AI-hunting ransomware 'EncForge' locks up model files as JadePuffer agent adapts on the fly

Key points

• Cloud security firm Sysdig reported that an autonomous AI attacker called JadePuffer deployed a new ransomware strain named EncForge against a vulnerable Langflow server.
• EncForge targets roughly 180 file types tied to AI work, including model checkpoints, vector databases and training datasets.
• When the first payload drop failed, the attacker wrote six Python delivery scripts in about five minutes until one worked.
• Sysdig estimates encrypting a single AI model costs an organisation between $75,000 and $500,000, depending on its size and purpose.
• Patch Langflow to version 1.3.0 or later and lock down the Docker socket the attacker used to reach root.

A ransomware crew that runs itself has a new toy, and it's aimed squarely at AI work.

Cloud security company Sysdig says the attacker, which it calls JadePuffer, returned to a previously breached server and dropped a fresh piece of malware named EncForge. Ransomware scrambles a victim's files and demands payment to restore them. What makes JadePuffer unusual is that it's an "agentic" attacker: an AI agent that plans and runs the intrusion by itself, from breaking in to dropping the ransom note.

We first reported JadePuffer on 2 July, when Sysdig documented it handling intrusion, lateral movement and data destruction without a human at the keyboard. This is its second act.

What makes this ransomware different?

EncForge was written to destroy AI work specifically. Where a normal ransomware strain grabs anything available, EncForge hunts about 180 file types that matter inside a machine-learning shop: model checkpoints (the saved state of a trained AI), vector databases (lookup tables that power chatbots and search), and training datasets in formats like Parquet, Arrow and TFRecord.

The command-line help inside the malware lists LoRA adapters and GGML weights as targets. Sysdig reads that as proof the tool was purpose-built rather than a generic file-locker with an AI badge glued on.

EncForge uses AES-256 encryption in counter mode, with the symmetric key secured by an RSA-2048 public key. To move faster it encrypts only portions of each file. A ransom note is dropped with a unique victim ID.

How did the attacker get in?

Through a hole in Langflow, an open-source tool used to build AI workflows. The flaw, tracked as CVE-2025-3248, lets an unauthenticated attacker run their own code on the server. Federal agencies were ordered to patch it back in July, as we reported on 8 July. Once inside, JadePuffer hunted for cloud credentials and API tokens, then found something better: an exposed Docker socket, a management channel that gave it root-level control of the host.

The first attempt to download EncForge failed. Rather than quit, the agent wrote six Python scripts in about five minutes, each fixing the previous problem, until the sixth (deploy.py v2) delivered the payload cleanly. It ran a test scan, launched the real encryption pass, and counted the .locked files to confirm the job was done.

Sysdig, whose findings were also picked up by BleepingComputer, found no sign that data was stolen. EncForge itself carries no theft function.

What is the damage?

Sysdig estimates a single encrypted AI model can cost between $75,000 and $500,000, because retraining takes weeks or months of compute time and human tuning. Vector indexes and fine-tuned checkpoints are often irreplaceable without the original data pipeline.

There's no public word on whether the victim paid.

The Linux variant also carries Windows anti-recovery code, including commands to delete shadow copies and disable boot recovery. A macOS build is hinted at in the code but hasn't been seen in the wild. That detail is worth watching: if a macOS version ships, every ML team running on Apple silicon becomes a target.

What should defenders do?

Patch Langflow to version 1.3.0 or later. Close off the Docker socket so a web application can't reach it. Run Langflow containers as a non-root user, and set strict file-level permissions on model weight directories.

For any team treating trained models as a business asset, back them up the way finance backs up the general ledger.