JADEPUFFER: An End-to-End Agentic-Led Ransomware Attack

Elliot Volkman: Hello and welcome back to the "Microsoft Threat Intelligence" podcast. My name is Elliot Volkman, the sometimes host of this podcast and a director for "Microsoft Threat Intelligence." And today we are going to be talking about the, or maybe a, first documented case of an LLM at the behalf of a threat actor conducting an end to end ransomware attack. What they are dubbing JADEPUFFER is going to highlight some of the research and findings of how they discovered it, some of the information that they were able to articulate that it was a agent or agentic AI functioning instead of just a person with automation and scripting and what this means for the threat landscape. So we are going to hand this off over to our two experts. We have Michael Clark and Crystal Morin, the senior cybersecurity strategist over at Sisdig. Can you give us a little bit of background about what you all had discovered as JADEPUFFER?

Michael Clark: Sure. JADEPUFFER is a threat actor that we identified who compromised the Langflow instance and then used that Langflow instance to attack a third-party server and with ransomware, it was the MySQL database, they got into and tried to encrypt the tables and things like that. But what made it, you know, especially interesting was we were able to determine it was an LLM conducting the attack. And we had been looking for, we've been monitoring evidence in this for a while. Like at this time, we have over 100 agentic threat actors, we call them, they're tracking. And this was the one who really did something interesting beyond the typical exploitation and credential theft and did a lot more than most of the other agentic threat actors that we have seen.

Elliot Volkman: Very cool. So maybe we can pull that just a little bit further apart. So you're saying you're tracking agentic threat actors. Are we talking about human threat actors with agents working at their direction or more akin to, I think, what we're seeing in this situation.

Michael Clark: Well, I think there's always a human behind it. We're not that Skynet quite yet. But their tool set is an LLM. So whether they're, how they're kicking it off, I don't think really matters, but they're not using just Python scripts. They're using an LLM to do the back and forth. So to handle pretty much everything.

Elliot Volkman: Okay. Just figured I would ask for clarification. Say we don't want, you know, media [inaudible 00:02:43]. So I think one of the things that I found particularly unique in this scenario, and we can kind of determine what this actually means as a side effect, but actually, maybe I'll just point this back to you all, but like, how did you determine that this was an agent working on the behalf of a threat actor?

Michael Clark: So we used a couple methods. One kind of indirect is the sheer volume of activity and commands and scripts it tried to make in a short amount of time. It's just not possible that it was a human because you can just see the way it iterates through reconnaissance and then tries to construct commands and works through why it doesn't work in a very methodical way. But that's indirect. In a more direct way, we, we were able to seed that system with indirect, I don't say prompt injection, because that makes it sound like we're running commands on their systems. But it's more if you can hide instructions and resource locations in paragraphs that are encoded. And unless a person decodes them, reads them, infers the meaning and remakes the location of the resource or the endpoint or path, it's an LLM that did it. So that's another way we're able to do it is by planning that kind of data. It reads the paragraph. We might even have it in different rare languages, and it automatically pulls out the location, and we see it go to it. So we're able to use that to kind of directly confirm that it's an LLM.

Elliot Volkman: Interesting. So if I understand that correctly, we're, we're saying here, like sort of like in a note section of documentation, you're just speaking to this entity, the agent, and like a normal human, regular human would have probably caught wind of that and be like, oh, yeah, you don't need this whole explanation.

Michael Clark: Yeah, exactly. And it lets us prove the way we, since it's a paragraph and not, it's not even parsable. So you can't write a regex script to do it. So you can, that's another way, because there's no, nothing to extract. It's all just sentences. And so that, yeah, that's a way we can prove it's an LLM. It's not, and I don't think we, it's nothing we invented. I think people have been doing that for a little while, but you're able to use it for these kind of purposes of identification.

Elliot Volkman: Interesting. And Crystal, do you have anything that you want to add to like the context of discovery and how we're sort of shifting? Because I mean, traditionally for threat intelligence, we're looking at like behavioral data to help determine the differences. But anything that you'd like to add?

