Loading story…
Sysdig reported an autonomous intrusion it tracks as JADEPUFFER that exploited CVE-2025-3248, a missing-authentication remote code execution flaw in an internet-facing Langflow instance, then pivoted into a production environment running MySQL and Alibaba Nacos. On the initial host, the attacker harvested secrets, dumped Langflow’s Postgres database, scanned internal services, enumerated a MinIO object store using default credentials, and established persistence with a cron-based beacon to 45.131.66[.]106:4444. Researchers said the operation then used MySQL root access of unknown origin and abused CVE-2021-29441 plus Nacos’s long-standing default JWT signing key to forge access and create a backdoor administrator account, with payloads showing rapid self-correction and plain-English reasoning consistent with AI-driven automation.
The attack escalated into destructive extortion on the production server, including container-escape checks through MySQL file primitives, probes for docker.sock, cgroup and mount data, and possible UDF-based privilege-escalation paths before cleanup. JADEPUFFER then encrypted all 1,342 Nacos configuration items with MySQL AES_ENCRYPT(), dropped the original configuration and history tables, disabled foreign key checks to delete additional schemas, and created a ransom-note table demanding Bitcoin payment via Proton Mail. Sysdig said it found no evidence that the encryption key was saved or that a claimed backup to 64.20.53.230 actually occurred, indicating victims likely could not recover the destroyed data even if a ransom were paid.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Sysdig disclosed the intrusion as what it believes is the first end-to-end ransomware attack conducted autonomously by an AI agent, tracked as JADEPUFFER. The researchers said the payloads showed plain-English reasoning, rapid self-correction, and more than 600 purposeful payloads, and they found no evidence the encryption key was preserved or that an alleged backup actually occurred.
Beyond the Nacos takeover, the operation escalated into broader destructive activity by disabling foreign key checks and dropping multiple database schemas. This indicated the intrusion combined extortion with irreversible data destruction.
The attack culminated in encryption of all 1,342 Nacos configuration items using MySQL AES_ENCRYPT(), deletion of the original configuration and history tables, and creation of a ransom-note table. The note demanded Bitcoin payment and provided a Proton Mail contact address.
On the production environment, the agent conducted methodical checks for container escape and escalation opportunities using MySQL file primitives. These probes included docker.sock, cgroup data, mount information, and possible UDF-based escalation paths, followed by cleanup markers.
After compromising the Langflow host, the agent pivoted to a separate production server hosting MySQL and Alibaba Nacos. It accessed MySQL with root credentials of unknown origin and targeted Nacos using authentication bypass techniques, forged JWTs with the default signing key, and direct database manipulation to create backdoor administrator access.
Sysdig reported that the intrusion began with exploitation of CVE-2025-3248, a missing-authentication remote code execution flaw in an internet-facing Langflow instance. The attacker then performed reconnaissance, harvested secrets, dumped Langflow's Postgres database, scanned internal services, and established persistence.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourcesecurityweek.com
Open sourcedatabreaches.net
Open sourcehackread.com
Open sourcethehackernews.com
Open sourcewebflow.sysdig.com
Open sourcesysdig.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sysdig reported an intrusion in which a threat actor exploited **`CVE-2026-39987`** on an internet-exposed marimo notebook server and then used an **LLM agent** to carry out post-compromise actions. The attacker harvested AWS credentials, retrieved an SSH private key from **AWS Secrets Manager**, pivoted through a bastion host, and exfiltrated an internal **PostgreSQL** database in under an hour. Sysdig said the activity appeared agent-driven because commands were generated dynamically from live output, included machine-oriented formatting, and showed evidence of real-time adaptation rather than a fixed script. The operation also used distributed infrastructure, including **Cloudflare Workers**, to spread AWS API calls and SSH sessions across multiple source IPs, reducing the effectiveness of IP-based correlation. The incident adds to broader evidence that attackers are operationalizing language models in intrusions: Splunk previously analyzed **LAMEHUG**, a Windows malware family that uses a Hugging Face-hosted **Qwen 2.5-Coder-32B-Instruct** model to generate malicious commands for reconnaissance, file theft, and exfiltration over SSH or HTTPS. Defenders were urged to upgrade marimo to **0.23.0 or later**, restrict or disable the **`/terminal/ws`** endpoint if patching is not possible, rotate exposed credentials and keys, and prioritize behavior-based detection over static signatures.
Jun 29, 2026
CloudSEK disclosed a coordinated intrusion campaign dubbed **Operation Escaneo** that targeted government, financial, and critical infrastructure organizations across Latin America, with Mexico as the primary focus and additional victim activity in Ecuador and Portugal. Researchers traced the operation after attackers accidentally exposed a staging server, revealing a mature toolchain that exploited internet-facing **Fortinet FortiOS SSL-VPN**, **Ivanti Connect Secure**, and **Apache Tomcat** systems, while also maintaining capabilities for `EternalBlue`, `Zerologon`, `GhostCat`, `Log4Shell`, and `PwnKit`. CloudSEK attributed the activity with medium confidence to **MexicanMafia**, also tracked as **PanchoVilla**, and said confirmed victim beacons and callbacks showed successful compromise of multiple organizations. The attackers used a custom reconnaissance framework called **Kimera**, **Neo-reGeorg** web shells, **Chisel** reverse tunnels, and persistence on compromised Cisco routers through **GRE tunnels** to retain access and evade detection. Investigators said the campaign moved across Windows, Linux, SAP ERP, Oracle, PostgreSQL, and network infrastructure, using tools such as **RDP**, **PsExec**, and **Impacket** for lateral movement and privilege escalation. Reported theft included a **407 MB BloodHound** Active Directory dataset, more than **1.3 million personal records**, and **SSL private keys**, including material tied to tax authority infrastructure, indicating both financially motivated theft and possible intelligence collection.
Jun 29, 2026
Attackers are actively exploiting **CVE-2026-5027**, a high-severity path traversal vulnerability in the open-source AI application platform **Langflow**, to write files to arbitrary locations on target systems and potentially achieve remote code execution. The flaw affects the `POST /api/v2/files` endpoint, where the `filename` parameter is not properly sanitized, and exploitation is made more severe by Langflow's default unauthenticated auto-login behavior, which lets attackers obtain a valid session token with a single unauthenticated request. VulnCheck reported observed attacks writing apparent test files to victim hosts, while Tenable identified the issue and assigned it a **CVSS 8.8** score. Internet exposure increases the risk: Censys data indicates about **7,000** Langflow instances are reachable online, with the largest concentration in North America. The exploitation report also fits a broader pattern of sustained attacker interest in Langflow, with other vulnerabilities including **`CVE-2026-0770`**, **`CVE-2026-21445`**, **`CVE-2026-33017`**, and **`CVE-2025-34291`** also reported as exploited in 2026; the last has been linked in public reporting to the Iranian state-backed group **MuddyWater**. Separately, a newly disclosed flaw in **Roxy-WI** (**`CVE-2026-45556`**) shows a similar arbitrary file-write-to-RCE pattern on managed load balancers, but no public patch was available at publication.
Jun 29, 2026