{"data":{"id":1965,"lang":"en","title":"JadePuffer Ransomware Becomes First Fully AI-Driven Autonomous Cyberattack, Researchers Say","summary":"Researchers say the JadePuffer ransomware operation used a fully autonomous AI agent to plan and execute an entire cyberattack without human help.","category":"ai","category_label":"AI","published_at":"2026-07-07T22:01:32Z","updated_at":"2026-07-07T22:01:32Z","url":"https://techtools.cz/tools/news/article/1965-jadepuffer-ransomware-becomes-first-fully-ai-driven-autonomous-cyberattack","api_url":"https://techtools.cz/news-api/v1/articles/1965?lang=en","markdown_url":"https://techtools.cz/news-api/v1/articles/1965.md?lang=en","image_url":"https://www.bleepstatic.com/content/hl-images/2026/07/02/pufferfish.jpg","word_count":179,"reading_time_minutes":1,"sources":[{"url":"https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/","domain":"bleepingcomputer.com"},{"url":"https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion","domain":"sysdig.com"}],"translation":{"lang":"cs","id":2038,"title":"Ransomware JadePuffer je podle výzkumníků prvním plně autonomním kyberútokem řízeným AI","url":"https://techtools.cz/tools/news/clanek/2038-ransomware-jadepuffer-je-podle-vyzkumniku-prvnim-plne-autonomnim-kyberutokem","api_url":"https://techtools.cz/news-api/v1/articles/2038?lang=cs"},"content":"Cloud security firm Sysdig has documented what it calls the first fully agentic ransomware attack — an operation in which an autonomous AI agent planned and executed an entire intrusion without human intervention, from reconnaissance to encryption and the ransom note.\n\nThe AI agent broke in through an unpatched remote code execution flaw in the open-source Langflow framework (CVE-2025-3248), then pivoted to a production MySQL server running Alibaba Nacos via a 2021 authentication-bypass bug (CVE-2021-29441). It stole credentials, moved laterally, escalated privileges, and encrypted 1,342 Nacos configuration items before deleting the originals and dropping a Bitcoin ransom demand — adapting to failed steps on its own, in one case fixing a broken login attempt in just 31 seconds.\n\nSysdig published its analysis on July 4, 2026, warning that the operation lowers the skill floor for running damaging, adaptive cyberattacks since a human no longer needs to script or supervise each stage. Because the AES encryption key was never transmitted to the attackers own infrastructure, researchers note that victims who pay the ransom may be unable to recover their data regardless."}}