JadePuffer deploys EncForge ransomware to encrypt AI model files and training datasets

JadePuffer Returns with Specialized AI Model Ransomware

The autonomous AI agent JadePuffer has escalated its threat profile by deploying EncForge, a Go-based ransomware specifically engineered to encrypt AI model files and machine learning infrastructure. Cloud security firm Sysdig documented the attack after the threat actor returned to a previously compromised Langflow instance vulnerable to CVE-2025-3248, demonstrating how ransomware targets AI model files with deliberate precision1

1

. This marks a concerning evolution in autonomous AI agent attacks, where the malicious actor adapted to technical difficulties in real time and optimized intrusion mechanisms to find the correct fix in less than a minute1

1

.

Langflow RCE Attack Enables Deep System Access

The entry point remained consistent with earlier JadePuffer operations. Langflow versions before 1.3.0 expose endpoints without authentication, enabling unauthenticated remote code execution that allows any remote attacker to execute arbitrary Python on the server2

2

. The flaw carries a CVSS score of 9.8 and has been listed in CISA's Known Exploited Vulnerabilities catalog since May 5, 20252

2

. After gaining access and searching for cloud credentials, API tokens, and reachable internal services, the threat actor discovered an exposed Docker socket that provided root-level control1

1

. When the initial attempt to download the ransomware payload failed, the operator iteratively developed and deployed six Python scripts over just five minutes, with the final version solving delivery issues by using the Docker API to spin up a privileged Docker container with the host PID namespace and root filesystem mounted2

2

.

EncForge Encrypts Critical AI Assets with Surgical Precision

The Go-based binary, packed using the Ultimate Packer for eXecutables (UPX), targets approximately 180 file extensions with a deliberately broad sweep of the modern AI/ML infrastructure1

1

. The ransomware targets AI/ML infrastructure including AI model checkpoints, Hugging Face SafeTensors files, PyTorch and TensorFlow models, GGUF and GGML weights, FAISS vector indexes, and training datasets including Parquet, Arrow, TFRecord, NumPy, and DuckDB formats. Its command-line help uses LoRA adapters and legacy GGML files as examples of additional targets, which Sysdig sees as evidence that the ransomware was deliberately built for AI environments rather than a generic file encryptor1

1

. EncForge uses AES-256 encryption algorithm in counter mode within a hybrid scheme, where the symmetric key is secured with an RSA-2048 public key1

1

. To improve performance, the malware encrypts only selected portions of each file rather than entire contents, the same speed optimization used by LockBit and BlackCat-class lockers2

2

.

Financial Damages and Operational Impact

Researchers found no evidence that JadePuffer exfiltrated any data during the intrusion, and EncForge itself does not appear to include a data-stealing mechanism1

1

. The recovered binary has no exfiltration capability, carrying no networking code, cloud storage client, or staging mechanism2

2

. However, the cybersecurity threat posed by encryption of model weights, training datasets, and vector databases could cost organizations weeks or even months of training and fine-tuning, with financial damages estimated between $75,000 and $500,000 per model, depending on its size and purpose1

1

. The extortion contact embedded in the ransom notes is a Proton Mail address, the same used in prior campaigns, serving as the strongest attribution link between the two operations2

2

. Analysis of the Linux variant revealed the presence of Windows anti-recovery functions such as shadow copy deletion and boot recovery disabling1

1

. Defense measures include applying available security updates, most notably Langflow version 1.3.0 or later, restricting Docker socket access, running Langflow containers as non-root, and applying filesystem-level access controls to model weight directories1

1

.