Agentic Ransomware: From Human-Operated to AI-Operated Attacks

Ransomware has always needed a human involved somewhere: an affiliate navigating a network by hand, or at minimum, a person who wrote the script the malware executed. Agentic ransomware breaks that assumption. It describes a ransomware attack where an autonomous AI agent, not a person, makes the operational decisions from the moment it gains access to the moment it demands payment.

We’ve already seen an early version of this in our own investigation into FortiBleed: an affiliate built a 14-agent AI framework that researched vulnerabilities and wrote attack playbooks, then handed the results to human operators to run the intrusion.

In July 2026, security researchers documented the first confirmed case of exactly that: an AI agent running a full extortion campaign end to end, an operation researchers named JADEPUFFER. This piece covers what agentic ransomware actually is, how it evolved out of human-operated and AI-assisted ransomware, why it changes the calculus for defenders, and what organizations can do about it.

Key Takeaways

• Ransomware no longer requires a human operator: Agentic ransomware is a ransomware attack that an autonomous AI agent plans and executes end to end, deciding what to exploit, what to steal, and when to strike, without a person directing each step.
• Two real operations already prove it, in different ways: JADEPUFFER (July 2026) is the first documented case of an AI agent running a complete extortion campaign end to end. FortiBleed’s TOXMAN affiliate had agentic AI embedded in its toolchain even earlier, generating the zero-days, playbooks, and checkers a human crew then used to run intrusions.
• The danger is speed and skill floor, not new techniques: Whether an agent runs the whole attack or just builds the tooling, it can correct a failed step in seconds and turn a few thousand dollars of API credits into capability that used to take a skilled team weeks to build.
• Threat intelligence narrows the window, it does not close it alone: Exposure monitoring, vulnerability intelligence, and Dark Web monitoring help defenders find what agentic ransomware is built to find first, but they work best paired with patching and hardening.
• Defense has to assume machine speed: Mitigations built for human-paced ransomware, like manual patch triage or a slow detection-to-response cycle, are not fast enough against an adversary that self-corrects in under a minute.

What Is Agentic Ransomware?

Agentic ransomware describes a ransomware operation where an AI agent, not a human, makes the operational decisions: what to exploit, which credentials to try, when to pivot, and when to encrypt or destroy data. The agent works in a loop, reading the result of its last action and choosing its next one, without a person approving each step. That loop can cover the same ground a human-operated campaign covers, reconnaissance, exploitation, credential theft, lateral movement, and extortion, but the agent decides the sequence itself and adapts when a step fails.

This is different from ransomware that is merely automated. Commodity ransomware like WannaCry follows a fixed script written in advance. Agentic ransomware follows a goal instead, and the model decides the path to it at runtime. Security researchers use the term agentic threat actor (ATA) for an operator whose attack capability is delivered by an AI agent rather than a human-driven toolkit. JADEPUFFER is the first operation confirmed to meet that definition.

From Human-Operated Ransomware to Agentic Ransomware: How the Threat Evolved

Ransomware has moved through three broad operating models since it became a dedicated criminal industry. Each model changed who, or what, makes the decisions during an attack, and that has consistently mattered more than the malware itself.

The Human-Operated Ransomware Era

Microsoft coined the term human-operated ransomware to describe attacks where a skilled person, not a self-spreading worm, drives every stage of the intrusion. A human operator or affiliate steals credentials, exploits a misconfiguration, escalates privileges, and moves laterally through a network before deploying a ransomware payload, often during a maintenance window chosen to reduce the chance of detection.

This model still dominates ransomware today. Groups such as Conti, Ryuk, and BlackCat built franchise-style Ransomware-as-a-Service (RaaS) programs around it, recruiting affiliates who supply the hands-on-keyboard skill in exchange for a cut of each ransom. The bottleneck in this model is the operator. A human can only run so many intrusions at once, and a tired or careless operator makes mistakes defenders can catch.

