JadePuffer arms itself with the EncForge ransomware to attack AI model data

Sysdig, a company specializing in cloud security, has published a new report on JadePuffer — an “agentic” threat actor (ATA) capable of autonomously working through every stage of an attack, from initial access to data encryption. The agent itself was first reported earlier this month, and now it has picked up its own ransomware, EncForge, aimed specifically at machine learning infrastructure.

What EncForge encrypts

The Go-written binary (lockd), packed with UPX, covers roughly 180 file extensions — essentially the entire modern ML stack. Its list of targets includes model checkpoints, Hugging Face SafeTensors files, PyTorch and TensorFlow models, weights in the GGUF and GGML formats, FAISS vector indexes, as well as training sets in the Parquet, Arrow, TFRecord, NumPy and DuckDB formats. Even the command-line help cites LoRA adapters and legacy GGML files as examples — which, in the researchers’ view, proves that the ransomware was built specifically for AI environments rather than being a general-purpose tool.

For encryption it uses AES-256 in counter mode under a hybrid scheme: the symmetric key is protected with an RSA-2048 public key. For the sake of speed, only individual fragments of each file are encrypted. A .locked extension is appended to the encrypted files, and the victim is left a note with a unique identifier.

An attack refined to perfection in five minutes

The attacker returned to a previously compromised Langflow instance vulnerable to CVE-2025-3248. After searching for cloud credentials, API tokens and reachable internal services, the agent discovered an exposed Docker socket that granted root privileges. When the first attempt to deliver the payload failed, the operator iteratively wrote and deployed six Python scripts over five minutes; the final deploy.py v2 solved the delivery problem. Sysdig notes that the AI agent adapted to technical difficulties in real time and found a working solution in under a minute.

A curious detail: the Linux variant was found to contain “Windows” anti-recovery functions — deleting shadow copies and disabling boot recovery. A reference in the code to a macOS version remained unconfirmed. The researchers found no signs of data theft — EncForge, it appears, cannot exfiltrate data at all.

The cost of downtime

Losing model weights, datasets and vector indexes can cost organizations weeks or months of training and fine-tuning. Sysdig estimates the financial damage at \(75,000–\)500,000 per model — depending on its size and purpose.

As a defense, it is recommended to update Langflow to version 1.3.0 or newer, restrict access to the Docker socket, run Langflow containers as a non-root user, and apply filesystem-level access controls to the directories holding model weights.

Source: Bleeping Computer