AI-hunting ransomware 'EncForge' locks up model files as JadePuffer agent adapts on the fly

Key points

• Cloud security firm Sysdig reported this week that an autonomous AI attacker called JadePuffer deployed a new ransomware strain named EncForge against a vulnerable Langflow server.
• EncForge is built to encrypt roughly 180 file types tied to artificial intelligence work, including model checkpoints, training datasets and vector databases.
• The attacker wrote and tested six Python delivery scripts in about five minutes when the first payload drop failed.
• Sysdig estimates the damage from encrypting a single AI model at $75,000 to $500,000, depending on its size and purpose.
• The fix is Langflow version 1.3.0 or later, plus locking down the Docker socket the attacker used to gain root control.

A ransomware crew that runs itself has a new toy, and it is aimed squarely at artificial intelligence work.

Cloud security company Sysdig says the attacker, which it calls JadePuffer, returned to a previously breached server and dropped a fresh piece of malicious software named EncForge. Ransomware is software that scrambles a victim's files and demands payment to unlock them. What makes JadePuffer unusual is that it is an "agentic" attacker: an AI agent that plans and runs the intrusion by itself, from breaking in to demanding the ransom.

Sysdig disclosed JadePuffer earlier this month. This is its second act.

What makes this ransomware different?

EncForge was written specifically to destroy AI work. Where a normal ransomware strain grabs anything it can find, EncForge hunts about 180 file types that only matter inside a machine-learning shop: model checkpoints (the saved brains of a trained AI), vector databases (the lookup tables that power chatbots and search), and training datasets in formats like Parquet, Arrow, TFRecord and NumPy.

The command-line help inside the malware even lists LoRA adapters and GGML weights as examples. Sysdig reads that as proof the tool was purpose-built, not a generic file-locker with an AI badge glued on.

Under the hood, EncForge uses AES-256 encryption with an RSA-2048 key to lock files, and appends a .locked extension to each one. To move faster it encrypts only parts of each file rather than the whole thing. A ransom note is dropped on the machine with a unique victim ID.

How did the attacker get in?

Through a hole in Langflow, an open-source tool used to build AI workflows. The flaw, tracked as CVE-2025-3248, lets an unauthenticated attacker run their own code on the server. Once inside, JadePuffer hunted for cloud credentials and API tokens, and found something better: an exposed Docker socket, a management channel that gave it root-level control of the host.

The first attempt to download EncForge failed. Rather than give up, the AI agent wrote six Python scripts in about five minutes, each one fixing the previous problem, until the sixth (deploy.py v2) delivered the payload cleanly. It then ran a test scan, launched the real encryption, and counted the .locked files to confirm the job was done.

Sysdig, whose findings were also picked up by BleepingComputer, found no sign that data was stolen during the break-in. EncForge itself does not appear to have a theft function bolted on.

What is the damage?

Sysdig estimates a single encrypted AI model can cost an organisation between $75,000 and $500,000, because retraining takes weeks or months of compute time and human tuning. Vector indexes and fine-tuned checkpoints are often irreplaceable without the original data pipeline.

There is no public word yet on whether the current victim paid.

The Linux version of EncForge also carries Windows anti-recovery code, including commands to delete shadow copies and disable boot recovery. A macOS build is hinted at in the code but has not been seen in the wild.

What should defenders do?

Patch Langflow to version 1.3.0 or later. Close off the Docker socket so a web app cannot reach it. Run Langflow containers as a non-root user, and put strict file-level permissions on the directories where model weights live.

For teams that treat their trained models as a business asset, back them up the way finance backs up the general ledger.