Sysdig discloses JADEPUFFER: LLM end-to-end driven database ransomware attack
JADEPUFFER: Agentic ransomware for automated database extortion
AI summary
Sysdig reported an attack named JADEPUFFER in which attackers entered the environment through a known Langflow vulnerability, moved laterally to access a database, and carried out configuration encryption extortion. Based on the attack's rapid iteration and corrections to errors, the report inferred it was driven by an LLM agent. End-to-end autonomy and whether it is the first such case are the researchers' assessment; the report said it could not directly see the attacker's system prompts and orchestration, and the lack of saved keys hindered recovery.
Why it was selected
Sysdig 记录了一次由 LLM 端到端驱动的勒索操作，其自述式载荷与 31 秒自我纠错为识别 Agent 攻击提供了可迁移的检测线索。