JADEPUFFER Agentic Ransomware: 5 Critical Threats for Your Monday Intel Drop

JADEPUFFER is the first documented case of agentic ransomware, a category Sysdig Threat Research defines as an extortion operation conducted entirely by a large language model agent with no human operator in the decision loop.

The attack chain began with CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, the open-source AI workflow builder. Langflow exposes a code validation endpoint that required no authentication before a patch shipped on April 1, 2025. CISA flagged active exploitation by early May 2025. Despite that public warning, internet-facing Langflow instances remained in production deployments. JADEPUFFER used this entry point to inject base64-encoded Python payloads directly through the RCE endpoint, executing them as self-narrating scripts that described each step in natural language as they ran.

From the Langflow instance, the AI agent dumped PostgreSQL credentials from environment variables and staged them at /tmp/creds.json. It then pivoted to a production Alibaba Nacos service registry running on a MySQL backend. Nacos is widely deployed in microservices environments to manage service discovery and configuration data for entire application fleets. The agent exploited CVE-2021-29441, a Nacos authentication bypass that creates rogue administrator accounts, to gain control of the admin panel. It established persistence via a crontab entry beaconing back to 45.131.66[.]106 on port 4444 every 30 minutes, staging exfiltration through 64.20.53[.]230 (AS19318, InterServer).

The agent then encrypted all 1,342 Nacos service configuration items using MySQL's native AES_ENCRYPT() function with AES-128-ECB mode, deleted the originals, replaced them with encrypted blobs, and created a README_RANSOM table directing victims to e78393397[@]proton[.]me. The ransom note claimed AES-256 encryption; the actual algorithm was AES-128-ECB. The encryption key was generated ephemerally via base64(uuid4().bytes + uuid4().bytes), printed once to stdout, and never transmitted, making recovery without payment impossible.

The critical capability this demonstrates is autonomous adaptation. When the initial Nacos admin account insertion failed, the agent diagnosed the precise cause and produced a corrected SQL payload in 31 seconds without any human issuing new instructions. This is what separates JADEPUFFER agentic ransomware from AI-assisted attacks where a human still reviews failures and decides next steps.

A sustained password spray campaign targeting Microsoft 365 environments through the Azure CLI generated 81 million login attempts in two weeks between June 12 and June 26, 2026. Huntress researchers confirmed 78 compromised Microsoft 365 accounts across 64 organizations, with a clear escalation event on June 22 when a single day produced 30 newly compromised identities across 23 businesses.

The threat actor using LSHIY LLC infrastructure (Autonomous System 32167) sourced username and password combinations from prior data breaches. Once valid credentials were found, the attacker authenticated via the ROPC (Resource Owner Password Credentials) OAuth grant type, a legacy flow that accepts direct username and password submissions without triggering the browser-based MFA challenge most organizations rely on. Organizations with Conditional Access policies scoped only to specific applications, specific user groups, or specific geographic locations left the ROPC endpoint completely uncovered.

The 81 million attempt volume reflects industrial-scale automation rather than manual targeting. Huntress data shows credential spray volume across their customer base increased more than 155 times over the prior six months, with organizations averaging approximately 1,964 failed attempts per tenant per month. This campaign is an acceleration of a structural trend.

The LSHIY spray exploits the same architectural gap that ConsentFix targeted with OAuth token theft: organizations configure MFA for their most visible applications while leaving legacy protocol endpoints as unguarded back doors. Defenders should pull Azure CLI authentication logs, filter for ROPC grant type authentications from AS32167 IPv6 addresses, and review all successful logins where Conditional Access policy evaluation passed without MFA enforcement between June 12 and June 26.

CVE-2026-45659 is a remote code execution vulnerability in Microsoft SharePoint Server arising from deserialization of untrusted data, rated CVSS 8.8. An authenticated attacker with Site Member permissions can trigger the flaw over the network without administrative privileges. CISA added it to the Known Exploited Vulnerabilities catalog and required Federal Civilian Executive Branch agencies to apply patches by July 4, 2026. That deadline has passed. Active exploitation continues.

