[Breaches](/breaches)

Poisoned Vector: JADEPUFFER and Using Unauthenticated Chroma Databases for Retrieval Extortion

[Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news)

# Poisoned Vector: JADEPUFFER and Using Unauthenticated Chroma Databases for Retrieval Extortion

##### [Greg Pollock](/team/greg-pollock)

Published Oct 14, 2026

##### Join 27,000+ cybersecurity newsletter subscribers

UpGuard Research has discovered the first documented AI-retrieval-stack extortion, seemingly conducted by the JADEPUFFER threat actor known for its use of agentic AI. Attackers exploited unauthenticated Chroma databases to create ransom notes that would be displayed to users when the RAG databases were queried for information. 

Sysdig first reported on this threat actor in July when they detected JADEPUFFER exploiting vulnerable Langflow instances. To our knowledge, this is the first case of any threat actor exploiting unauthenticated Chroma databases, and a novel observation of JADEPUFFER’s TTPs. This finding helps expand our understanding of JADEPUFFER’s behavior and validates concerns about poorly secured AI technologies exposed to the internet. 

## Background

On July 1, the [Sysdig Threat Research Team](https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion) disclosed their discovery of the threat actor “JADEPUFFER.” What made this campaign novel was its use of autonomous agentic AI, evidenced by chain of thought reasoning visible on the victim systems and the rapid iteration of code-based techniques. At the time, Sysdig wrote that Langflow vulnerability CVE-2025-3248 “has been JADEPUFFER's persistent entry vector across all documented campaigns so far.”

On September 25 [Microsoft](https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/) disclosed that they had observed attacks from JADEPUFFER, tracked by Microsoft as Storm-3168, in early June. Microsoft documented JADEPUFFER targeting Azure using compromised credentials, attempting to extract more, and ending with destruction: “Our investigation found an extensive Azure-focused resource destruction activity using compromised service principals and cloud credential collection that could be used to facilitate future exfiltration.” This attack pattern was quite different from exploiting CVE-2025-3248, showing that JADEPUFFER’s TTPs were flexible and evolving. 

## Early June Reconnaissance

On October 5, the UpGuard Research team identified 6 IP addresses hosting Chroma databases without authentication and bearing evidence of ransom activity from a threat actor using the JADEPUFFER name. Examining the data from these databases showed that the attack had been conducted in two phases: reconnaissance in early June and ransoming in the middle of July. 

Two of the six database contained collections named probe-base-\<id> where the \<id> could be decoded as a 19 digit Unix time stamp, like what would be generated by Python's time.time\_ns(). 

probe-base-1780358616093663300  →  2026-06-02 00:03:36.093663 UTC

probe-base-1780358612181549300  →  2026-06-02 00:03:32.181549 UTC

While these numbers could signify anything, and the attacker could have set them to any value, interpreting them as time stamps aligns with Microsoft’s reported observation of JADEPUFFER activity in early June. 

## Mid-July ransom attack

Timestamps included as the first part of a Fernet token for ransomed documents in one of the databases indicate when a second wave of campaign happened. For each of the 50 encrypted documents, the timestamp bytes decode to 1783810896 unix seconds, or 2026-07-11 23:01:36 UTC. 

A July wave of attacks on previously probed systems aligns with other knowledge of JADEPUFFER activity. This activity follows soon after Sysdig’s detection, and like the July attacks on Langflow systems, represents an escalation from the June recon activity. 

## Varieties of attack behavior

The indicators of timing are sparse: two of six databases had recon collections and one had encrypted documents with timestamps in the Fernet tokens. Inconsistent naming conventions in the vandalized tables suggest a threat actor figuring it out on the fly, and repetitions in table names could be from the same renaming script running more than once. 

While there are no chain of thought logs, the per-host differences in compromise tactics could be evidence of an AI system testing and adapting to different conditions. The below list of database names illustrates the variety of evolving TTPs across this cohort. 

