Agentic AI ransomware — the containment playbook when the attacker is a model

Use this playbook when you have evidence — or strong suspicion — that an attack chain is being driven by an autonomous agent rather than a hands-on-keyboard operator. Signals that point this way:

• Attack stages advancing faster than a human console operator could type them, with sub-minute transitions between recon, credential use, and lateral movement.
• Failed actions re-attempted with refined parameters within seconds (JADEPUFFER self-corrected a failed Nacos login in 31 seconds), rather than the minutes-to-hours a human takes to notice and adjust.
• Initial access through an AI/LLM-adjacent service — the JADEPUFFER intrusion began at an unauthenticated Langflow code-validation endpoint (CVE-2025-3248, CVSS 9.8), now on the CISA KEV catalog.
• Breadth of parallel activity — simultaneous credential sweeps across cloud, database and object-storage services — that a single human would sequence.

Do NOT use this playbook for classic human-operated ransomware (use your standard IR runbook), for commodity auto-spreading worms (deterministic, not adaptive), or for a suspected agent compromise with no ransomware or destruction objective (that is an agent-governance incident, not this one). The distinguishing feature here is an adversary that reasons and adapts inside your network at machine speed.

Every human-oriented IR plan carries an implicit assumption: there is dwell time. The attacker breaches, then pauses — to orient, to pull tools, to decide the next move. Those pauses are your interruption windows. Against an agent they collapse.

The JADEPUFFER operation documented by Sysdig ran the full chain — reconnaissance, credential harvesting, exfiltration, lateral movement to a production MySQL server and a Nacos config service, privilege escalation, a backdoor admin account, a crontab beacon, and AES encryption of 1,342 configuration items — with no human in the loop (independent coverage, The Hacker News). The tell was speed: a failed login diagnosed and retried in 31 seconds.

What this changes operationally:

• There is no "contain by end of shift". The window between first detection signal and irreversible encryption is minutes at most.
• Manual approval gates become the bottleneck that loses. If isolating a host or revoking a token needs a ticket and a change-approval, the agent finishes first.
• The agent reacts to you. Partial containment — blocking one path — prompts it to try another. Half-measures leak signal and teach it your defence. Contain completely or not at all.

You will not win this at 03:00 by out-typing a model. The decisive work happens before, by making a single RCE unable to become a database-wide event. Do this now:

• Inventory the AI-adjacent attack surface. Every LLM framework, agent runtime, MCP server, orchestration tool and no-code AI builder (Langflow, Nacos, MinIO and equivalents) is initial-access surface. Patch to current, put them behind authentication, and take them off any internet-reachable path they do not need.
• Scope every non-human identity. The service account behind an agent or app should reach exactly the data it needs and nothing else. JADEPUFFER's damage came from one foothold whose reachable credentials opened cloud, database and object storage. Least-privilege per identity is the blast-radius cap.
• Kill default and shared credentials. The chain pivoted via default MinIO credentials and a Nacos auth bypass. Enumerate and remove defaults; unique secret per service.
• Pre-authorise the kill. Decide, in advance and in writing, who can isolate a host, disable an account and revoke a token bank without a change-approval meeting. Automate it where you can — the response has to move at machine speed.
• Segment so encryption cannot fan out. Flat networks let one compromised host reach every share. Segmentation turns a total loss into a contained one.

When the chain is live, you are racing the agent. Priorities, in order:

1. Cut the foothold's reach, not just the foothold. Isolate the compromised host at the network layer AND immediately revoke every credential that host could have read — not the ones you have confirmed stolen, all of them. Assume harvest is complete.
2. Mass-rotate, do not investigate first. API keys (cloud, and any LLM-provider keys the agent could resell or reuse), database passwords, object-storage keys, service tokens. Rotation is cheaper than the encryption you are trying to prevent.
3. Freeze the identity plane. Disable the service account behind the foothold and any account it authenticated as. If a backdoor admin has already been injected, freezing the plane limits its use.
4. Block egress. The same event exfiltrates before it encrypts. Cut outbound to unknown destinations to cap data loss even if encryption is already underway.

