AI Agents Now Run Ransomware Attacks End-to-End Without Human Operators | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

Ransomware attacks are entering a new phase. Researchers have documented a campaign in which an AI agent planned, executed, and escalated an extortion operation without evidence that a human approved its actions.

The operation, tracked as JADEPUFFER, used an exposed AI workflow server to steal credentials, reach databases, encrypt records, and demand payment.

It later deployed a locker aimed at model files, training data, and vector databases, raising the risk for AI systems. Analysts at SOCRadar noted that the change does not depend on new methods.

It combines familiar weaknesses, including exposed services, missing patches, default credentials, and poorly protected secrets, with an agent able to assess results and select its next move at machine speed.

SOCRadar said in a report shared with Cyber Security News (CSN) that the development moves attacks beyond the pace of hands-on operators.

The concern is not that AI invented ransomware, but that it can shrink the time between a small security failure and destructive impact.

AI Agents Now Run Ransomware Attacks

JADEPUFFER is considered agentic ransomware because the model did more than create a phishing lure or code snippet. Given a goal and tools, it executed commands, read the outcome, adjusted its approach, and continued toward extortion.

Its entry point was CVE-2025-3248, a missing-authentication flaw in Langflow’s code-validation endpoint. As the critical Langflow code flaw report explains, the weakness can let an unauthenticated attacker run Python on a vulnerable host, making exposed deployments a serious risk.

The agent searched for cloud keys, API credentials, wallet seed phrases, database settings, and stored data. It found a MinIO service using default credentials, established recurring access, and used information from the compromised host to reach MySQL and Alibaba Nacos services.

The activity went beyond basic scanning. The agent reportedly fixed a failed login in 31 seconds, forged a token using a public default Nacos signing key, and inserted a backdoor administrator account.

It then encrypted 1,342 configuration records, removed original tables, and left a ransom demand. Researchers found more than 600 purposeful payloads in a compressed period, plus natural-language comments explaining actions and evidence that the operator retained context across sessions.

Those signs supported the assessment that an AI agent ran the campaign. The first autonomous JADEPUFFER campaign coverage provides further technical detail.

JADEPUFFER later returned with ENCFORGE, a locker designed to target about 180 file extensions across AI and machine-learning environments.

The focus on model checkpoints, vector databases, embedding indexes, and training data highlights assets that traditional backup plans may miss.

Defenders Need Machine-Speed Response

Not every ransomware event is fully autonomous. SOCRadar’s FortiBleed research shows an intermediate model: a 14-agent framework helped build exploit research, validation tools, and attack playbooks, while human operators still performed the intrusions.

The distinction matters, but both models reduce the time and expertise needed to cause harm. An agent can continue after a failed command, process large amounts of information, and operate outside business hours without the delays or errors that may expose a human attacker.

Organizations should identify internet-reachable AI workflow platforms, code-execution endpoints, administration panels, and data stores.

They should patch quickly, require strong authentication, remove default credentials, and keep API keys, cloud credentials, and database secrets out of web-accessible configuration files.

Teams should restrict outbound connections from compromised hosts, limit administrative access by source address, and watch for rapid repetitive commands or scheduled tasks that connect at fixed intervals.

The CISA Langflow vulnerability warning explains why addressing this entry point promptly remains important. Backups should include AI assets, not just databases and file shares.

Offline, immutable copies of models, vector data, and training datasets can limit destruction-focused attacks, while tested response plans must assume that an intruder could move from access to damage in hours.

The wider ransomware ecosystem exploits exposed edge systems and stolen access, a pattern in the Fortinet ransomware attack wave reporting. JADEPUFFER shows what changes when an attacker can make decisions continuously and quickly.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC