JadePuffer Deploys ENCFORGE Ransomware: First Autonomous Attack Targeting AI/ML Models

AI-driven threat actor JadePuffer deploys ENCFORGE ransomware against AI models and ML infrastructure. Encrypts 180+ AI-related file formats. Single-model rebuild cost up to $750,000.

Incident overview

On 21 July 2026, cloud security firm Sysdig Threat Research published a report on another campaign by JadePuffer, an AI-agent-driven threat actor. In this attack, JadePuffer deployed ENCFORGE, a new ransomware family purpose-built for AI and machine learning (ML) infrastructure, capable of encrypting more than 180 AI-related file formats.

JadePuffer is the first confirmed threat actor to use a large language model (LLM) to autonomously execute end-to-end ransomware attacks. In the latest intrusion, the AI agent completed the full attack chain from initial access to payload deployment in about five minutes, and autonomously diagnosed and fixed a technical failure in payload delivery.

Technical details

Initial access and lateral movement

Per the Sysdig report, JadePuffer's intrusion path:

• Entry: known vulnerability CVE-2025-3248 in the Langflow MLOps platform (missing authentication on a code-validation endpoint) for initial code execution

• Credential harvest: search for cloud-provider keys, database connection strings, and API tokens

• Container escape: discovered an exposed Docker socket (`/var/run/docker.sock`); mounted the socket to spawn a privileged container and escape to the host

• Payload delivery: after the initial payload drop failed, the AI agent iteratively generated six Python scripts in about five minutes and ultimately delivered the ENCFORGE binary across the namespace boundary via procfs

ENCFORGE ransomware analysis

ENCFORGE is a Go ransomware binary, UPX-packed (internal name `lockd`). Design target is explicitly AI/ML assets:

| Target type | Example extensions | | --- | --- | | PyTorch models | .pt, .pth | | TensorFlow models | .ckpt | | HuggingFace SafeTensors | .safetensors | | llama.cpp quantized models | .gguf | | FAISS vector indexes | .faiss | | Training datasets | .parquet, .tfrecord, .arrow, .npy, .duckdb | | ONNX models | .onnx | | LoRA adapters | .bin, .adapter |

Encryption: AES-256-CTR with RSA-2048 key exchange. For performance, ENCFORGE encrypts only selected portions of each file, not the entire contents. Encrypted files get a `.locked` extension and a ransom note.

Attack objective: destruction, not extortion

Unlike most enterprise ransomware, ENCFORGE currently has no data-theft capability. Sysdig researchers assess the primary goal as destroying the AI models themselves, not using data leaks for pressure. Rebuilding a single complex ML model is estimated at $75,000–$500,000; destroying multiple models can run into millions of dollars.

Impact

JadePuffer and ENCFORGE mark a new phase of ransomware:

• AI-specific payload: first ransomware explicitly targeting AI/ML model weights, vector databases, and training datasets

• Autonomous attack: the AI agent decides, self-corrects, and optimizes the attack path with no human in the loop

• Machine speed: container escape, payload iteration, and deployment in five minutes — faster than human operators can respond

• Recovery bind: encrypted AI models cannot be restored by paying ransom; rebuild depends entirely on secure offline backups

Mitigation

Immediate actions

• Upgrade Langflow: Langflow 1.3.0 or later, which patches CVE-2025-3248

• Restrict the Docker socket: audit container access to `/var/run/docker.sock`; most deployments should not expose it

• Run as non-root: AI workload containers should run as a non-root user

• Offline model backups: snapshot production models offline to the same security standard as source code and production databases

Defense in depth

• Least-privilege filesystem ACLs on model-weight directories

• Do not store AI-provider API keys in the Langflow runtime environment

• Lock down internet-facing AI orchestration tools; restrict source IPs

• Retire default and potentially leaked credentials

• Deploy EDR and threat-hunting on AI infrastructure

References

• Help Net Security: JadePuffer ENCFORGE ransomware analysis

• HackWire: in-depth analysis of JadePuffer AI-agent attacks on AI model data

• NetSecOps: JadePuffer ENCFORGE technical details and IOCs

• CyberAdviser: JadePuffer agent attacks on AI model data