JadePuffer returns with ransomware built to target AI models and infrastructure

JadePuffer, the threat actor behind the recently documented extortion operation executed end-to-end by an AI agent, is now attempting to leverage ENCFORGE, novel ransomware created to target AI and machine learning (ML) infrastructure.

The extortion contact embedded in the ransomware is the same one Sysdig researchers found when analyzing that prior campaign. “This is the same operator with a materially upgraded toolkit,” they noted.

How JadePuffer first surfaced

Earlier this month, Sysdig researchers revealed that a threat actor has been using an LLM-powered AI agent to:

Compromise an internet-facing Langflow instance by exploiting a known vulnerability (CVE-2025-3248) in the popular open-source framework for building AI agents and workflows
Pivot to an internet-exposed production server
Encrypted and destroyed a MySQL database and an Alibaba Nacos configuration service. (Exfiltration of the data has not been verified.)

Sysdig’s assessment that the attack was LLM-driven rests on several elements, including the natural-language commentary in the payloads that is typical of LLM-generated code, and the extreme speed at which the agent diagnosed and corrected its own failures.

“The targeted downstream attack leaned on years-old issues, a 2021 Nacos auth-bypass and an unchanged default signing key, against neglected, internet-exposed infrastructure,” the researchers shared, and noted that “agents make spraying the entire historical vulnerability catalogue effectively free, so the long tail of unpatched systems becomes more exposed, not less.”

Enter ENCFORGE

On Monday, Michael Clark, director of threat research at Sysdig, shared a new development: the threat actor has returned to the previously targeted Langflow instance and deployed ENCFORGE, a Go-based ransomware that “targets approximately 180 file extensions, with a deliberately broad sweep of the modern AI/ML stack, including model checkpoints, vector databases, training datasets, and embedding indices in nearly every current format.”

The researchers observed the attacker (i.e., the AI agent) extracting cloud provider keys, database connection strings, and API tokens and reusing/replaying them to access internal database and cache services.

Then, it attempted to fetch the ransomware and deploy it. It succeeded on the second attempt, after quickly devising another approach when the first one failed.

“The combination of Langflow as an entry vector and ENCFORGE as a payload is no coincidence. Langflow deployments sit adjacent to the infrastructure ENCFORGE is designed to destroy: Model weights, vector stores, and training pipelines are exactly what an AI orchestration framework is built to interact with,” Clark explained.

“For organizations building or operating AI infrastructure, the threat model has expanded. Encrypted business files can be restored from backups, but encrypted production models often cannot. Not only can the ransom cost you millions of dollars, but rebuilding and retraining your models can cost $75,000 to $500,000 each.”

Clark’s advice to defenders is to shrink the attack surface by patching known flaws in internet-exposed infrastructure, and harden the container environment by restricting Docker socket access and running Langflow containers as non-root and setting the noexec (“no execution”) flag on any directory the Langflow process is allowed to write into.

He also advises locking down internet-facing AI orchestration tools, maintaining offline snapshots of production model artifacts, not storing AI provider API keys in Langflow’s runtime environment, and retiring default and potentially compromised credentials.

And, as Sysdig researchers previously noted, the fact that the LLM narrates its own intentions in its payloads can be used by defenders for detection and triage.