Poisoned Vector: JADEPUFFER and Using Unauthenticated Chroma Databases for Retrieval Extortion

UpGuard Research has discovered the first documented AI-retrieval-stack extortion, seemingly conducted by the JADEPUFFER threat actor known for its use of agentic AI. Attackers exploited unauthenticated Chroma databases to create ransom notes that would be displayed to users when the RAG databases were queried for information. 

Sysdig first reported on this threat actor in July when they detected JADEPUFFER exploiting vulnerable Langflow instances. To our knowledge, this is the first case of any threat actor exploiting unauthenticated Chroma databases, and a novel observation of JADEPUFFER’s TTPs. This finding helps expand our understanding of JADEPUFFER’s behavior and validates concerns about poorly secured AI technologies exposed to the internet. 

Background

On July 1, the Sysdig Threat Research Team disclosed their discovery of the threat actor “JADEPUFFER.” What made this campaign novel was its use of autonomous agentic AI, evidenced by chain of thought reasoning visible on the victim systems and the rapid iteration of code-based techniques. At the time, Sysdig wrote that Langflow vulnerability CVE-2025-3248 “has been JADEPUFFER's persistent entry vector across all documented campaigns so far.”

On September 25 Microsoft disclosed that they had observed attacks from JADEPUFFER, tracked by Microsoft as Storm-3168, in early June. Microsoft documented JADEPUFFER targeting Azure using compromised credentials, attempting to extract more, and ending with destruction: “Our investigation found an extensive Azure-focused resource destruction activity using compromised service principals and cloud credential collection that could be used to facilitate future exfiltration.” This attack pattern was quite different from exploiting CVE-2025-3248, showing that JADEPUFFER’s TTPs were flexible and evolving. 

Early June Reconnaissance

On October 5, the UpGuard Research team identified 6 IP addresses hosting Chroma databases without authentication and bearing evidence of ransom activity from a threat actor using the JADEPUFFER name. Examining the data from these databases showed that the attack had been conducted in two phases: reconnaissance in early June and ransoming in the middle of July. 

Two of the six database contained collections named probe-base-<id> where the <id> could be decoded as a 19 digit Unix time stamp, like what would be generated by Python's time.time_ns(). 

probe-base-1780358616093663300  →  2026-06-02 00:03:36.093663 UTC

probe-base-1780358612181549300  →  2026-06-02 00:03:32.181549 UTC

While these numbers could signify anything, and the attacker could have set them to any value, interpreting them as time stamps aligns with Microsoft’s reported observation of JADEPUFFER activity in early June. 

Mid-July ransom attack

Timestamps included as the first part of a Fernet token for ransomed documents in one of the databases indicate when a second wave of campaign happened. For each of the 50 encrypted documents, the timestamp bytes decode to 1783810896 unix seconds, or 2026-07-11 23:01:36 UTC. 

A July wave of attacks on previously probed systems aligns with other knowledge of JADEPUFFER activity. This activity follows soon after Sysdig’s detection, and like the July attacks on Langflow systems, represents an escalation from the June recon activity. 

Varieties of attack behavior

The indicators of timing are sparse: two of six databases had recon collections and one had encrypted documents with timestamps in the Fernet tokens. Inconsistent naming conventions in the vandalized tables suggest a threat actor figuring it out on the fly, and repetitions in table names could be from the same renaming script running more than once. 

While there are no chain of thought logs, the per-host differences in compromise tactics could be evidence of an AI system testing and adapting to different conditions. The below list of database names illustrates the variety of evolving TTPs across this cohort. 

Ransom note

The contents of the ransom notes were as follows:

⚠️⚠️⚠️ JADEPUFFER RANSOMWARE ⚠️⚠️⚠️

Your ChromaDB vector database has been compromised.

WHAT HAPPENED:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

• ChromaDB poisoned with ransomware embeddings

• RAG system contaminated before production data load

• No authentication enabled (CVE exposure)

BUSINESS IMPACT:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

• AI chatbot will return ransom notes instead of real answers

• Customer queries retrieve malicious content

• Brand reputation damage

TO RESTORE YOUR SYSTEM:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. Pay $2,500 USD in BTC to: bc1qjc3mdcdyj082ffr2wvc80mz8axqd53r7suynxs

2. Email transaction ID to: jadepuffer@protonmail.com

3. Receive cleanup script + auth config within 24h

DEADLINE: 7 days from infection

AFTER DEADLINE: Price doubles + disclosure

VULNERABILITIES EXPLOITED:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

• No authentication (user_id = "")

• Unauth write access (collections/add)

• Preemptive poisoning (contaminated before data load)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

        ><(((º> JADEPUFFER <º)))><

    Vector Database Ransomware - Global Fleet

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Prior UpGuard research on exposed Chroma databases

This attack pattern is exactly what UpGuard Research predicted a year ago when we first surveyed internet-exposed Chroma databases. At the time there were 1,170 accessible databases, about a third of which lacked authentication. Per the ransom note left in these databases, that is the vector used by the attacker here. 

The “embedding poisoning” attack is also a logical way to exploit a writeable vector database we discussed at the time. “Simply accessing the available data is just one concern. Another would be that a malicious user could alter or poison the data available to a chatbot. It's easy to imagine a number of situations in which a production chatbot with an unauthed and open ChromaDB instance could deliver incorrect or even dangerous information to a chatbot user.”

JADEPUFFER appears to have arrived at the same conclusion. While some of the collections were named as ransom notes, those named Production_rag_data-2 were attempting to impersonate production RAG databases so that the notes would be retrieved at runtime and displayed to users. 

Conclusion

AI systems have introduced many new attack surfaces, from prompt injection to misconfigured MCPs to brand impersonation. Writable vector databases used for RAG systems offer yet another path for attackers to turn a vulnerability into an opportunity for extortion. The theoretical risk was easy to foresee; now we have confirmation that threat actors, whose campaigns are already evolving at the speed of agentic AI, will seize upon this possibility when presented to them. 

It is possible that the JADEPUFFER branding on these attacks was placed after the Sysdig report by a separate group, but the creative tactics here are align with their other observed behavior. The two previously reported attacks use diverse TTPs– stolen credentials and software vulnerabiltiies, Azure resources and Langflow instances–and targeting unauthenticated Chroma databases would be consistent with their observed fluency in risks associated with new AI-supportive technologies. UpGuard Research has previously documented the exposure risks of many similar products – Llama Index, llama.cpp, Flowise, Streamlit, and ComfyUI – which may eventually fall within the sites of attackers, too.