Home / Technology / First AI-Driven Ransomware 'JADEPUFFER' Emerges
First AI-Driven Ransomware 'JADEPUFFER' Emerges
8 Jul
Summary
- JADEPUFFER is the first AI-driven ransomware, noted by Sysdig researchers.
- The attack exploited a known vulnerability in Langflow and targeted Alibaba Nacos.
- Victims paying the ransom will not recover their data due to lack of backups.
Security researchers have identified JADEPUFFER, believed to be the first ransomware attack autonomously driven by artificial intelligence. The attack exploited a known vulnerability (CVE-2025-3248) in internet-facing Langflow instances, a platform that itself uses AI. JADEPUFFER's automated process involved seeking credentials for various services and harvesting data before encrypting 1,342 Nacos configuration items and dropping database tables.
Despite the sophistication, JADEPUFFER's targets will find no recourse even if they pay the ransom, as the ransomware fails to create data backups or generate recovery keys. This self-contained attack demonstrates a concerning evolution in cybercrime, potentially enabling less skilled actors to launch complex operations.
The discovery by Sysdig researchers highlights a new phase in cybersecurity, where Agentic Threat Actors (ATAs) leverage AI. While alarming, the verbose nature of JADEPUFFER's adaptive responses to obstacles offers a potential advantage for detection, a characteristic not typical of traditional cyber threats. Langflow has since patched the vulnerability in April 2025.
