01
CriticalJADEPUFFERAI Model Ransomware
JADEPUFFER returns with ENCFORGE, ransomware built to destroy AI models, training data, and vector databases
The operator came back to the same server it hit three weeks ago, same entry point, same CVE. This time it brought a payload built for a specific purpose: encrypting the assets behind machine learning systems. Backups can restore business data. Weeks of training runs are not so easy to recover.
OperatorJADEPUFFER (ATA)
PayloadENCFORGE
(Go, UPX-packed)
(Go, UPX-packed)
Entry CVECVE-2025-3248
Langflow RCE
Langflow RCE
Targets~180 ML file types:
.ckpt .safetensors
.gguf .faiss
.parquet .pt .pkl
.ckpt .safetensors
.gguf .faiss
.parquet .pt .pkl
What happened
Sysdig's Threat Research Team documented JADEPUFFER returning to a Langflow server that the operator had previously compromised via CVE-2025-3248, the same unauthenticated remote code execution flaw it used in its original July 7 campaign. The operator's AI agent again iterated Python scripts through the Langflow RCE channel, this time building and deploying ENCFORGE, a compiled Go binary packed with UPX. The agent devised six Python scripts over roughly five minutes before landing on a working approach, using the mounted Docker socket to spawn a privileged container, copy the ransomware binary across the namespace boundary via the host's procfs, and run the encryption pass on the host filesystem outside the original container's isolation. ENCFORGE uses AES-256-CTR encryption with RSA-2048 key exchange. It targets approximately 180 file extensions spanning the modern machine learning stack: PyTorch and TensorFlow checkpoints (.ckpt, .pt), HuggingFace SafeTensors weights (.safetensors), llama.cpp GGUF models (.gguf), FAISS vector indexes (.faiss), Apache Parquet and TFRecord training datasets (.parquet), NumPy arrays (.npy, .npz), and ONNX model files (.onnx), among others. A command-line flag lets operators append additional extensions per campaign. Sysdig found no data exfiltration capability in the binary and no leak site associated with this operation, which places JADEPUFFER outside the double-extortion model used by most ransomware groups. The ransomware kills processes holding file locks before encrypting, then self-deletes after running.
Why it matters
ENCFORGE targets assets that most enterprise backup strategies do not cover well. Business data restores from snapshots. Model checkpoints, fine-tuned weights, and curated training datasets represent weeks or months of compute time, data labeling work, and iterative training runs. The gap between the last clean snapshot and an ENCFORGE attack may contain more organizational value than the gap in any conventional data backup scenario. Any organization running AI workloads on infrastructure accessible from the internet via Langflow, or connected to systems that are, now has a named payload to defend against with a documented entry vector and a documented target list.
Don't miss
JADEPUFFER came back to the same Langflow server it had already compromised. The original July 7 attack, covered in Issue 80, used throwaway Python code to encrypt a Nacos configuration service. The second attack used a purpose-built binary to target AI model files specifically. Two observations from Sysdig stand out: first, the operator rebuilt the container escape chain from scratch and succeeded within six scripts and five minutes, which demonstrates the agent's ability to adapt to a partially mitigated environment. Second, ENCFORGE's code hints at a macOS variant that has not yet been confirmed in the wild. The fact that JADEPUFFER returned to a server it previously hit suggests that initial remediation after the July 7 attack was incomplete. Sysdig noted the Langflow instance was still running a version vulnerable to CVE-2025-3248.
Potential actions
- Patch Langflow to version 1.3.0 or later immediately. The entry point for both JADEPUFFER attacks is CVE-2025-3248, which has been in CISA KEV since May 2025. Any Langflow instance still below 1.3.0 is directly in scope for this operator.
- Extend your backup strategy to cover ML artifacts explicitly: model checkpoints, fine-tuned weights, vector indexes, and training datasets. Store them in immutable, air-gapped or write-once storage separate from the primary compute environment. Test restoration of these assets, not just business data.
- Audit Docker socket exposure on any server running containerized AI workloads. Mounting the Docker socket inside a container grants the container full host access. ENCFORGE's container escape relied on this configuration. Remove the socket mount where it is not operationally required.
The Sip
JADEPUFFER came back to the same server, through the same door, and this time brought a payload built to destroy the one thing most ML teams have never thought to back up properly. Patch the CVE. Extend your backups. And check whether the July 7 server was actually fully remediated.