Crystal Morin: Yeah, another part of it too. So the first article that we put out for JADEPUFFER, there was an error when it was trying to log in and use one of the credentials, and it self-corrected in a matter of 31 seconds. So when it hit that failure, it reasoned over the failure to try to figure out what happened and then rewrote 15 lines of code and then moved on through the extortion campaign. A person cannot even comprehend and figure out a problem in 31 seconds, never mind even trying to type out 15 lines of code in 31 seconds. So that's also a pretty clear indicator of an LLM doing something like that. And then the second one as well, Mike, you can recall there was something similar as well. There was an issue and it was a, I think it was a five minute, it had something to do with the payloads, I believe.

Michael Clark: Oh, there was a foreign key, like when it was trying to drop a database, there were primary foreign key issues that it had to work through. And you could see it trying to work through how to get around it because MySQL won't do it, won't drop a table if there's keys referring to it in certain cases. You could see it trying to work, reason through it and try different things to get around it all very quickly and methodically.

Elliot Volkman: So based on that situation, do you feel like it was being pretty noisy as far as like it trying to get to its end goal?

Michael Clark: Yeah, I mean, that's one of the kind of, I guess, drawbacks from an attacker perspective of doing it, using an LLM, it is noisy. As I think we all know, our LLMs all try to save us tokens ever. So it has no problems trying every way it can, going down wrong paths, doing weird errors. So there's a lot that identifies it. And it doesn't do anything new. It's just doing a lot, you know, more because it has all that build-in knowledge. It doesn't have to go research and then come back. So you get to see it do all sorts of weird things and different things, but nothing extremely advanced. So.

Crystal Morin: They're very persistent, which is a good thing for us on the defender side, right. Again, the bad thing is the speed aspect of it. But the persistence means that at some point, eventually we should see or be able to detect something that we have a detection analytic that will trigger for. So, yeah.

Elliot Volkman: That, that is a good point. And I think like the at least one major series of articles that we've seen has been, I think there's like 17,000 actions captured across like four days. Like, yeah, that, that sounds like someone would have caught wind of that a little bit earlier. But I think the --

Michael Clark: That matches what we saw too. Like we had, I think it was 6 to 800 payloads of generated like Python scripts it was trying to run over a short amount of time. So the sheer amount of things it tries to do is much greater than any human attacker.

Elliot Volkman: I think the other challenge that we need to consider is like as these models and systems and they sort of get a little bit smarter, in theory, they will get less noisy and be more efficient. But the fact that they just have the sheer speed and the always on capability, obviously that is a problem in itself. But yeah, that'll be a challenge for not so distant future, I suppose. But I'm curious though, like right now, typically we would maybe articulate a threat actor based on their sophistication. Obviously, nation states usually take the cake as being like the most sophisticated. But because we're seeing these new scenarios where agents are working at the behest of people, do we feel like the mechanism is now where mapping agents are maybe lower sophistication, or is this enabling potentially lower sophisticated threat actors to achieve their goal, or maybe both?

Michael Clark: That's a, that's a tough question. And we talked about this before a little bit is it kind of messes up attribution because everyone has access to these. It does raise the floor quite a bit for attackers to level. I mean, I would say nation states and people may disagree, but like the hallmark of them is generally they want to be stealthy. Criminals and credential theft, they don't really care about being stealthy. And LLMs are not stealthy. And like I think one of the odd quirks of it all is if you ask it to be stealthy, it's more likely to start refusing to do what you want. I'm sure we've all run into this when we're trying to build things, and it starts refusing you because it's cyber or things like that. So you kind of have to be careful of how you use your LLM to accomplish these things.

Elliot Volkman: Anything you would like to add to that, Crystal?

