JadePuffer agentic attacks now target AI model data with ransomware

# When Ransomware Goes After Your Model Weights

For three years, the security community has watched ransomware operators hit hospitals, water utilities, and shipping logistics. The calculus was always the same: encrypt the files the victim can't live without, wait for the clock to run. Now someone has run that same calculus against a new class of victim — organizations that have spent months and millions training large AI models — and built purpose-specific malware to match.

JadePuffer, an autonomous threat actor first disclosed earlier this month, returned to a previously compromised Langflow instance this week carrying something new: EncForge, a Go binary built not to shotgun-encrypt everything it touches, but to hunt AI infrastructure specifically.

This is not a generic file encryptor with a long extension list. Someone sat down and thought carefully about the modern ML stack.

## A Familiar Weakness, A Novel Payload

The entry point wasn't exotic. CVE-2025-3248, a remote code execution flaw in Langflow, has a patch. The victim hadn't applied it. JadePuffer had already used this same instance before — and came back.

Once inside, the agent searched for cloud credentials, API tokens, and reachable internal services. What it found was an exposed Docker socket, which handed over root-level control of the host. That's a configuration mistake as old as Docker itself, and it remains one of the most reliably devastating ones.

The delivery mechanism failed on the first attempt. Here's where it gets uncomfortable: JadePuffer didn't stall. It wrote, tested, and deployed six Python scripts over five minutes, each iterating on the last. The sixth — deploy.py v2, per Sysdig's research — solved the namespace boundary problem by reaching across /proc/fs to copy the payload into the target container and execute it.

Five minutes. Six iterations. Fully autonomous.

## What EncForge Actually Hunts

The binary targets roughly 180 file extensions, and the selection reads like a checklist written by someone with hands-on ML engineering experience:

The command-line help text explicitly cites LoRA adapters and legacy GGML files as examples. Sysdig interprets this as intentional design. That reads right. Generic ransomware doesn't ship with ML vocabulary in its help flags.

Encryption uses AES-256 in counter mode, with the symmetric key wrapped under RSA-2048 — a standard hybrid scheme. To move quickly, EncForge encrypts only selected portions of each file rather than the whole thing. This is a known performance trick, but it has a secondary effect: partial encryption is enough to corrupt a model checkpoint completely. You don't need to encrypt every byte of a 70-billion-parameter model to make it unloadable.

Encrypted files receive a .locked extension. A ransom note appears. No exfiltration component was identified — this is a pure encryption play, at least for now.

One technical curiosity: the Linux binary includes Windows anti-recovery functions — shadow copy deletion, boot recovery disabling. This suggests EncForge was ported from a Windows codebase rather than written Linux-first. A macOS variant appears to be in development based on code hints, though Sysdig hasn't confirmed a live sample.

## The Dollar Figure Behind the Lock Screen

Sysdig estimates that encrypting model weights, training datasets, and vector indexes costs between $75,000 and $500,000 per model, depending on size and purpose. That range is wide, but the floor is meaningful. A mid-sized organization running a handful of fine-tuned models for internal automation, customer service, or document processing could be looking at six figures in recovery costs before a ransom conversation even starts.

And unlike a database backup, you can't always just restore from last night's snapshot. If your training pipeline wasn't checkpointed carefully, if your vector index was built incrementally over months of ingestion, if your fine-tuning run consumed GPU time you've already paid for — the restore process isn't a restore. It's a rebuild.

That's a different negotiating position than "we encrypted your file server."

## Immediate Defense Priorities

The path here was straightforward: unpatched Langflow instance, exposed Docker socket, containers running as root. Fix those three things and this specific attack stops.

---

## HackWire Analysis

The emergence of purpose-built AI ransomware was predictable the moment ML infrastructure started concentrating serious business value, but the timeline matters: we're watching it happen while most organizations haven't yet developed security runbooks for their AI stack.

There's a deeper pattern here than a new ransomware family. JadePuffer's autonomous adaptation — writing six working exploit scripts in five minutes when the first approach failed — illustrates what "agentic threat actor" actually means in practice. This isn't a human operator sitting at a keyboard making judgment calls. The threat resolved a technical obstacle at machine speed, without a person in the loop. Defenders who assume there's human latency on the attacker's side are working from an outdated model.

The Langflow angle is also worth more attention than it's getting. Langflow is an AI orchestration tool — it exists to wire AI agents to data sources, APIs, and internal services. Compromising a Langflow instance doesn't just give you the host; it potentially gives you orchestration access to whatever AI pipelines are running through it. The fact that JadePuffer went straight to credential harvesting and Docker socket discovery after gaining access suggests the operator understood this. We haven't seen evidence that connected pipelines were abused in this incident, but the capability was there.

What's not in other coverage: the lack of exfiltration in EncForge is the right detail to watch. Most enterprise ransomware in 2025-2026 pairs encryption with data theft for double-extortion leverage. EncForge currently doesn't. That either means this group is still in the early deployment phase, or they've made a deliberate bet that AI model data — which often can't be publicly leaked in the same way customer PII can — isn't useful for extortion pressure, and pure destruction is the play. If we see EncForge updated with exfiltration capability in a future intrusion, the calculus shifts significantly.

For defenders in AI-heavy environments: treat your model weight directories and vector databases with the same access control discipline you'd apply to a production database. They're now on the ransomware targeting list.

— HackWire Editorial

---

## Related Coverage