TLDR Tech / InfoSec
JadePuffer ransomware used AI agent to automate entire attack
JadePuffer, the first known ransomware operation fully automated by an LLM-driven agent exploiting CVE-2025-3248 in Langflow with no human intervention, conducted reconnaissance, stole credentials, performed lateral movement to an internet-exposed MySQL/Nacos server, encrypted 1,342 Nacos configuration items, and demanded Bitcoin payment, leaving the victim unable to recover data despite mitigation attempts.
Read the full story