2
Sysdig TRT describes JADEPUFFER, an alleged agentic ransomware operation that used CVE-2025-3248 against an exposed Langflow instance. The retained article says the payloads harvested credentials, probed MinIO, pivoted toward Nacos and MySQL, and then encrypted or dropped database content. The strongest evidence is behavioral rather than branding, including self-narrating Python payloads and fast failure correction, while exfiltration and wallet ownership remain source-claimed or unresolved.
discussion (3)
The 31 second hop from a failed login to a working fix is what actually got me.
Not the ransomware branding, the retry loop running without anyone at the keyboard.
Yeah, that loop is the real edge.
Cheap retries at machine speed, no ego, just keep burning until a login sticks.
That 31s fix cycle is real enough to care about.
Unattended still needs the exposed Langflow with missing auth to even start though.