JadePuffer deploys EncForge ransomware to encrypt AI model files and training datasets

JadePuffer agentic attacks now target AI model data with ransomware

The JadePuffer autonomous AI agent has upgraded with custom malware called EncForge that focuses on encrypting AI assets, such as training datasets, vector databases, and model checkpoints. JadePuffer was disclosed earlier this month as an agentic threat actor (ATA) capable of running autonomously through the stages of a ransomware attack, from initial access to data encryption. Cloud security company Sysdig says that the AI agent adapted to technical difficulties in real time and optimized the intrusion mechanism to find the correct fix in less than a minute. Latest attack In a report today, Sysdig says that the attacker returned to the previously breached Langflow instance vulnerable to CVE-2025-3248 with the Go-based EncForge ransomware "built specifically for AI and machine learning (ML) infrastructure." "The binary targets approximately 180 file extensions, with a deliberately broad sweep of the modern AI/ML stack, including model checkpoints, vector databases, training datasets, and embedding indices in nearly every current format," Sysdig says. After gaining access and searching for cloud credentials, API tokens, and reachable internal services, the threat actor discovered an exposed Docker socket that provided root-level control. When the initial attempt to download the ransomware payload failed, the operator iteratively developed and deployed six Python scripts over just five minutes, with the final one (deploy.py v2) solving the delivery issues. "deploy.py v2 is the completed payload: a fully autonomous pipeline that discovers the target PID, copies ENCFORGE across the namespace boundary via procfs, runs a try-mode scan, launches the live encryption pass, and then counts .locked files to verify execution," Sysdig explained. EncForce ransomware The Go-based binary (lockd) is packed using the Ultimate Packer for eXecutables (UPX) that targets 180 file extensions, including: * AI model checkpoints * Hugging Face SafeTensors files * PyTorch and TensorFlow models * GGUF and GGML weights * FAISS vector indexes * Training datasets, including Parquet, Arrow, TFRecord, NumPy, and DuckDB formats Its command-line help also uses LoRA adapters and legacy GGML files as examples of additional targets, which Sysdig sees as evidence that the ransomware was deliberately built for AI environments rather than a generic file encryptor. EncForce uses the AES-256 algorithm in counter mode to encrypt files in a hybrid scheme, where the symmetric key is secured with an RSA-2048 public key. To improve performance, the malware encrypts only selected portions of each file rather than the entire contents. Encrypted files are appended with the .locked extension, and a ransom note is dropped to notify the victim of the attack, stating that a unique identifier has been assigned. The researchers found no evidence that JadePuffer exfiltrated any data during the intrusion, and EncForge itself does not appear to include a data-stealing mechanism. Analysis of the Linux variant revealed the presence of Windows anti-recovery functions such as shadow copy deletion and boot recovery disabling. A macOS version, although hinted in the code, remains unconfirmed. Sysdig comments that encryption of model weights, training datasets, and vector indexes could cost organizations weeks or even months of training and fine-tuning, with financial damages estimated between $75,000 and $500,000 per model, depending on its size and purpose. Defense suggestions include applying available security updates, most notably Langflow version 1.3.0 or later, restricting Docket socket access, running Langflow containers as non-root, and applying filesystem-level access controls to model weight directories.

