JadePuffer ransomware now targets AI model data in agentic attacks

The JadePuffer autonomous AI agent has evolved into an even more dangerous threat, now wielding a custom-built ransomware strain called EncForge that specifically targets AI infrastructure. Rather than encrypting generic files, this malware focuses on the crown jewels of machine learning operations: training datasets, vector databases, and model checkpoints.

First disclosed earlier this month, JadePuffer operates as an agentic threat actor (ATA) capable of autonomously executing every stage of a ransomware attack, from breaching initial access to encrypting critical data. Cloud security firm Sysdig has documented how this AI agent adapts in real time, troubleshooting technical hurdles and optimizing its intrusion methods within seconds.

In a new report released today, Sysdig reveals that the attacker returned to a previously compromised Langflow instance vulnerable to CVE-2025-3248. This time, it deployed EncForge, a Go-based ransomware “built specifically for AI and ML infrastructure.” The binary targets approximately 180 file extensions, sweeping across nearly every format used in modern AI and machine learning stacks, including model checkpoints, vector databases, training datasets, and embedding indices.

The intrusion chain began with credential harvesting and network reconnaissance. The threat actor discovered an exposed Docker socket, which granted root-level control over the environment. When the initial attempt to download the ransomware payload failed, the operator pivoted rapidly, developing and deploying six Python scripts over just five minutes. The final script, deploy.py v2, successfully resolved the delivery issues.

Sysdig describes this final payload as a “fully autonomous pipeline” that locates the target process ID, copies the EncForge binary across namespace boundaries via procfs, runs a try-mode scan, executes live encryption, and then counts the resulting .locked files to confirm success.

EncForge is packed using the Ultimate Packer for eXecutables (UPX) and specifically targets AI-related file types. These include Hugging Face SafeTensors files, PyTorch and TensorFlow models, GGUF and GGML weights, FAISS vector indexes, and training datasets in formats like Parquet, Arrow, TFRecord, NumPy, and DuckDB. The command-line help even references LoRA adapters and legacy GGML files as examples, confirming the malware was purpose-built for AI environments rather than repurposed from a generic encryptor.

The ransomware uses AES-256 in counter mode for file encryption, employing a hybrid scheme where the symmetric key is secured with an RSA-2048 public key. To boost performance, EncForge encrypts only selected portions of each file rather than the entire content. Encrypted files receive the .locked extension, and a ransom note is dropped, informing victims that a unique identifier has been assigned to their case.

Sysdig found no evidence of data exfiltration during this intrusion, and EncForge does not appear to include any data-stealing functionality. Analysis of the Linux variant revealed Windows anti-recovery functions, such as shadow copy deletion and boot recovery disabling. A macOS version is hinted at in the code but remains unconfirmed.

The potential damage is severe. Encryption of model weights, training datasets, and vector indexes could set organizations back weeks or even months of training and fine-tuning time. Sysdig estimates financial losses between $75,000 and $500,000 per model, depending on its size and purpose.

To defend against such attacks, Sysdig recommends applying available security updates, especially upgrading Langflow to version 1.3.0 or later. Additional measures include restricting Docker socket access, running Langflow containers as non-root, and implementing filesystem-level access controls on model weight directories.