Three SharePoint product lines are confirmed affected: SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. Organizations running any of these on-premises deployments should treat unpatched instances as actively at risk. Post-exploitation behavior documented by researchers includes persistence via Velociraptor, Cloudflare tunneling agents, and Zoho Assist remote access tools installed after initial compromise.

Full patch commands and verification steps are in our prior CVE-2026-45659 coverage. Apply May 2026 security updates on all SharePoint servers now, run the SharePoint Products Configuration Wizard after patching, restart IIS on all front-end web servers, rotate all SharePoint service account credentials, and revoke excessive Site Member permissions. Any SharePoint server that was internet-accessible between vulnerability disclosure and your confirmed patch date warrants a full log review for unauthorized remote-access tool installation.

Two additional threats from this past week demand Monday morning attention.

The Department of Homeland Security confirmed on July 1, 2026, that an unknown threat actor breached the Homeland Security Information Network (HSIN) and an associated SharePoint collaboration system between late May and early June 2026. HSIN is the sensitive unclassified information-sharing platform used by federal, state, local, and private-sector partners to coordinate security operations. With the FIFA World Cup underway across United States venues, the breach raised immediate concerns about exposed event security planning documents, venue coordination procedures, and interagency intelligence. DHS stated classified systems were not affected but has not confirmed whether documents were stolen. If your organization holds an active HSIN account, audit authentication logs for the breach window and rotate all credentials immediately. Full remediation steps are in our HSIN breach analysis.

CVE-2026-33825, the Windows Defender privilege escalation flaw researcher Nightmare Eclipse leaked in April 2026 alongside working proof-of-concept code, has been confirmed by CISA as actively used by ransomware gangs as of this week. The vulnerability exploits insufficient access control in Microsoft Defender to reach the Security Account Manager database, extract local password hashes, and escalate to SYSTEM-level control. Microsoft patched the flaw on April 14, 2026. CISA added it to the KEV catalog April 22 with a federal deadline of May 7. Organizations that have not applied the April 2026 cumulative update face active ransomware risk from any attacker with local access to a Windows endpoint. Full BlueHammer IOCs and detection rules are here.

JADEPUFFER agentic ransomware is significant not because of its individual components but because of what it removes from the attack chain: the skilled human operator. Every step of this extortion operation was executed by an AI agent reasoning about its targets, adapting to failures, and making tactical decisions without a human in the loop. The agent required no exploit development skill, no lateral movement expertise, and no database administration knowledge. It used three public CVEs and a standard MySQL encryption function.

The skill floor for ransomware has dropped to whatever it costs to run an LLM agent. When that agent operates on stolen credentials through LLMjacking, the marginal cost to the attacker approaches zero. Sysdig's analysis indicates JADEPUFFER likely used a commercial LLM API funded by credentials stolen in an earlier operation, meaning the entire ransomware attack may have run at near-zero direct cost.

For security teams, two calculations change. First, ransomware attempt volume will increase as the human bottleneck is removed. Second, the attacker profile expands: operators without ransomware technical expertise can now deploy agentic attack frameworks targeting whatever internet-facing developer tooling they can reach. Langflow, Nacos, and similar platforms often get deployed rapidly in cloud and DevOps environments without the security scrutiny applied to traditional production infrastructure.

The four additional threats in this Monday Intel Drop follow the same structural pattern: attackers exploiting configuration gaps and unpatched known vulnerabilities at industrial scale. The LSHIY campaign targeted Conditional Access policy gaps that most organizations have never audited. CVE-2026-45659 exploited the gap between patch release and organizational deployment cycles. BlueHammer exploited a three-month window between a researcher's public PoC release and full endpoint patch deployment. Your attack surface this Monday is defined precisely by the distance between what you have patched and what attackers already know is still open.

Five threats, five action tracks. Work through these before EOD today — all five have active exploitation confirmed.