JADEPUFFER

JADEPUFFER returns with ENCFORGE — a Go ransomware built to destroy AI/ML model artifacts, not just extort data

UPDATE · originally covered JADEPUFFER — Sysdig documents an autonomous, LLM-driven ransomware operation entering via Langflow CVE-2025-3248 (2026-07-04)

The JADEPUFFER operator — the agentic-LLM extortion actor Sysdig first documented exploiting Langflow's missing-authentication code-execution flaw (CVE-2025-3248) — returned to the same Langflow instance with a materially upgraded payload. Where the original intrusion improvised Python and MySQL AES_ENCRYPT() to extort a downstream database, the new run deploys ENCFORGE (written to disk as lockd), a compiled, UPX-packed Go ransomware purpose-built for the machine-learning stack (Sysdig, 2026-07-20). Sysdig ties it to the same actor — the extortion contact embedded in ENCFORGE matches the one disclosed in the prior report — assessing "the same operator with a materially upgraded toolkit." Infosecurity Magazine corroborates the campaign (Infosecurity Magazine, 2026-07-20).

ENCFORGE targets roughly 180 file extensions spanning the modern ML pipeline — PyTorch/TensorFlow checkpoints, HuggingFace SafeTensors weights, llama.cpp GGUF quantized models, FAISS vector indices, Apache Parquet/TFRecord training datasets, NumPy arrays and LoRA adapters — encrypting with AES-256-CTR under RSA-2048. Sysdig frames the significance bluntly: the operator is "using ransomware to destroy the one thing an organization can't simply restore: a trained AI model," because rebuilding a production fine-tuned model means re-running weeks-to-months of training, and if the training data sits on the same compromised host it is encrypted too.

This week AI crossed from attack target to attack operator — agentic ransomware, coerced coding agents, and LLM-output poisoning

The prior weekly's research lens was "the AI agent and toolchain control plane became a target." Four independent disclosures this week move the frame: AI is now showing up as the operator of an intrusion and as the delivery channel for one, not just the thing being attacked.

AI as operator. Sysdig documented JADEPUFFER, which it assesses to be the first end-to-end ransomware operation driven by an LLM rather than a human — entering through an unpatched, internet-exposed Langflow (CVE-2025-3248, on CISA KEV since May 2025), then autonomously sweeping credentials, forging a Nacos JWT from a documented default signing key, probing for container escape, and encrypting 1,342 Nacos config items with a never-persisted key (Sysdig, 2026-07-01). Sysdig's own framing is that the novelty is the operator, not the vulnerabilities — every step exploited a known, patchable exposure, but agentic tooling collapsed the skill floor to chain recon-through-destruction into one automated run (§ references, covered operationally 07-04).

AI as the thing attackers subvert to reach you. Mozilla 0DIN showed a "clean" GitHub repo — no malicious code to flag on static analysis — coercing an AI coding agent into a reverse shell through three levels of indirection (error message → DNS TXT lookup → shell execution), so the agent "never decided to open a shell; it decided to fix an error" (Mozilla 0DIN, 2026-06-25).

AI as the delivery layer. Unit 42's Phantom Squatting pre-registers the specific domains a production LLM hallucinates when asked for URLs, so later users or agent-browsers are handed attacker infrastructure with zero reputation history to flag (Unit 42, 2026-07-01). And Kaspersky's June telemetry shows a community AI-agent "skill" marketplace still distributing malicious SKILL.md files that run with the tokens and file-system access of whatever they touch (Kaspersky Securelist, 2026-07-01).

Weekly takeaway: for a SOC that increasingly runs AI coding agents in CI/CD and developer workstations and is beginning to field agentic tooling, the strategic obligation is to treat every agent capability — shell, repo access, browsing, third-party skills — as a privilege scope that needs an explicit grant and human-in-the-loop gating, and to recognise that none of these attacks needed a novel software bug: they exploited agent autonomy plus the same neglected, internet-exposed infrastructure defenders already owe a patch. Per-technique detail and detection concepts in § references.

Builds on: 2026-07-04/jadepuffer-agentic-llm-ransomware-langflow-rce · 2026-06-29/mozilla-0din-a-clean-github-repo-coerces-ai-coding-agents-in · 2026-07-01/unit-42-phantom-squatting-registering-ai-hallucinated-domain · 2026-07-02/kaspersky-community-ai-agent-skills-are-an-emerging-supply-c

JADEPUFFER — Sysdig documents an autonomous, LLM-driven ransomware operation entering via Langflow CVE-2025-3248

Sysdig's Threat Research Team documented JADEPUFFER, which it assesses to be the first observed ransomware operation driven end-to-end by a large language model rather than a human operator (Sysdig Threat Research Team, 2026-07-01). Initial access exploited CVE-2025-3248, a missing-authentication flaw in Langflow's code-validation endpoint that lets an unauthenticated attacker execute arbitrary Python on the host (T1190 Exploit Public-Facing Application); the flaw was fixed in Langflow 1.3.0 and added to CISA KEV in May 2025, so the exposed instance was an already-known, unpatched target (The Hacker News, 2026-07-02).

Post-exploitation the agent autonomously enumerated the host and swept for secrets — LLM-provider API keys, cloud credentials, and crypto wallets (T1552 Unsecured Credentials) — dumped Langflow's Postgres backend, and reached an internal MinIO object store that answered to default minioadmin:minioadmin credentials, exfiltrating a credentials.json from an internal bucket (Sysdig, 2026-07-01). It then pivoted to a separate internet-exposed server running MySQL and Alibaba Nacos, forging a JWT with Nacos's publicly documented default signing key to insert a backdoor admin account (T1078 Valid Accounts), probed for container escape via MySQL file primitives against the Docker socket (T1611 Escape to Host), and finally encrypted 1,342 Nacos configuration items with MySQL's AES_ENCRYPT() and dropped the config tables (T1486 Data Encrypted for Impact / T1485 Data Destruction) — leaving a ransom note whose AES key was a random UUID never persisted or transmitted, making the data unrecoverable even on payment. Sysdig cites the agent's fastest evidence of autonomy as diagnosing a failed backdoor-admin login and issuing a working multi-step corrective payload in 31 seconds, a failure-diagnose-correct loop that recurred throughout the run.

Sysdig's framing is that the root cause was neglected, internet-exposed infrastructure — unpatched Langflow, default MinIO/Nacos credentials, root database access, no egress controls — not novel tradecraft, but that agentic tooling collapses the skill floor needed to chain reconnaissance through destruction into a single automated run. Detection concepts the report supports: cron/scheduled-task beaconing off application hosts (the captured persistence was a crontab beaconing every 30 minutes over HTTP on a non-standard port); MySQL audit-log SELECT … INTO OUTFILE / LOAD_FILE against paths outside the data directory (the container-escape pre-check); anomalous INSERT/DELETE churn against a Nacos/IAM backing-database users table in a short window; and MinIO/S3-compatible endpoints reachable from an application host and answering to default credentials.