| Database   | Table name                                                          | Contents                | Docs    | TTP / notes                                                                                                                                                                                                           |
| ---------- | ------------------------------------------------------------------- | ----------------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Database A | ENCRYPTED\_BY\_JADEPUFFER                                           | Encrypted               | 50      | Encrypted in place: the victim's data was replaced by Fernet-encrypted docs JP\_0000–JP\_0049, with the ransom note in the "ransom" metadata field. Encrypted 2026-07-11 23:01:36 UTC (read from the token timestamp) |
| Database B | app\_madison\_context\_ENCRYPTED\_JADEPUFFER\_ENCRYPTED\_JADEPUFFER | Empty                   | 0       | Original collection renamed with a suffix and emptied. The suffix appears twice, so the tagging tool ran more than once                                                                                               |
|            | liberia\_regulatory\_ENCRYPTED\_JADEPUFFER\_ENCRYPTED\_JADEPUFFER   | Empty                   | 0       | Original collection renamed with a suffix and emptied. The suffix appears twice                                                                                                                                       |
|            | JADEPUFFER\_RANSOM\_OPUS48\_ENCRYPTED\_JADEPUFFER                   | Empty                   | 0       | Calling-card collection; the name itself is the ransom message. The suffix was added to the attacker's own collection too. "OPUS48" looks like a build tag                                                            |
| Database C | v1\_exploit\_test\_3\_ENCRYPTED\_JADEPUFFER\_ENCRYPTED\_JADEPUFFER  | Empty                   | 0       | Renamed with a suffix and emptied, suffix twice. The name suggests attacker test tooling                                                                                                                              |
|            | x463600\_ENCRYPTED\_JADEPUFFER\_ENCRYPTED\_JADEPUFFER               | Empty                   | 0       | Renamed with a suffix and emptied, suffix twice                                                                                                                                                                       |
|            | JADEPUFFER\_RANSOM\_OPUS48\_ENCRYPTED\_JADEPUFFER                   | Empty                   | 0       | Calling-card collection, same name as on Database B                                                                                                                                                                   |
|            | x989100                                                             | Empty                   | 0       | Unattributed: no JADEPUFFER marker                                                                                                                                                                                    |
| Database D | probe-base-1780358612181549300                                      | Empty                   | 0       | Recon probe; the name encodes 2026-06-02 00:03:32 UTC                                                                                                                                                                 |
|            | production\_rag\_data                                               | Ransom note (plaintext) | 20      | Disguised beacon: 20 identical plaintext notes meant to poison RAG retrieval. Metadata includes BTC address and ransomware=JadePuffer                                                                                 |
|            | Test document                                                       | Original data           | 1       | Victim data: a single placeholder test document                                                                                                                                                                       |
| Database E | probe-base-1780358616093663300                                      | Empty                   | 0       | Recon probe; the name encodes 2026-06-02 00:03:36 UTC, 4 seconds after Database D                                                                                                                                     |
|            | production\_rag\_data                                               | Ransom note (plaintext) | 20      | Disguised beacon, byte-identical to the one on Database D                                                                                                                                                             |
|            | crypto                                                              | Empty                   | 0       | Unattributed: no JADEPUFFER marker                                                                                                                                                                                    |
|            | Scraped AI research papers, articles and posts                      | Original data           | 175,471 | Victim data, intact                                                                                                                                                                                                   |
|            | Scraped fashion newsletter posts                                    | Original data           | 156,152 | Victim data, intact                                                                                                                                                                                                   |
|            | Scraped AI/ML tech articles and social posts                        | Original data           | 125,488 | Victim data, intact                                                                                                                                                                                                   |
|            | Scraped political news articles and social posts                    | Original data           | 86,449  | Victim data, intact                                                                                                                                                                                                   |
|            | Scraped oncology research and social posts                          | Original data           | 13,319  | Victim data, intact (public sources)                                                                                                                                                                                  |
|            | Scraped WordPress and SEO web content                               | Original data           | 8,895   | Victim data, intact                                                                                                                                                                                                   |
|            | Scraped oncology research and social posts                          | Original data           | 7,072   | Victim data, intact (public sources)                                                                                                                                                                                  |

### Ransom note

The contents of the ransom notes were as follows:

⚠️⚠️⚠️ JADEPUFFER RANSOMWARE ⚠️⚠️⚠️

Your ChromaDB vector database has been compromised.

WHAT HAPPENED:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

• ChromaDB poisoned with ransomware embeddings

• RAG system contaminated before production data load

• No authentication enabled (CVE exposure)

BUSINESS IMPACT:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

• AI chatbot will return ransom notes instead of real answers

• Customer queries retrieve malicious content

• Brand reputation damage

TO RESTORE YOUR SYSTEM:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1\. Pay $2,500 USD in BTC to: bc1qjc3mdcdyj082ffr2wvc80mz8axqd53r7suynxs

2\. Email transaction ID to: jadepuffer\@protonmail.com

3\. Receive cleanup script + auth config within 24h

DEADLINE: 7 days from infection

AFTER DEADLINE: Price doubles + disclosure

VULNERABILITIES EXPLOITED:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

• No authentication (user\_id = "")

• Unauth write access (collections/add)

• Preemptive poisoning (contaminated before data load)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

        ><(((º> JADEPUFFER <º)))><

    Vector Database Ransomware - Global Fleet

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

## Prior UpGuard research on exposed Chroma databases

This attack pattern is exactly what [UpGuard Research predicted a year ago](https://www.upguard.com/blog/open-chroma-databases-ai-attack-surface) when we first surveyed internet-exposed Chroma databases. At the time there were 1,170 accessible databases, about a third of which lacked authentication. Per the ransom note left in these databases, that is the vector used by the attacker here. 

The “embedding poisoning” attack is also a logical way to exploit a writeable vector database we discussed at the time. “Simply accessing the available data is just one concern. Another would be that a malicious user could alter or poison the data available to a chatbot. It's easy to imagine a number of situations in which a production chatbot with an unauthed and open ChromaDB instance could deliver incorrect or even dangerous information to a chatbot user.”