AI-Assisted Ransomware: The Middle Step

Between fully human-operated and fully agentic ransomware sits a stage many ransomware crews already occupy. Here, a human still plans and runs the attack but uses an LLM as a tool to speed up parts of it: drafting a more convincing phishing lure, generating a snippet of loader code, or summarizing reconnaissance data. The LLM does not decide what happens next. A person reads its output, decides whether to use it, and directs the next step. This is AI-assisted ransomware, and it describes most of what defenders see in the wild as of early 2026.

Agentic-Integrated Ransomware: Agents Build the Capability, Humans Run the Intrusion

There is a further stage between AI-assisted ransomware and a fully agentic attack, built around a division of labor: AI agents handle the capability-building, humans still run the intrusion. FortiBleed, a credential-harvesting campaign linked to the INC and Lynx ransomware gangs and running since at least February 2026, is the clearest published example. An affiliate known as TOXMAN built PENTEST LAB, a 14-agent framework, and pointed it at capability rather than at victims: hunting zero-days, validating known CVEs, and generating the attack playbook and credential checkers the rest of the group depends on. Named human operators then used that tooling to run the actual intrusions. Call this agentic-integrated ransomware. Agentic AI is embedded in the toolchain, but a human still decides what happens inside a victim’s network.

Agentic Ransomware: When the Agent Runs the Operation

Agentic ransomware removes the person from that loop entirely. The AI agent is given a goal, for example to gain access to a network and extract value from it, along with the tools to pursue that goal: a code execution environment, network access, and the ability to read its own output. From there, the agent plans its own next step, executes it, observes what happened, and adjusts, repeating that cycle for as long as it takes to reach the goal or exhaust its options.

Researchers have already documented an AI agent, JADEPUFFER, running a complete extortion campaign this way, with no evidence of a human reviewing or approving its actions during the operation. The difference from FortiBleed is where the human sits: FortiBleed’s agents built the weapons, while JADEPUFFER’s agent pulled the trigger, planning, executing, and deciding when to extort without a person involved at any stage.

Comparing the Two Models

Why Agentic Ransomware Changes the Threat Model

None of the individual techniques agentic ransomware relies on are new. Exploiting exposed applications, harvesting credentials, and encrypting data are all well-documented. What changes is who is doing the work, and how fast.

Ransomware has always required a skilled human somewhere in the chain. Agentic ransomware breaks that requirement: the skill floor drops to whatever it costs to rent or compromise access to an AI agent, a cost that falls further when that access comes from stolen credentials through a practice known as LLMjacking. That widens the pool of people capable of running a full intrusion-to-extortion campaign well beyond those with hands-on-keyboard skill.

Speed compounds it. JADEPUFFER diagnosed and corrected a failed step in 31 seconds, faster than a human could realistically read an error and write a fix, leaving defenders less time to notice and respond before the destructive phase. One upside: an agent that narrates its reasoning in code comments is, unintentionally, leaving a detection signal a human attacker rarely does.

Defenders are starting to answer that speed with the same kind of autonomy. SOCRadar’s Agentic Threat Intelligence points AI agents at the same continuous reconnaissance, validation, and monitoring work that operations like FortiBleed now automate offensively, aimed at closing exposure before an attacker’s agent finds it.

The Role of Threat Intelligence in Preventing Agentic Ransomware Attacks

Threat intelligence does not stop a ransomware attack by itself, and no vendor should claim otherwise. What it does is close the specific gaps agentic ransomware is built to find fastest, before an agent finds them first. In addition to Agentic Threat Intelligence, several core SOCRadar capabilities specifically target the security exposures that autonomous ransomware attempts to leverage:

• Attack Surface Management: Continuously discovers internet-facing assets, including AI orchestration tools and admin panels, so an exposed and unpatched system gets flagged before an agent finds it.
• Cyber Threat Intelligence: Tracks actively exploited vulnerabilities against their Known Exploited Vulnerabilities (KEV) status, helping teams prioritize patches on the flaws attackers are already automating.
• Advanced Dark Web Monitoring: Surfaces chatter around LLMjacking, agentic tooling built for offensive use, and access-for-sale listings before they turn into a campaign.