Crystal Morin: Yeah, I think one of the big things when we found this attack was this lowered the barrier to entry for ransomware now. This was an LLM that conducted a pretty much successful, albeit messy, ransomware attack, which means that anyone could take an LLM potentially and conduct a ransomware attack. Ransomware is generally a pretty complex kind of campaign. Not only do you need the technical savvy to accomplish it, but also business savvy to convince your victim to pay you the millions of dollars. And this is not the case here. All you need is an LLM to run it for you. So there is the potential that a lot more cyber criminals can now take advantage of this, which is concerning because also traditionally, you know, healthcare, financial industry were typically the targets of ransomware attacks. Now we can potentially see anyone and everyone be targeted because it doesn't matter anymore. I think as far as attributing these attacks as well, at the end of the day, and I used to work in threat intelligence prior to coming to Sysdig, does attribution really matter? As long as you're stopping the attack, that's the most important part. Yes, attribution's important, but using LLMs makes it so much harder because they're pulling from all of this information from open internet. So literally any of these threat actors could be using an LLM, and they're all using, like Mike said, the same kinds of capabilities. So it's going to be hard to pinpoint one attack from another with this JADEPUFFER campaign, the way that we were able to see that it was the same actor, believed that it was the same actor happening twice, was the crypto wallet that was in the ransom note both times was identical. So that helped. There's also the possibility, again, if there is a ransomware group or a single person behind this LLM, if they're actually technically savvy and they're building a binary that they're feeding into the LLM, then that could be an indicator or a signature. If you have a Russian or Chinese threat actor and they have something, you know, one of their special tools that they're feeding into the LLM to use, that might be something to use. But again, there's no guarantee. These are going to make it a lot harder for attribution at the end of the day.

Elliot Volkman: I think you're bringing up a lot of really interesting points and questions here because while actor attribution is helpful because we're able to get a better sense of what they're going to potentially do based on what we're seeing, I think you sort of are pointing at like we have a ransomware as a service ecosystem and a cybercrime as a service ecosystem. So like on one page, we are seeing a possibility where there could be disruption in that marketplace. Right now, it's not insanely expensive to hire these different groups to work on your behalf, but if they're just agentizing it, it's basically like a SAS solution where it might make it even cheaper, enable teams to move even faster. And then I think if I'm understanding this correctly, in the finding that you all discovered here is because they were using the same crypto wallet, you were able to map the two items together, but it sounds like there's enough difference between the two situations that typically you wouldn't really have been able to connect the two dots.

Michael Clark: They made it easy on us with using the same IP address. So that helped. But in the second situation, the second report we did, they targeted the host versus going after a third party. And they used a container escape and then tried to run ransomware on the host. Now, the ransomware primarily targeted AI data and models, which was pretty interesting. So I mean, they had 128, I forget the exact number, 130 or so different extensions it looked for, but there were like 20 to 30 AI-specific ones like tensors, safe tensors and other file types, which brings up the interesting question of, all right, if you, you can cause a lot of harm if you ransom a AI model that has not been properly backed up yet, or the training data, or, you know, even other files that I don't quite understand fully, all the weights and things like that. So if they get at those files, it could be, I think we estimated, and this was a very safe estimate of like up to $500,000 for a medium model if they matter to ransom it. To redo it, sorry, to remake the model could cost like $500,000. And that could be a lot more for a bigger company.

Elliot Volkman: So for clarification, are we saying that this particular threat actor was going after like a, like going right at the models or the organizational or enterprise owned system that contains all sorts of crazy proprietary data?

Michael Clark: Well, they were hoping, I think, that there were, the ransomware they developed looked for these files. This, and since this was a Langflow system, they, I guess, they maybe had some expectation there might be models accessible from it. And then, but you know, there were not in this case, but the binary and we were able to reverse engineer a bit and see all this. And it was the first time I had seen, you know, this being, these files being targeted. And it was new ransomware that had, it's a new strain that, it's really hard to tell if a go binary was built by AI. So I don't want to say it was, but knowing the threat actors, they probably used AI to build it. I mean, that's what most people would do now. So it just, it kind of wraps it all up. Very interesting. They were abusing AI, and now they're attacking AI.