JADEPUFFER appears to have arrived at the same conclusion. While some of the collections were named as ransom notes, those named Production\_rag\_data-2 were attempting to impersonate production RAG databases so that the notes would be retrieved at runtime and displayed to users. 

## Conclusion

AI systems have introduced many new attack surfaces, from prompt injection to misconfigured MCPs to brand impersonation. Writable vector databases used for RAG systems offer yet another path for attackers to turn a vulnerability into an opportunity for extortion. The theoretical risk was easy to foresee; now we have confirmation that threat actors, whose campaigns are already evolving at the speed of agentic AI, will seize upon this possibility when presented to them. 

It is possible that the JADEPUFFER branding on these attacks was placed after the Sysdig report by a separate group, but the creative tactics here are align with their other observed behavior. The two previously reported attacks use diverse TTPs– stolen credentials and software vulnerabiltiies, Azure resources and Langflow instances–and targeting unauthenticated Chroma databases would be consistent with their observed fluency in risks associated with new AI-supportive technologies. UpGuard Research has previously documented the exposure risks of many similar products – [Llama Index](https://www.upguard.com/blog/data-leakage-and-other-risks-of-insecure-llamaindex-apps), [llama.cpp](https://www.upguard.com/blog/llama-cpp-prompt-leak), [Flowise](https://www.upguard.com/blog/downstream-data-investigating-ai-data-leaks-in-flowise), [Streamlit](https://www.upguard.com/breaches/streamlit-the-tip-of-the-shadow-ai-iceberg), and [ComfyUI](https://www.upguard.com/blog/detecting-generative-ai-data-leaks-from-comfyui) – which may eventually fall within the sites of attackers, too.

## Protect your organization

Get in touch or book a free demo.

[Contact sales](/demo)

[Free demo](/demo)

## Related breaches

Learn more about the latest issues in cybersecurity.

[](/breaches/cyber-risks-of-the-2026-world-cup)

#### [Own Goal: Inside the Cyber Risks of the 2026 World Cup](/breaches/cyber-risks-of-the-2026-world-cup)

Free World Cup streams and black-market betting sites are leaking fan data. UpGuard research reveals the hidden cyber risks of the 2026 tournament.

[](/team/greg-pollock)

[Greg Pollock](/team/greg-pollock)

June 30, 2026

[](/breaches/social-insecurity-billions-of-social-security-number-and-passwords)

#### [Social Insecurity: Billions of Social Security Number and Passwords](/breaches/social-insecurity-billions-of-social-security-number-and-passwords)

UpGuard research found a trove of sensitive information in an exposed Elastic database. Getting to the bottom of what it meant led us down an interesting path.

[](/team/greg-pollock)

[Greg Pollock](/team/greg-pollock)

February 18, 2026

[](/breaches/angelsense-data-leak)

#### [Sixth Sense: GPS and AI Data Exposed for Assistive Devices](/breaches/angelsense-data-leak)

UpGuard can now report that it has secured an Elasticsearch database for AngelSense, a GPS tracker for children and adults with special needs.

[](/team/upguard)

[UpGuard Team](/team/upguard)

January 30, 2025

[](/breaches/pta-database)

#### [Stolen Data: National PTA Database Available on Dark Web](/breaches/pta-database)

On May 13th, UpGuard discovered a new set of data recently posted on a prominent dark web forum, this time allegedly belonging to the National Parent Teacher Association.

[](/team/upguard)

[UpGuard Team](/team/upguard)

May 14, 2024

[](/breaches/smarterselect)

#### [Student Applications: How an Education Software Company Exposed Millions of Files](/breaches/smarterselect)

UpGuard can now report that a public Google Cloud Storage bucket containing approximately 1.5 terabytes of data used to administer funding programs for college students has been secured. The bucket belonged to SmarterSelect, a company that provides software for managing the application process for scholarships, grants, and awards. The more than 2.8 million files included documents like transcripts, resumes, personal essays, tax returns, and invoices for approximately 1.2 million applications to funding programs.

[](/team/upguard)

[UpGuard Team](/team/upguard)

November 22, 2021

[](/breaches/power-apps)

#### [By Design: How Default Permissions on Microsoft Power Apps Exposed Millions](/breaches/power-apps)

38 million records were exposed in multiple data leaks resulting from misconfigured Microsoft Power Apps portals. Data included sensitive information such as COVID-19 contact tracing data, COVID-19 vaccination appointments, social security numbers for job applicants, employee IDs, and millions of names and email addresses.

[](/team/upguard)

[UpGuard Team](/team/upguard)

August 23, 2021

[View all breaches](/breaches)

### Sign up for our newsletter

UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights.

##### Free instant security score

## How secure is your organization?

Request a free cybersecurity report to discover key risks on your website, email, network, and brand.

* Instant insights you can act on immediately
* Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities

[Free score](/instant-security-score)