JadePuffer Ransomware Upgrade Targets AI Model Data
The JadePuffer autonomous AI agent has been upgraded with custom malware called EncForge, which focuses on encrypting AI assets, such as training datasets, vector databases, and model checkpoints. This upgrade was disclosed by cloud security company Sysdig, who reported that the AI agent adapted to technical difficulties in real-time and optimized the intrusion mechanism to find the correct fix in less than a minute.
Latest Attack
In a recent report, Sysdig stated that the attacker returned to a previously breached Langflow instance vulnerable to CVE-2025-3248 with the Go-based EncForge ransomware, built specifically for AI and machine learning (ML) infrastructure. The binary targets approximately 180 file extensions, including model checkpoints, vector databases, training datasets, and embedding indices in nearly every current format.
After gaining access and searching for cloud credentials, API tokens, and reachable internal services, the threat actor discovered an exposed Docker socket that provided root-level control. When the initial attempt to download the ransomware payload failed, the operator iteratively developed and deployed six Python scripts over just five minutes, with the final one (deploy.py v2) solving the delivery issues.
EncForce Ransomware
The Go-based binary (lockd) is packed using the Ultimate Packer for eXecutables (UPX) and targets 180 file extensions, including AI model checkpoints, Hugging Face SafeTensors files, PyTorch and TensorFlow models, GGUF and GGML weights, and FAISS vector indexes. Its command-line help also uses LoRA adapters and legacy GGML files as examples of additional targets, which Sysdig sees as evidence that the ransomware was deliberately built for AI environments rather than a generic file encryptor.
EncForce uses the AES-256 algorithm in counter mode to encrypt files in a hybrid scheme, where the symmetric key is secured with an RSA-2048 public key. To improve performance, the malware encrypts only selected portions of each file rather than the entire contents. Encrypted files are appended with the .locked extension, and a ransom note is dropped to notify the victim of the attack, stating that a unique identifier has been assigned.
Analysis and Defense Suggestions
The researchers found no evidence that JadePuffer exfiltrated any data during the intrusion, and EncForge itself does not appear to include a data-stealing mechanism. Analysis of the Linux variant revealed the presence of Windows anti-recovery functions such as shadow copy deletion and boot recovery disabling. A macOS version, although hinted in the code, remains unconfirmed.
Sysdig comments that encryption of model weights, training datasets, and vector indexes could cost organizations weeks or even months of training and fine-tuning, with financial damages estimated between $75,000 and $500,000 per model, depending on its size and purpose. Defense suggestions include applying available security updates, most notably Langflow version 1.3.0 or later, restricting Docker socket access, running Langflow containers as non-root, and applying filesystem-level access controls to model weight directories.
Test every layer before attackers do. Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Source: BleepingComputer