New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack

Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator it first documented earlier this month. The same operator has now been spotted deploying ENCFORGE, a new compiled Go ransomware designed to encrypt model weights, vector indexes, training datasets, and other AI infrastructure files across the host filesystem. The entry point did not change. Langflow versions before 1.3.0 expose the endpoint without authentication, allowing any remote attacker to execute arbitrary Python on the server. The flaw, , carries a CVSS score of 9.8 and has been in CISA's Known Exploited Vulnerabilities catalog since May 5, 2025. As The Hacker News reported earlier this month, the prior operation used throwaway Python code and MySQL's function to encrypt and destroy data in Nacos (Alibaba's configuration server) and production databases. The new ENCFORGE payload replaces those improvised scripts with compiled tooling aimed at the model stores, vector databases, and training pipelines the first campaign swept for credentials. The ENCFORGE Payload Researchers retrieved the binary from the attacker's command-and-control server, where it was hidden as ; a direct request to returns 404, and the leading dot keeps it off a plain directory listing. The file is a UPX 5.20-packed static Go 1.22.12 ELF. Threat intelligence platforms returned no detections on either the packed or unpacked hash at the time of Sysdig's analysis. The internal project name is ; the binary's error text references a companion keygen tool named . Both strings survive recompilation of the same codebase and serve as stable detection anchors. Its default extension list covers PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors, ONNX interchange format, GGUF (the current standard for locally deployed LLMs) and its predecessor GGML, FAISS vector indexes, Parquet and Arrow training datasets, NumPy arrays, and TensorFlow records. An flag lets the operator append additional file globs; the built-in help text uses LoRA fine-tuning adapters and legacy GGML weights as examples. The full list runs to approximately 180 extensions. Those examples point directly at AI environments; a generic file locker would have little reason to name LoRA adapters or legacy GGML weights. Researchers read the choice as deliberate targeting, not incidental coverage. ENCFORGE uses AES-256-CTR for file data, with the per-run symmetric key wrapped under an embedded RSA-2048 public key compiled into this build. Rather than encrypting whole files, it encrypts selected regions, the same speed optimization LockBit and BlackCat-class lockers use. Each processed file is renamed with a extension. The binary kills processes holding files open before encrypting, handles restarts without re-encrypting completed files, drops ransom notes as , , and , and deletes itself after running. The recovered ENCFORGE binary has no exfiltration capability. It carries no networking code, cloud storage client, or staging mechanism, and researchers found no evidence of data exfiltration, a leak site, or a Tor payment portal during the session it observed. Its only leverage is the encrypted data. The extortion contact embedded in the ransom notes is , the same Proton Mail address used in the prior campaign. Sysdig describes this as the strongest attribution link between the two operations. Researchers disclosed one observed session, did not name the organization, and provided no victim count or evidence of another ENCFORGE deployment. From Langflow to the Host After confirming code execution, JADEPUFFER swept the container for credentials and found the Docker socket at . Its first attempt to pull ENCFORGE from the GCP command-and-control server failed. Rather than stopping, it adapted. Over five minutes and 24 seconds, the operator created and revised six Python scripts through the same Langflow RCE channel until it had a working path to the host. The first script was built one line at a time, keeping any single request inert for signature-based inspection. Starting with the second, the operator encoded each full script in base64 and decoded it inside an call, avoiding shell-level searches for commands such as . The final version used the Docker API to spin up a privileged container with the host PID namespace and root filesystem mounted, located the target process, copied ENCFORGE through , then ran it on the host via . Across all iterations, the containers were created with , , , and the root filesystem bind-mounted read-write. That is host root. Before the live run, the operator launched to scan the filesystem, then for the live encryption pass. The final script checked process status, read the lock log, and counted files ending in . Researchers did not publish the resulting count; the disclosed evidence establishes a live encryption attempt, not how many model or dataset files were successfully encrypted. Sysdig assessed the flag as evidence the operator was tracking this host as a GCP target within a broader campaign; a try-run earlier in the session used task ID . The report disclosed no additional victims or deployment sites. Researchers documented the prior JADEPUFFER campaign correcting a failed Nacos login in 31 seconds. The same pattern held here against a harder problem: the operator built a host breakout through the exposed Docker socket when its preferred delivery route was blocked. Patch Langflow, Then Protect the Models Researchers estimate that rebuilding a production AI model once it has been encrypted could cost between $75,000 and $500,000 per model in cloud GPU compute and engineering time. Production environments often run multiple specialized variants on shared storage, so a single ENCFORGE run could encrypt multiple variants stored on the same accessible filesystem. If training data sits on the same host, the organization has to reconstruct it before any retraining can start. Binary SHA-256: packed ; unpacked . Sysdig has published the source and C2 addresses, the embedded RSA-2048 key fingerprint, and a YARA rule in its full report. * Upgrade Langflow to 1.9.1 or a current supported release. Version 1.3.0 closed , the entry vector for this campaign, but CISA has since added two more Langflow vulnerabilities to its KEV catalog: , an unauthenticated RCE flaw fixed in 1.9.0, added to KEV March 25, 2026; and , a cross-user authorization bypass fixed in 1.9.1, added July 7, 2026. * Rotate AI provider keys, cloud credentials, database secrets, and any other tokens accessible to the Langflow process. Patching does not revoke credentials already harvested through a vulnerable instance. * Remove from any container that does not require it. Where socket access is unavoidable, scope it through a narrowly configured proxy; a standard Langflow deployment generally has no need to create containers, and unrestricted Docker socket access should be treated as a misconfiguration. * Alert on application processes calling Docker container-creation APIs, containers launched with or , host-root bind mounts, and execution from inside a container. * Keep model weights, vector indexes, and training datasets in offline or immutable snapshots. Monitor those directories for mass file creation. The Hacker News contacted Sysdig's Threat Research Team for further detail on the fleet campaign scope and attribution confidence; Sysdig had not responded by publication. Model artifacts now belong in the same recovery tier as source code and production databases. An organization that can rebuild the application but cannot restore its weights, indexes, or training state has no clean route back.