Investigators claim to have detected AI Agent ransomware.

Researchers claim to have detected the first AI Agent ransomware with the name "JadePuffer."

According to a report by the Infosecurity Magazine website, a research team from cloud technology expert Sysdig has detected a ransomware with full use of AI power, large language model, or LLM (Large Language Model), named "JadePuffer." This ransomware-related campaign will implement the CVE-2025-3248 security vulnerability, a vulnerability that opens up a code Injection attack into the / api / v1 / validate / code section of Langflow, a tool for building AI applications, which after ransomware can penetrate that section. Yes, the malware will automatically perform tasks that lead to the takeover and destruction of all the databases on the victim's server. The research team revealed that the malware's insidious automation is that if the penetration fails, it will automatically rework with more developed parameters through failure learning, which can be achieved very quickly in seconds.

The attack phase of such malware will follow this.

Hack into the system using the Langflow tool vulnerability.

Reconnaissance and stealing various passwords

Stealing on-board data (Local), which covers Langflow's Postgres database.

Extend malware distribution to connected systems.

Enumeration the Object-Store MinIO and steal the stored passwords.

Create Cron Job on the Langflow system to guarantee malware longevity (Persisrtence).

Use the maximum permissions (Root) login code to enter the MySQL database server running on Alibaba Nacos' service.

Relying on various vulnerabilities to reach Nacos by including the implementation of the CVE-2021-29441 vulnerability.

On the file lock side, the malware created a random AES key in the base64 format (uuid4 () .bytes + uid4 () .bytes), which was printed to the stdout but was not saved or forwarded, making it impossible for the victim to decrypt it, even paying money could not be recovered because the hacker did not have such a decryption key in hand. It can be called the most insidious feature of this malware.

# Trending # lemon 8 diary # ai # Agent # freedomhack