The ‘first’ AI-run ransomware attack still needed a human

Last week, researchers astatine unreality information steadfast Sysdig said they’d documented the archetypal known lawsuit of “agentic ransomware.” It was an extortion operation, dubbed JadePuffer, successful which an AI cause — not a quality — handled the method execution of a real-world cyberattack from commencement to finish. The cause broke into a susceptible server, stole credentials, moved done the target’s network, encrypted files, and adjacent wrote its ain ransom note, adapting to obstacles on the mode similar a quality hacker would. Coverage of the backing described it arsenic tally “without immoderate quality oversight,” with “no quality astatine the keyboard.”

That’s not rather the full picture. In an interview connected Monday with CyberScoop, Sysdig’s Michael Clark, the company’s elder manager of menace research, clarified that a quality was inactive precise overmuch progressive — conscionable not successful the method execution. “A quality inactive acceptable up and pointed the cognition and provisioned the infrastructure down it, the command-and-control server, the staging server utilized for the stolen information and chose a victim,” Clark said. The credentials utilized to interruption into the victim’s database, helium added, weren’t harvested by the AI cause itself; idiosyncratic obtained them separately, done a anterior compromise, and handed them to the operation.

None of this contradicts Sysdig’s archetypal claim, and the method details of the onslaught stay notable connected their ain — wild, even. The cause got successful done a known bug successful Langflow, a fashionable open-source instrumentality for gathering LLM apps, past moved connected to a accumulation MySQL server and exploited different known flaw to summation admin access. It encrypted implicit 1,300 configuration records and not lone near down a ransom enactment that it wrote itself but it near a Bitcoin code wherever the ransom could beryllium sent. Sysdig hasn’t disclosed who was targeted.

The techniques were reasonably mean apparently, what stood retired was the velocity and transparency involved. The cause fixed a failed login successful 31 seconds, narrating its ain reasoning successful natural-language codification comments the full way.

One item that initially seemed to muddy the representation has since been clarified. Clark had told CyberScoop that Sysdig recovered “multiple models were utilized successful the attack,” citing harvested keys for OpenAI, Anthropic, DeepSeek, and Gemini — connection that near unfastened the question of whether respective models actively powered antithetic stages of the intrusion. Asked to clarify, Clark told TechCrunch that those keys were simply portion of what the cause stole, not grounds of what was driving it.

“The cause swept the Langflow big for thing invaluable — supplier API keys, unreality credentials, cryptocurrency wallets, and database configs — and those supplier keys were portion of the loot,” helium said via email. “They are indicative of what the attacker considered worthy taking, but they bash not archer america which exemplary was making the decisions.”

On the exemplary really moving JadePuffer, Clark said Sysdig “was not capable to place the circumstantial exemplary driving the agent” and has nary visibility into its strategy punctual oregon configuration.

Microsoft researcher Geoff McDonald’s theory, offered connected LinkedIn respective days ago, is worthy revisiting successful that light. McDonald suspected an open-weight exemplary with information grooming stripped out, alternatively than a frontier model, was down the attack, based connected his ain red-teaming acquisition showing frontier labs’ information layers clasp up well. Sysdig’s ain relationship doesn’t corroborate oregon regularisation that out.

McDonald’s station besides warned that ransomware campaigns are present bounded chiefly by attacker fund alternatively than quality effort, raising the anticipation of “thousands oregon tens of thousands of simultaneous campaigns.” That interest is simply a small harder to quadrate with what Clark described Monday. (If a quality inactive has to take each victim, proviso infrastructure, and get database credentials for each operation, that’s a spot of a bottleneck, astatine least.)

Either way, Clark told CyberScoop, portion Sysdig hasn’t seen the aforesaid cognition deed different victims yet, fixed however inexpensive it is to tally an agent, helium expects that to change.