A checklist to keep at the console:

• [ ] Compromised host network-isolated
• [ ] All credentials reachable from that host revoked/rotated
• [ ] LLM-provider and cloud API keys rotated
• [ ] Service account(s) disabled
• [ ] Outbound egress to unknown ASNs blocked
• [ ] Backup integrity confirmed and backups taken offline

Once the chain is stopped, eradicate on the assumption that an adaptive adversary planted more than one way back:

• Hunt agent-style persistence, not just files. JADEPUFFER injected a backdoor admin account directly into a database and installed a crontab beacon. Audit database privilege tables and admin rows, scheduled tasks (cron, systemd timers, Windows scheduled tasks), and config-service entries — not only the filesystem for dropped binaries.
• Rebuild the foothold from a clean base. Do not clean-in-place a host an agent had code execution on. Rebuild from a known-good image, patch the entry vulnerability, and restore data from a backup predating the intrusion.
• Reconcile every credential. Any secret reachable during the incident stays rotated. Reissue, do not restore, tokens.
• Verify the encryption blast radius. Enumerate what was actually encrypted or dropped (JADEPUFFER dropped original tables and destroyed databases after encrypting) and restore from offline backups, confirming integrity before returning to production.

Preserve, timestamped and with chain-of-custody, before you rebuild anything:

• The compressed attack timeline — first signal to encryption — with original timestamps. The sub-minute cadence is itself evidence of automation and belongs in the regulator filing.
• Full command and API-call history from the compromised host and the agent's entry service.
• The credential-exposure list: every secret reachable from the foothold, marked rotated with time.
• Persistence artefacts: the injected admin row, the crontab beacon, any config-service changes.
• Exfiltration evidence: outbound sessions, volumes, destinations.
• TTPs mapped in both MITRE ATT&CK and MITRE ATLAS — ATLAS is the adversarial-AI matrix regulators and insurers will increasingly expect for an AI-driven incident.

The hard part is that most of this is generated in the seconds the agent is active — there is no time to assemble it by hand mid-incident. This is where continuous, wire-speed traffic recording earns its place: Zero Hunt's on-appliance AI Traffic Analysis model — four parallel inference heads (suspicious traffic, malware classification, attack-type identification, application fingerprinting), trained on billions of PCAP sequences and running locally on the appliance GPU — captures the lateral fan-out, the credential sweeps and the egress as they happen, so the timeline and IOC set already exist by the time you file, instead of being reconstructed from a next-morning SIEM digest.

Anti-patterns that get organisations encrypted, drawn from human-tuned response meeting a machine adversary:

• Investigate-then-contain. The instinct to scope precisely before acting is correct against a human and fatal against an agent. Contain wide first; narrow later.
• Approval-gated response. A revoke-token action that needs a change ticket runs slower than the attack. Pre-authorise and automate the destructive containment actions.
• Partial containment. Blocking one path teaches an adaptive adversary to take another. Isolate completely; do not negotiate with a control loop.
• Detection that reports, not reacts. A SIEM that surfaces the incident in the morning digest is a post-mortem tool, not a containment control, against a 31-second agent. The only detection fast enough is behavioural and wire-speed: the traffic signature of in-progress encryption (rapid SMB/NFS write bursts, predictable lateral fan-out, preceded by privilege-escalation traffic) is visible during the encryption phase, before files are fully locked — exactly the window an agent compresses. That behavioural mid-chain flag is what lets an automated kill fire in time.
• Trusting patch state over reachability. You may patch the entry CVE and still lose, because the harvested credentials outlive the vulnerability. Rotate on the assumption of full compromise.

An AI-driven attack does not change your notification duties — it changes the content. Key points:

• The clock is unchanged. Under NIS2 (and its Italian transposition, d.lgs. 138/2024) the significant-incident early warning is due within 24 hours and the notification within 72; under DORA the major-incident gates are 4h / 72h / 1 month. See the NIS2 Title 13 timeline playbook for the cadence.
• Classify it as intentional and automated. The notification asks whether the incident was intentional; an autonomous-agent attack is, and the automation is materially relevant to impact assessment and to the sector CSIRT's threat picture.
• Cite ATLAS, not only ATT&CK. Regulators, ENISA and insurers are building AI-incident expectations around the adversarial-AI taxonomy; mapping the chain in MITRE ATLAS alongside ATT&CK makes the filing defensible.
• Expect the "was AI involved" question from insurers. Cyber-insurance questionnaires are adding autonomous-attack and AI-exposure items; the evidence pack you built above answers them directly.