Elliot Volkman: So we do know, obviously, actors are definitely going after the most the large enterprise model organizers because, you know, they're able to influence and understand if they can get in there and how they function. But I think the other good point here is like the amount of proprietary information that is sent like, you know, on a daily basis, someone building proprietary code for a company. So obviously the days of just locking out information is not really like the primary, not the central goal for ransomware anymore. It is now data exfiltration and abuse of that information. But I think that does very clearly articulate the challenges that organizations might not necessarily have seen direct evidence of, but this is a great piece of research to indicate maybe we need higher levels of controls and policies in place of what goes into these or what does not.

Michael Clark: Yeah, the idea of crown jewels is changing quickly because does everyone know where all their AI, important AI data is or valuable AI data is? That's a different question. Like active directory or your main database and things like that.

Elliot Volkman: Yeah, that is, that is a great point. I know you've kind of pulled this apart a little bit, but I'm curious based on, and you literally just called this out with the crown jewels are changing a bit now, but how do you feel this scenario is changing where in the agentic world, where now threat actors are being enabled with AI or agents or otherwise? You know, how is that different from the standard threat actor and using automation?

Michael Clark: I think a lot of it, any of the old security, security saying, everyone counted on it though, even if like all of us said it, like it's not security, but we all kind of counted on the fact that an attacker would not have 100% knowledge of our networks, of how to do everything. And that adaptability is kind of what I see with AI as a big threat. An example in this attack was they looked for the MinIO, it's like an S3 compatible service that people can deploy and do the same kind of protocol that they would do with S3, but locally on their own servers. It was looking for things like that, which I wasn't too familiar with at the time, and other, other capabilities like Ray. And It's so, it's able to easily see evidence of something and then immediately try to take advantage of it. So we're not looking at an attacker who has to do recon and then go research how to take advantage of what they saw anymore. They see it and they have the knowledge already. So it's able to, I don't like to say quickly because LLMs are kind of slow in some ways, but it's able to relatively quickly see that something's there and take advantage of it and keep moving throughout the environment. We've seen LLMs pivot through five or six different levels of an environment because it already knows how to do everything. Which is the scary part.

Elliot Volkman: That is. Yeah, that is a very good point. I think the other question that we have is on like the how do we solve for this in our future state? So right now they're sort of bumbling and fumbling through this scenario and they're making a lot of noise. So it obviously draws our attention in. But I'm curious if this goes even well beyond just actor attribution, but like if they are constantly shifting their TTPs, like how do we get to a state where we can get, and I hate using the word predictive, but like essentially trying to get ahead of where they're going based on historical patterns. Do you have a perspective on how organizations should be faring across a moving target, essentially?

Michael Clark: Crystal, I --

Crystal Morin: You just said it right there, historical patterns. A lot of everything that we saw in JADEPUFFER was old news. These are all tactics and techniques that have been seen in previous attacks. There was nothing new or novel here. How it was all piecemealed together was unique. But the vulnerabilities that were used for initial access, one was a year old and was in CISA and should have been patched. Another was, I think, five years old. So again, it's just basic security hygiene. There were default passwords and credentials in there. So we just need to make sure that we're keeping up on basic security practices and implementing those kinds of things, rotating credentials. That's the proactive security that's going to keep us away from these kinds of attacks. Mike and I, after reporting on JADEPUFFER the first time, went through and looked at the timescale for the extortion portion of that first attack. And it was about 30 minutes to attack and destroy the production database, which is pretty quick. But at the same time, if you have the right detection analytics in place, you should be able to detect this attack early enough to the point where you can stop it before at least everything is destroyed. So it's a time scale that we can work with. But like I said, and again, it's just basic security that we're working with here. And we have the agentic tools at our hands too as defenders. The only thing I think working against us is, you know, we have regulations and compliance concerns that we need to deal with. And I think that gives us some hesitancy because we don't want to then get fined for using things inaccurately or, you know, giving our agentic systems too much access. So there are some fine lines that we're still trying to figure out as defenders, but we definitely have all the capabilities to combat these things.

