JadePuffer Returns with ENCFORGE Ransomware Targeting AI Models
The threat actor known as JadePuffer has resurfaced with a new ransomware variant, ENCFORGE, specifically engineered to destroy trained AI model artifacts, marking a significant escalation in ransomware tactics.
The sophisticated threat actor previously documented as the first to use a large language model (LLM) for end-to-end ransomware operations, JadePuffer, has returned with a novel ransomware variant named ENCFORGE. This new payload is purpose-built to target and destroy trained AI model artifacts, representing a significant evolution in ransomware tactics beyond traditional data encryption.
Sysdig Threat Research Team (TRT) research, published on July 20, reveals that JadePuffer re-entered a compromised Langflow instance, the same environment targeted in its earlier campaign. There, the actor deployed ENCFORGE, a Go-based ransomware binary packed with UPX, which targets approximately 180 file extensions crucial to the modern machine learning ecosystem.
The ransomware's targeting is highly deliberate, focusing on formats essential for AI development. This includes PyTorch and TensorFlow checkpoints, HuggingFace SafeTensors weights, llama.cpp GGUF quantized models, FAISS vector indices, and training datasets in Apache Parquet and TFRecord formats, as well as NumPy arrays. The inclusion of specific file extensions like LoRA fine-tune adapters and legacy GGML weights, mentioned in the binary's help text, further underscores the specialized nature of this attack.
Unlike typical ransomware that encrypts data for ransom, ENCFORGE aims for destruction. Rebuilding compromised AI models can be prohibitively expensive, with Sysdig estimating the cost to reproduce the training gap at $75,000 to $500,000 per model, encompassing cloud GPU costs and engineering time. If training data resides on the same host, recovery becomes impossible without reconstruction, making the destruction of these assets particularly devastating.
Entry into the target environment was again achieved through CVE-2025-3248, a critical missing-authentication vulnerability in Langflow's code validation endpoint. This flaw was previously recognized by CISA, which added it to its Known Exploited Vulnerabilities (KEV) catalog in May 2025. Following initial access, the actor executed familiar reconnaissance and credential-harvesting routines before discovering a mounted Docker socket.
In a notable display of adaptability, when the initial attempt to fetch the ransomware payload from JadePuffer's command-and-control (C2) server failed within the container, the operator dynamically rebuilt the delivery mechanism. Over approximately five minutes, the actor used six Python scripts executed via the Langflow RCE channel to establish a working pipeline. This pipeline leveraged the mounted Docker socket to spawn a privileged escape container, copy the locker to the host filesystem via the procfs, and then execute the encryption pass outside the original container's isolation.
The ENCFORGE ransomware itself employs AES-256-CTR encryption with an RSA-2048 key exchange. It is designed to terminate processes that hold file locks before encryption and self-deletes after completion. Notably, Sysdig's analysis found no evidence of data exfiltration capabilities or a corresponding leak site, indicating that JadePuffer's primary objective is the destruction of AI models rather than adhering to the double-extortion model prevalent among most ransomware-as-a-service (RaaS) groups.
This campaign highlights a concerning trend where threat actors are developing specialized tools to target high-value, often difficult-to-replicate digital assets like AI models. The focus on destroying these assets, rather than encrypting them for ransom, presents a new and significant challenge for organizations heavily invested in AI development and deployment, forcing a re-evaluation of backup and recovery strategies for machine learning infrastructure.
The JadePuffer threat actor has evolved its tactics by integrating a custom ransomware named EncForge, specifically designed to target and encrypt AI-related assets such as training datasets, vector databases, and model checkpoints. This new variant was observed in a recent attack on a Langflow instance, demonstrating the actor's ability to adapt and optimize intrusion mechanisms in real-time, even developing a fully autonomous encryption pipeline within minutes.