Mitigation and Defense Recommendations Against Agentic Ransomware

• Inventory and patch AI-adjacent infrastructure first: Treat any AI orchestration platform, LLM tooling server, or agent framework as a Tier-1 asset in vulnerability management. These systems are new, often unmanaged, and increasingly the first thing agentic ransomware operators look for.
• Take code-execution and admin endpoints off the public internet: Any endpoint capable of executing code, validating scripts, or administering a service should require authentication and should not be reachable from the open internet, regardless of how the vendor ships it by default.
• Scope secrets away from web-reachable hosts: Move API keys, cloud credentials, and database secrets into a dedicated secrets manager rather than environment variables or configuration files a compromised web process can read.
• Eliminate default credentials everywhere, not just on flagship systems: Object storage, configuration platforms, and internal admin tools shipped with factory default credentials are exactly what an autonomous agent is built to find and use. Audit for them as a standing control, not a one-time setup step.
• Restrict administrative access to databases and configuration services: Never expose a root or admin account to the internet, and enforce unique credentials and source-IP restrictions on management interfaces.
• Apply egress controls: Prevent a compromised host from beaconing to arbitrary external destinations or reaching downstream systems it has no legitimate reason to contact.
• Tune detection for agent-driven behavior, not just known malware: Watch for high-frequency, self-correcting command sequences, unusual read or write probes against sensitive services, and scheduled tasks that beacon on short, fixed intervals, patterns that look more like automation than a human typing.
• Extend backups to AI and ML artifacts: Maintain offline, immutable backups that explicitly cover model checkpoints, vector databases, and training data, not only structured databases and file shares. These assets are often impossible to recreate quickly if destroyed.
• Track exploitation status continuously, not just CVSS scores: Prioritize patching based on confirmed in-the-wild exploitation, since the window between disclosure and automated, agent-driven exploitation is compressing across the industry.
• Plan incident response for machine-speed adversaries: Build runbooks that assume an attacker can move from initial access to destruction in hours, not days, and rehearse them accordingly.

For a closer look at securing autonomous AI infrastructure, explore SOCRadar University’s free course, Top 10 Lessons Learned Building AI Agents for Cyber Defense. It covers agent vulnerabilities, exposed credentials, prompt injection, and security controls that help teams manage these risks.

Case Study: FortiBleed, Agentic AI Inside a Live Ransomware Supply Chain

FortiBleed is the earlier of the two real-world cases covered in this article: an active operation with agentic AI built into its toolchain months before an agent ran a full attack on its own.

A Credential-Harvesting Operation at Scale

SOCRadar first disclosed FortiBleed in June 2026, after discovering the attacker’s operational server during routine infrastructure monitoring. The campaign has been running since at least February 2026, using reused and leaked credentials to compromise internet-facing Fortinet FortiGate firewalls and SSL VPN gateways at scale. SOCRadar’s verified database now covers more than 86,644 devices across 194 countries, the most extensive figure of any research team tracking the campaign.

From Credential Theft to Ransomware

Credential harvesting alone does not make FortiBleed a ransomware story. SOCRadar’s investigation found a single operator logged into both the INC Ransom and Lynx ransomware negotiation panels using infrastructure traceable back to FortiBleed, direct evidence that the stolen FortiGate access was being handed off, or used directly, for ransomware deployment. That link, confirmed through infrastructure analysis and victim overlap between the two datasets, is what connects a firewall credential dump to the broader ransomware economy.

