JADEPUFFER Agentic Ransomware Uses LLM to Automate Database Extortion

Gbhackers •Mayura Kathir • July 2, 2026

The first instance of agentic ransomware: JADEPUFFER, an LLM-driven extortion operation that automated an end-to-end database-crippling campaign. The actor gained execution on an internet-facing Langflow instance via CVE-2025-3248, used the AI-host environment to harvest cloud and API credentials, and pivoted into a production MySQL/Nacos deployment to carry out a destructive, database-focused extortion playbook without a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Fuels Surge in Global Cyberattacks As of February 12, 2026, organizations worldwide are experiencing an average of 2,090 cyber-attacks per week, largely driven by ransomware incidents. This increase highlights the ongoing challenges faced by businesses in securing their networks against evolving cyber threats. 1922 sources 64

Extracted Entities

JADEPUFFER Agentic Ransomware Uses LLM to Automate Database Extortion

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (2)

Ransomware Groups (1)