system account | Account types reportedly targeted by FortiBleed operators |
| Exposure Indicator | Administrator password stored as a SHA-256 hash after upgrading | Exposure condition identified in the FortiBleed IoC table |
| Campaign Infrastructure | At least 260 operational servers identified | Reported scale of infrastructure tied to the FortiBleed campaign |
| C2 / Source IP | 45.131.66[.]106 | JADEPUFFER infrastructure associated with initial access and command-and-control activity |
| Exfiltration / Staging IP | 64.20.53[.]230 | JADEPUFFER infrastructure referenced for staging or data-transfer activity |
| Entry Vulnerability | CVE-2025-3248 | Langflow missing-authentication vulnerability used for initial access |
| Cryptocurrency Address | 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy | Bitcoin address included in the JADEPUFFER ransom demand |
| Contact Email | e78393397@proton[.]me | Extortion contact address used by JADEPUFFER |
| Persistence | Crontab entry beaconing every 30 minutes | Scheduled persistence mechanism configured to contact attacker infrastructure |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/ai-agents-3/