How SOCRadar Uncovered TOXMAN’s Agentic AI Framework

Digging further into the operator’s infrastructure, SOCRadar’s follow-up investigation found agentic AI embedded deep in the operation. An affiliate known as TOXMAN had built PENTEST LAB, a 14-agent Docker-based framework coordinated through OpenRouter and armed with tools including nuclei, ffuf, and sqlmap, burning roughly $4,554 in API credits across paid Claude and DeepSeek access. The agents hunted zero-days in platforms such as Nextcloud, validated known CVEs across Fortinet, Active Directory, and ESXi, and generated the FortiGate takeover playbook and credential checkers the rest of the group still relies on. TOXMAN reportedly sourced jailbreaks from Exploit.in to get the agents past model refusals.

None of that touched a victim directly. Inside actual networks, named human operators tracked in the group’s own spreadsheet handled the VPN pivots, domain admin paths, and ransomware deployment. That is agentic-integrated ransomware rather than fully agentic ransomware, but it is a live example of AI doing the capability-building work months before JADEPUFFER showed an agent could run the whole attack by itself.

Case Study: JADEPUFFER, Fully Agentic Ransomware Attack

Where FortiBleed shows agents building the capability, JADEPUFFER shows an agent running the whole attack. The clearest illustration of that comes from Sysdig’s Threat Research Team, which published its findings on July 1, 2026. The team assessed with high confidence that the operation, which it named JADEPUFFER (also stylized as JadePuffer in press coverage), was driven end to end by a large language model (LLM), based on four independent lines of behavioral evidence detailed below. The campaign ran as a database extortion operation before evolving into an attack built to destroy AI models, and this section walks through both.

Phase 1: Breaking Into Langflow

Langflow is an open-source framework for building LLM-driven applications and agent workflows. CVE-2025-3248 is a missing-authentication flaw in its code validation endpoint that lets an unauthenticated attacker run arbitrary Python on the host. The vendor patched it on April 1, 2025, and CISA added it to its KEV catalog on May 5, 2025, yet exposed, unpatched instances remain common.

JADEPUFFER delivered its payloads as Base64-encoded Python through this endpoint. It enumerated the host, then swept the environment for LLM provider API keys, cloud credentials, wallet seed phrases, and database configuration files, dumping Langflow’s own Postgres database for more. It found an exposed MinIO endpoint still using its default credentials, pulled a stored credentials file from an internal bucket, and installed a crontab entry beaconing to attacker infrastructure every 30 minutes for persistence.

Phase 2: Pivoting to the Real Target

Artifacts on the Langflow host pointed to the real target: a separate, internet-exposed server running MySQL and Alibaba Nacos, a service-discovery and configuration platform. The agent connected using root credentials of unknown origin, then attacked Nacos on multiple fronts at once, exploiting a known 2021 authentication bypass, forging a token with Nacos’s public default signing key, and inserting a backdoor admin account directly into its database. A failed login was corrected within 31 seconds, complete with a fresh password hash and a working fix, no human involved.

After probing for a container escape through the Docker socket, the agent encrypted 1,342 Nacos configuration records with MySQL’s AES_ENCRYPT function, dropped the original tables, and left a ransom note naming a Bitcoin address and a Proton Mail contact. It then escalated to dropping entire database schemas, narrating in code comments which ones it judged most valuable before deleting them.

How Researchers Concluded an AI Agent Was Driving the Attack

Sysdig based its assessment on four lines of evidence: self-narrating payloads with natural-language comments explaining each action, a pace of failure diagnosis and correction far faster than a human could manage, comprehension of planted natural-language context across sessions weeks apart, and more than 600 distinct, purposeful payloads executed in a compressed window.

One detail remains unresolved. The ransom note’s Bitcoin address is the canonical example address from Bitcoin’s own developer documentation, yet it is also a real, active wallet with a long transaction history. Sysdig could not determine whether the model hallucinated a familiar address from training data or the operator used a real wallet that happens to match it.

