JADEPUFFER

JADEPUFFER does not rely on a lure, a phishing email, or a user clicking anything. Entry is a single unauthenticated HTTP request to Langflow's code-validation endpoint, /api/v1/validate/code, which Sysdig identifies as a missing-authentication flaw tracked as CVE-2025-3248. The endpoint exists so Langflow can check that a user-submitted code snippet is syntactically valid before wiring it into an agent workflow. Because it never checks who is submitting the code, an attacker gets arbitrary Python execution on the host with no credential of any kind.

Langflow is an attractive target for reasons beyond the bug itself. It is a widely deployed open-source framework for building LLM applications, and deployments remain exposed on many internet-facing servers. Because these servers exist to orchestrate connected AI services, they frequently hold LLM provider API keys, cloud credentials, and connections to vector databases and object stores directly in their runtime environment, and they are often stood up quickly without network controls. CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities catalog in May 2025, and it remained JADEPUFFER's entry vector across both documented campaigns.

Every payload in both campaigns was delivered the same way: as base64-encoded Python submitted through this single RCE channel. There is no dropped installer, no macro, no clipboard trick. The entire operation runs through one endpoint on one application.

Immediately after gaining execution, the agent fingerprints the host: user context, kernel and OS version, hostname, network interfaces, and the running process list. It then sweeps the environment in parallel for secrets across several categories at once: LLM provider API keys across multiple vendors, cloud provider credentials with explicit coverage of Chinese cloud environment-variable prefixes alongside AWS, GCP, and Azure, cryptocurrency wallet and seed-phrase material, and database connection strings.

It then dumps Langflow's own backing Postgres database, harvesting stored credentials and user records to local files, reviews them, and deletes the staging files. From there it probes the internal address space and, on finding a responsive MinIO object-store API, authenticates with the well-known default credential pair and works through a full bucket-enumeration playbook: listing every bucket, prioritizing one named for Terraform state and an internal configuration bucket, then fetching named credential files by path.

For persistence on this first host, it writes a single crontab entry that beacons outbound to attacker infrastructure every 30 minutes using nothing more than the Python standard library. In the second campaign, once a Docker socket was located, the same agent progressed to building a working container-escape pipeline in a live session, discovered the host process ID through the Docker API, copied the ENCFORGE binary across the container boundary through the host's /proc filesystem, and launched it directly on the host outside the original container's isolation. Every step, including recovery from a failed step, was generated and executed by the same agent in one continuous session.

The evasion in this operation is architectural rather than file-level obfuscation. Every payload arrives through the legitimate application's own code-execution surface, so there is no external dropper, no email attachment, and no suspicious download to flag at delivery. The application itself is the delivery mechanism.

ENCFORGE is packed with UPX and returned no detections from common threat-intelligence tools on either the packed or unpacked sample at the time Sysdig analyzed it. Within the RCE session, the agent's technique matured across iterations: an early script built its logic one inert line at a time to avoid tripping any single-request signature, then switched to a single-shot inline base64 payload decoded straight into an exec() sink, invisible to tooling that only searches for shell-level base64 -d patterns.

The clearest evasion artifact is a homoglyph. Alongside two normally named CPython interpreters, the operator's staging server hosted a third binary named with a Unicode mathematical pi character in place of the letter p, engineered to slip past filename checks such as basename in ("python","python3") or a process-kill command matching only the literal string. The Docker-socket escape is itself an evasion technique: rather than attempting anything detectable inside the constrained container, the agent built a privileged, host-mounted, one-shot container for each command and tore it down immediately after, minimizing the footprint any single artifact would leave.

On the Langflow host, the objective is credentials and staging access: the MinIO object store's application data, backup, and machine-learning-artifact buckets, plus any .env or credentials.json files reachable from it. None of this is the final target; it is the means to reach a separate production database server.

On that second server, the agent modifies the Nacos configuration-service database directly: it inserts a backdoor administrator account into the users and roles tables, corrects the account when the first insertion attempt fails, then uses the resulting session to encrypt the service's configuration items in place using the database's own encryption function, drop the original and history tables, and replace them with an extortion table containing a payment demand.

In the ENCFORGE campaign, the target expands to the filesystem itself: roughly 180 extensions spanning model checkpoints and weights (PyTorch, TensorFlow, HuggingFace, llama.cpp formats), vector-index files, and columnar training-dataset formats. A command-line flag lets the operator append custom extensions per campaign, and the binary's own help text names LoRA fine-tune adapters and legacy model weights as the example, evidence the targeting is deliberately built around AI infrastructure. The compiled binary also carries Windows-specific anti-recovery code, literal invocations of vssadmin.exe and bcdedit.exe, indicating a Windows build exists or is planned even though the session Sysdig observed ran on Linux.