Two Robberies, One Warning
A 2024 deepfake heist and a 2026 AI-aided ransom, two years apart, expose the same root cause — and the boring fixes that would have stopped both.
In 2024, AI impersonated trusted humans to defeat a control process. By 2026, an AI agent ran the whole intrusion on its own.
The Puppet Show
Engineering firm: Arup
A finance employee in Arup’s Hong Kong office got a phishing email “from the CFO” about a confidential transfer. He was suspicious — good instinct. So he asked for a video call to confirm.
On the call, the CFO and several colleagues looked and sounded right. Every one of them was an AI deepfake built from public footage and voice of CFO. The live, multi-person call overrode his doubt. He made 15 transfers to five accounts. No system was hacked — the target was human trust.
The Robot Burglar
Flagged by threat researchers as JadePuffer
Sysdig documented what they call the first end-to-end agentic ransomware: an LLM agent that chained recon, credential reuse, lateral movement, persistence, privilege escalation and destruction — narrating its own reasoning the whole way.
Entry via CVE-2025-3248 (Langflow unauth RCE), pivot to a MySQL/Nacos box via CVE-2021-29441. It encrypted 1,342
config items and dropped a README_RANSOM table. When a login failed, it fixed itself and retried in 31 seconds.
A human still chose the victim — but the skill floor collapsed to “the cost of running an agent.”
The point of all this
Two years apart, the same mistake only repeats. Arup went after human judgment; JadePuffer went after human speed. Different layer of the stack, one root cause, no process checks.
What bothers me isn’t the sophistication — it’s the lack of it. Neither attack needed a novel exploit. Arup weaponized social engineering as old as the con itself. JadePuffer chained a publicly-known Langflow CVE, a leftover root credential, and an internet-exposed config store. Old holes, walked through at machine speed.
The two defenses split cleanly. Against deepfakes, human process still wins: out-of-band verification, dual approval, a mandatory delay on high-value moves. You cannot out-vibe a fake face — but you can refuse to act on a single channel.
Against an agent that recovers from a failed login in 31 seconds, human vigilance loses. Here the answer is unglamorous engineering: patch known CVEs, never expose config stores, kill default and static credentials, scope and rotate secrets, and move to just-in-time access measured in minutes. Then instrument for machine-speed behavior instead of periodic snapshots.
AI didn’t invent the intrusion. It removed the cost — and the skill floor — of running one.
The optimistic reading: every fix on the list already existed before either attack. We don’t need new magic. We need to actually do the boring things, before the next operator — human or not — shows up.
Inside the JadePuffer kill chain
No zero-days, no genius — just a sequence any penetration tester would recognise, run start to finish by software. If you’re newer to security, here’s each step in plain terms. (First, jargon: a CVE is just a public ID for a known, already-published security bug — think of it as a numbered entry in a global catalogue of “known unlocked doors.” The fix usually exists before the CVE is even public.)
- Break in — initial access. The agent found a machine on the public internet running Langflow (a tool for
building AI workflows) with the bug
CVE-2025-3248. That bug is an unauthenticated remote code execution (RCE): “unauthenticated” means no login needed, and “remote code execution” means an outsider can make the server run commands of their choosing. So the agent simply told the server to run its code. No password, no phishing — the door was already unlocked and listed in the catalogue. - Look around — reconnaissance. Once inside, it did recon: mapping what else it could reach from that machine — other servers, databases, internal services. It found a Nacos box. (Nacos is a configuration and service-registry server: the place apps look up their settings and find each other.) That’s a prize — it’s the building’s directory and key cabinet in one.
- Reuse a key — credential access. Rather than crack a password, it used one that was already lying around, via
CVE-2021-29441(a Nacos authentication-bypass bug). Credentials are just the usernames, passwords, keys, and tokens that prove who you are. A static or leftover credential is one that never changes and got forgotten — a spare key left under the mat. It walked straight in. - Move sideways — lateral movement. Lateral movement is hopping from the first machine you landed on to others, widening your foothold. It moved from the Langflow box to the config store — same building, more rooms.
- Dig in — persistence. Persistence means setting things up so you survive a reboot or a logout: a scheduled task, a new account, a hidden backdoor. Restart the server and the intruder is still there, because it planted a way back in.
- Climb — privilege escalation. Privilege escalation is going from a low-power account to an admin (or “root”) one that can do anything. The higher it climbs, the more it can read, change, or destroy. It climbed until nothing was off-limits.
- Detonate — impact. With full control, it encrypted 1,342 configuration items — scrambling them so only the
attacker’s key can restore them — and dropped a ransom note (a
README_RANSOMentry) demanding payment. The telling part: when a login attempt failed, it didn’t stall or wait for a human. It read the error, adjusted, and retried about 31 seconds later. Nobody was at the keyboard.
Every step was a documented, fixable weakness — a published CVE, a forgotten credential, a service that shouldn’t have faced the internet. None of it was new. The only new ingredient was the operator: an agent that never tired, never fat-fingered, and fixed its own mistakes on the fly.
Why “spray-and-pray” is nearly free now
For decades the attacker’s bottleneck was human time. A skilled operator has only so many hours, so they hand-pick targets worth the effort — big names, fat accounts. Attacks didn’t scale, and “too small to bother with” was a genuine defense.
An agent breaks that math. It reasons, recovers from its own errors, and runs around the clock for roughly the price of API tokens. Point it at ten thousand hosts in parallel and the cost per victim falls toward zero. You no longer need to be a lucrative target — if you have a known hole and a stale credential, you’re worth hitting because hitting you is almost free.
When the attacker’s time costs nothing, being “too small to target” stops being a strategy.
Patch & credential hygiene for the agent era
Against a sprayed agent, human vigilance can’t keep up — but the agent is only as good as the holes it finds. Close them and it moves on to an easier target. Track your coverage:
What a sprayed agent trips on — no known hole, no spare key, no easy win.
AI is a tool, and tools don’t have intentions — operators do.
The real threat is the checks we skip and the time we don’t take — Arup had time for one out-of-band call and trusted the screen instead, and rotated credentials would have tripped JadePuffer long before it finished.
Sources
- Arup deepfake (Jan 2024) — Hong Kong Police / CNN / Fortune reporting.
- JadePuffer agentic ransomware (Jun–Jul 2026) — Sysdig Threat Research.
An opinion piece — figures as publicly reported at time of writing.