The Attack Escalates: ENCFORGE Targets AI Models

JADEPUFFER did not stop there. On July 20, 2026, Sysdig reported that the same operator had returned to the same Langflow instance with an upgraded toolkit, escalating through an exposed Docker socket to root-equivalent access and deploying a new locker, ENCFORGE.

ENCFORGE targets roughly 180 file extensions across the AI and ML stack: model checkpoints, vector databases, training data, and embedding indices. Sysdig estimates rebuilding a single destroyed model can cost $75,000 to $500,000. Unlike the first campaign, this one skipped data exfiltration and the leak-site threat entirely. It was destruction-first, aimed at infrastructure that often cannot be restored from a routine backup.

Conclusion

Ransomware has moved from a craft that required a skilled human at every stage, to a service that let human operators buy their way into that skill, to an autonomous operation that increasingly doesn’t need a human at all. The techniques haven’t changed nearly as much as who, or what, is deciding to use them.

FortiBleed and JADEPUFFER are the two clearest proof points we’ve tracked so far, and they won’t be the last. One is a documented operation that used agentic AI to build attack capability at a fraction of the cost and time a human research team would need. The other is a documented attack that exploited an ordinary, already-patched vulnerability and ran to completion faster than most organizations could have investigated the first alert. The lesson is that defenses built around human-paced assumptions, like a patch cycle measured in weeks or an incident response plan that assumes hours to escalate, are no longer matched to the adversary they’re meant to stop.

Treat AI-adjacent infrastructure as seriously as the core network, close exposure before an agent finds it, and rehearse response at machine speed. That’s the shift worth making now, before the next agentic ransomware operator forces the issue.

MITRE ATT&CK Mapping

The table below maps techniques characteristic of agentic ransomware as a category.

Indicators of Compromise: FortiBleed

Indicators of Compromise: JADEPUFFER

The following indicators are drawn from Sysdig’s published research.

Frequently Asked Questions

What Is Agentic Ransomware?

Agentic ransomware is a ransomware operation planned and carried out end to end by an autonomous AI agent rather than a human operator or a fixed script. The agent independently performs reconnaissance, exploitation, lateral movement, and encryption or destruction, adapting to failures without a person directing each step.

How Is Agentic Ransomware Different From Human-Operated Ransomware?

Human-operated ransomware relies on a skilled operator or affiliate manually navigating a network, while agentic ransomware delegates that decision-making to an AI agent. The agent can diagnose and correct a failed step in seconds, which lowers both the skill and the time required to run a full extortion campaign.

What Was the First Documented Agentic Ransomware Attack?

Cloud security firm Sysdig documented the first known fully autonomous agentic ransomware attack in July 2026, naming the operator JADEPUFFER, whose AI agent ran the entire intrusion and extortion chain with no human involved. FortiBleed’s TOXMAN affiliate had agentic AI embedded in its toolchain even earlier, though building attack capability rather than running the intrusion itself.

Can Threat Intelligence Prevent Ransomware Attacks?

Threat intelligence cannot guarantee prevention, but it substantially reduces the odds a ransomware operation succeeds. Exposure monitoring flags internet-facing systems before attackers find them, vulnerability intelligence prioritizes patches on actively exploited flaws, and Dark Web monitoring surfaces the access sales and tooling chatter that precede an attack.

How Can Organizations Defend Against Agentic Ransomware?

Organizations should patch and restrict internet exposure on AI tooling and orchestration servers, scope secrets away from web-reachable hosts, replace default credentials on object storage and configuration platforms, apply egress controls, and maintain offline backups that cover AI and ML artifacts, not only databases and files.

Is Agentic Ransomware More Dangerous Than Traditional Ransomware?

Agentic ransomware is not more technically sophisticated, since it relies on known vulnerabilities and techniques, but it is more dangerous operationally. An AI agent removes the skill barrier and can execute an entire attack chain in hours instead of days, giving defenders less time to detect and respond.