{"id":371720,"date":"2026-07-06T07:28:00","date_gmt":"2026-07-06T14:28:00","guid":{"rendered":"https:\/\/cms-articles.softonic.io\/en\/?p=371720"},"modified":"2026-07-06T07:28:41","modified_gmt":"2026-07-06T14:28:41","slug":"jadepuffer-seen-in-the-wild-it-may-be-the-first-fully-autonomous-ransomware","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/jadepuffer-seen-in-the-wild-it-may-be-the-first-fully-autonomous-ransomware\/","title":{"rendered":"JadePuffer seen in the wild: it may be the first fully autonomous ransomware"},"content":{"rendered":"<p class=\"wp-block-paragraph\">JadePuffer has now shown up in a real attack, and it may be the first <strong>fully autonomous ransomware campaign<\/strong> we&#8217;ve seen. Researchers say it carried out the entire attack chain on its own, with no direct human steering.<\/p>\n\n<p class=\"wp-block-paragraph\">An unpatched, internet-facing <a href=\"https:\/\/langflow.en.softonic.com\/\" rel=\"noopener\">Langflow<\/a> system was enough to let it in. The researchers say the intrusion started with <strong>CVE-2025-3248<\/strong>, a critical known flaw in Langflow, the open-source framework. From there it moved through the environment, stole credentials, encrypted systems, and even recovered from a failed login in about 31 seconds. That kind of self-correction makes JadePuffer feel less like a rigid script and more like a skilled operator adjusting as it goes.<\/p>\n\n<p class=\"wp-block-paragraph\">What followed was more destructive than lucrative. The researchers say JadePuffer encrypted <strong>1,342 service configuration files<\/strong>, deleted the originals, and never saved or sent out the encryption key. That means recovery would be effectively impossible even if a victim paid. The Bitcoin address in the ransom note didn&#8217;t help its case either, since it looked like a generic example probably lifted from training data.<\/p>\n\n<p class=\"wp-block-paragraph\">If you run software that&#8217;s exposed to the internet, this should get your attention. Tools like JadePuffer could make sophisticated attacks easier to launch and leave defenders with a much <strong>smaller window<\/strong> to react.<\/p>\n\n<p class=\"wp-block-paragraph\">There&#8217;s nothing to download here, but if you use Langflow or similar internet-facing systems, <strong>patch known flaws<\/strong> and lock down credential controls now.<\/p>","protected":false},"excerpt":{"rendered":"<p>JadePuffer has now shown up in a real attack, and it may be the first fully autonomous ransomware campaign we&#8217;ve seen. Researchers say it carried out the entire attack chain on its own, with no direct human steering. An unpatched, internet-facing Langflow system was enough to let it in. The researchers say the intrusion started &hellip; <a href=\"https:\/\/cms-articles.softonic.io\/en\/jadepuffer-seen-in-the-wild-it-may-be-the-first-fully-autonomous-ransomware\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;JadePuffer seen in the wild: it may be the first fully autonomous ransomware&#8221;<\/span><\/a><\/p>\n","protected":false},"author":9337,"featured_media":371719,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wpcf-pageviews":0},"categories":[1015],"tags":[],"usertag":[],"vertical":[],"content-category":[6771],"class_list":["post-371720","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","content-category-ai"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/371720","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/users\/9337"}],"replies":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/comments?post=371720"}],"version-history":[{"count":1,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/371720\/revisions"}],"predecessor-version":[{"id":371721,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/371720\/revisions\/371721"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media\/371719"}],"wp:attachment":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media?parent=371720"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/categories?post=371720"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/tags?post=371720"},{"taxonomy":"usertag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/usertag?post=371720"},{"taxonomy":"vertical","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/vertical?post=371720"},{"taxonomy":"content-category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/content-category?post=371720"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}