# Nacos CVE-2021-29441

Published articles for Nacos CVE-2021-29441.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## JADEPUFFER: Agentic ransomware for automated database extortion

DevFeed: [JADEPUFFER: Agentic ransomware for automated database extortion](<https://devfeed.tech/articles/jadepuffer-agentic-ransomware-for-automated-database-extortion-53239.md>)

Original publisher: [Read original article](<https://webflow.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion>)

Author: Michael Clark

Published: 2026-07-01T00:00:00Z

Content type: article

Language: en

Sources: [Sysdig](<https://devfeed.tech/sources/sysdig-blog.md>)

Topics: [Threat Research](<https://devfeed.tech/topics/threat-research.md>), [ransomware](<https://devfeed.tech/topics/ransomware.md>), [Cybercrime](<https://devfeed.tech/topics/cybercrime.md>), [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>), [Database](<https://devfeed.tech/topics/database.md>), [Server](<https://devfeed.tech/topics/server.md>)

Tags: [agentic](<https://devfeed.tech/tags/agentic.md>), [agentic-ai-security](<https://devfeed.tech/tags/agentic-ai-security.md>), [agentic-ai-threat](<https://devfeed.tech/tags/agentic-ai-threat.md>), [agentic-ransomware](<https://devfeed.tech/tags/agentic-ransomware.md>), [agentic-threat-actor](<https://devfeed.tech/tags/agentic-threat-actor.md>), [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [ai-agent-attack](<https://devfeed.tech/tags/ai-agent-attack.md>), [ai-ransomware](<https://devfeed.tech/tags/ai-ransomware.md>), [api-keys](<https://devfeed.tech/tags/api-keys.md>), [autonomous-cyberattack](<https://devfeed.tech/tags/autonomous-cyberattack.md>), [cloud-credential-theft](<https://devfeed.tech/tags/cloud-credential-theft.md>), [cloud-native-security](<https://devfeed.tech/tags/cloud-native-security.md>), [cnapp](<https://devfeed.tech/tags/cnapp.md>), [container-security](<https://devfeed.tech/tags/container-security.md>), [credential-harvesting](<https://devfeed.tech/tags/credential-harvesting.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [cve-2025-3248](<https://devfeed.tech/tags/cve-2025-3248.md>), [database](<https://devfeed.tech/tags/database.md>), [database-extortion](<https://devfeed.tech/tags/database-extortion.md>), [exploited](<https://devfeed.tech/tags/exploited.md>), [jadepuffer](<https://devfeed.tech/tags/jadepuffer.md>), [langflow](<https://devfeed.tech/tags/langflow.md>), [langflow-rce](<https://devfeed.tech/tags/langflow-rce.md>), [langflow-vulnerability](<https://devfeed.tech/tags/langflow-vulnerability.md>), [large-language-model-attack](<https://devfeed.tech/tags/large-language-model-attack.md>), [lateral-movement](<https://devfeed.tech/tags/lateral-movement.md>), [llm](<https://devfeed.tech/tags/llm.md>), [llm-driven-attack](<https://devfeed.tech/tags/llm-driven-attack.md>), [llmjacking](<https://devfeed.tech/tags/llmjacking.md>), [minio-enumeration](<https://devfeed.tech/tags/minio-enumeration.md>), [mysql-ransomware](<https://devfeed.tech/tags/mysql-ransomware.md>), [nacos-cve-2021-29441](<https://devfeed.tech/tags/nacos-cve-2021-29441.md>), [nacos-default-jwt-key](<https://devfeed.tech/tags/nacos-default-jwt-key.md>), [ransomware](<https://devfeed.tech/tags/ransomware.md>), [ransomware-evolution](<https://devfeed.tech/tags/ransomware-evolution.md>), [runtime-threat-detection](<https://devfeed.tech/tags/runtime-threat-detection.md>), [sysdig-threat-research-team](<https://devfeed.tech/tags/sysdig-threat-research-team.md>), [sysdig-trt](<https://devfeed.tech/tags/sysdig-trt.md>), [threat-intelligence](<https://devfeed.tech/tags/threat-intelligence.md>)

### AI overview

Sysdig Threat Research Team documents JADEPUFFER, an agentic ransomware operation that used an LLM to exploit a vulnerable Langflow instance, obtain credentials, adapt its attack steps, and carry out database extortion against a production server.

### Source excerpt

The Sysdig TRT documents JADEPUFFER: the first known agentic ransomware operation, where an LLM autonomously exploited Langflow, harvested credentials, and executed full database extortion.