Michael Clark: Defending against the adaptability is tough because it's really you have to secure everything, so that's not very helpful. I would say exposure is becoming more and more important. So understanding your organization's exposure is really the place to start. And as Crystal mentioned, the way CVEs are going, it doesn't really, like the old ways of measuring CVEs and prioritizing them, I don't think really work as well because AI can create exploits very easily. It has been proven many times, and it can change exploits together very easily. So just patching your criticals, you know, that's just not enough. You really have to concentrate on what's exposed and fully secure it. Otherwise, the AI might find a low privileged credential somewhere and then spin that into a high, into access using a low privilege vulnerability. It's, you know, it's very easy for it to do. So that's why I think exposure is important. You need some place to start. And luckily, the tools for exposure are continuing to get better, even though it's still difficult. But that's a good place to start.

Elliot Volkman: Fantastic answers. I appreciate you grounding us in reality because I think the most important thing that we're seeing here is, yes, adaptability is obviously a concern and the speed is very much a concern. But I cannot recall who I'd chatted with at Black Hat, but they positioned this, I think I was calling this what's old is new, but it is a remix of old material. So it's not like they are coming up with new and unique and novel concepts of ways to achieve their goal. They're just, they have an extensive library at their hands, and they will basically just brute force everything until they get their way essentially. But until they get a little bit more clever, fortunately, I think the advice and guidance that you're providing here is exactly what our audience and our practitioners need to continue to harp on. And I think more importantly than ever before is hopefully is both a blessing and a curse is that all organizations, the executives will, they are no longer at an opportunity where they can just treat security as sort of like a cost factory. Like this has to be at the very core at the board level. And we've been arguing this for ages at this point, it feels like, but I think now more than ever, they're going to see evidence of it. So hopefully we are not going to be in a world where it takes a breach for them to react. But I think as more research and stories like this come up, you're exactly right, exposure management and just patching as we need to. Excellent. Michael and Crystal, anything else that you want to add specifically so people can learn a little bit more about your research and findings in JADEPUFFER?

Crystal Morin: I think there's just one more suggestion building off of what Mike had said too, as far as defending against these kinds of things. The scale at which we're working with on the defensive side, our environments are huge with all of the machine identities and AI environments that we're adding. You know, scanning our environments and looking to see what we are securing clearly isn't enough. That's why these gaps exist and these credentials, default credentials are still in existence that have been sitting there for four plus years and haven't been changed. So again, like I said, going back to square one, doing a full evaluation, and I know that sounds tedious, but going through your environment, doing a bill of materials, software bill of materials, an AI bomb, and evaluating everything that you have in your environment. Understanding where it is, what it's connected to. You probably have a lot of AI infrastructure. So what does that contain? What does it have access to? You know, the identities, the data, because all of this stuff is connected. That's going to help you in cases like this as well. Whereas if an attacker gets access to something, you know potentially where that attack chain could lead to. So I think inventory is incredibly significant right now too, when we're looking at combating attacks like this, when they can move so quickly, like Mike said, four or five pivots across an environment within minutes, we need to be able to move and understand our environment that quickly too.

Elliot Volkman: All right. Well, in that case, Michael or Mike and Crystal, thank you all so much for joining us and giving us a little bit more context into your finding with JADEPUFFER. Again, I do feel like this is a really interesting piece of research and I think it's more akin to what we're going to see more prevalently versus some of the maybe rogue models going crazy and getting headlines. So unfortunately, we'll probably see more situations like this, but this appears to be one of the first or is maybe the first documented cases of agents really going end to end with the ransomware situation. So I appreciate you sharing your insights and your findings.

Michael Clark: Thank you for having us.

Crystal Morin: Thank you.