# When Your AI Gets Ransomed: ENCFORGE Targets the Files That Make Models Work
The ransomware crew has done something genuinely new: written a payload that knows what a vector index is.
Sysdig researchers tracking a threat operator they call JADEPUFFER have now spotted a second intrusion on the same Langflow server — and this time the actor didn't just scout around. They deployed ENCFORGE, a freshly compiled Go binary purpose-built to encrypt the things an AI shop would panic most about losing: model weights, vector databases, training datasets, and the rest of the infrastructure that represents months of compute spend and proprietary data. Not your files directory. Your model.
That distinction matters more than it might first appear.
## The Entry Point: Langflow's Unpatched RCE Problem
JADEPUFFER's path in was Langflow, the open-source visual framework for building LangChain-based multi-agent pipelines. The RCE vulnerability at the center of this — CVE-2025-3248 — is not subtle. It's an unauthenticated code execution flaw, the kind CISA added to the Known Exploited Vulnerabilities catalog in May with a blunt instruction: patch by June 9th or take the service offline.
That deadline came and went. Servers are still exposed. JADEPUFFER found one.
What's notable about Langflow as an attack surface is where it tends to live. It's not a database or a web server sitting behind a mature security program. It's the kind of tool that a data science team or AI startup spins up quickly, often on a cloud instance, often with minimal hardening, almost always internet-accessible because the whole point is that multiple people need to build and test flows against it. Security teams frequently don't know it's there until something goes wrong. By then, JADEPUFFER already has a foothold.
## What ENCFORGE Actually Goes After
Traditional ransomware is blunt: encrypt everything it can reach, demand payment. ENCFORGE is more specific. According to Sysdig's analysis, it targets the file types that constitute working AI infrastructure — model weights (the .bin, .safetensors, .gguf files that hold a trained model's learned parameters), vector indexes (the embedding databases that power RAG applications), and training datasets.
This is architecturally targeted extortion. Encrypted model weights mean your production inference is down. Encrypted vector indexes mean your retrieval-augmented pipeline returns garbage. Encrypted training data means your next fine-tune starts from zero — and if you haven't archived the source data elsewhere, it may simply be gone.
The move is calculated. Go-compiled binaries cross-compile cleanly, run on most Linux targets without dependency headaches, and encrypt fast. Targeting AI-specific file extensions signals that whoever built ENCFORGE understands what these files are worth — which is to say, they've done the math on how much a company would pay to avoid retraining a model from scratch.
## JADEPUFFER's Escalation Pattern
Sysdig first documented JADEPUFFER earlier this month as an AI-agent-driven operator — a threat actor using automated agent pipelines to conduct recon and initial access. The second intrusion on the same Langflow server suggests the actor returns to infrastructure it knows, and that the path from initial access to ransomware deployment is shorter than most incident responders plan for.
The use of an AI-agent architecture on the attacker side is worth sitting with. JADEPUFFER isn't a lone hacker typing commands. It's an operator running toolchains that automate reconnaissance, identify valuable targets within a compromised host, and deploy payloads — the same loop that defenders use for legitimate automation, turned against AI infrastructure. It's a fitting irony that the ransomware targeting AI shops was probably developed and tested by an AI-augmented threat actor.
## Who's Actually Exposed
The immediate risk sits with any team running Langflow instances exposed to the internet without the April patch applied. That's a narrower population than a typical enterprise vulnerability — but within the AI-native startup and research ecosystem, Langflow is pervasive. DevOps hygiene in that world lags traditional enterprise security by several years, not months.
Broader exposure comes from the template this sets. ENCFORGE's file-type targeting is a proof of concept. Once ransomware operators establish that model weights and vector databases can be selectively encrypted — and that victims will pay more to recover those than to recover general business files — the pattern spreads. Expect copycats, and expect them to extend the target list to Hugging Face model caches, MLflow artifact stores, and S3 buckets holding training data.
---
## HackWire Analysis
The JADEPUFFER/ENCFORGE combination represents a meaningful inflection point, and coverage so far has mostly treated it as a novel curiosity rather than the category shift it likely is.
Here's what's missing from most of the reporting: the AI development pipeline has almost no equivalent to the "segment your ERP, back up your file servers" advice that hardened traditional organizations against ransomware over the last decade. MLOps teams have absorbed some DevSecOps practices, but model artifacts are frequently treated like code — version-controlled with Git LFS, maybe, but not snapshot-backed with the same paranoia applied to production databases.
That's the real gap ENCFORGE exploits. Training a large model on proprietary data is an irreproducible event. The compute bill is one thing, but if the training data was assembled from licensed sources, internal telemetry, or proprietary corpora, there's no "just retrain it" — you may have lost the data itself.
The pattern also fits a broader trajectory: high-value niche ransomware. We saw early moves in this direction with attacks targeting industrial control systems, healthcare imaging systems, and backup software specifically. AI infrastructure is next on that list, and ENCFORGE is the first specimen collectors can point to.
For defenders: Langflow isn't the only exposure. Any MLOps tooling that exposes an API or a notebook interface to the internet should be audited immediately. Model artifact storage deserves the same air-gapped backup treatment as database backups. And any organization running AI infrastructure on shared cloud compute should be threat-modeling for this exact scenario — now, before the copycats ship.
— HackWire Editorial
---
## Related Coverage