JADEPUFFER returns with ENCFORGE — a Go ransomware built to destroy AI/ML model artifacts, not just extort data
UPDATE · originally covered JADEPUFFER — Sysdig documents an autonomous, LLM-driven ransomware operation entering via Langflow CVE-2025-3248 (2026-07-04)
The JADEPUFFER operator — the agentic-LLM extortion actor Sysdig first documented exploiting Langflow's missing-authentication code-execution flaw (CVE-2025-3248) — returned to the same Langflow instance with a materially upgraded payload. Where the original intrusion improvised Python and MySQL AES_ENCRYPT() to extort a downstream database, the new run deploys ENCFORGE (written to disk as lockd), a compiled, UPX-packed Go ransomware purpose-built for the machine-learning stack (Sysdig, 2026-07-20). Sysdig ties it to the same actor — the extortion contact embedded in ENCFORGE matches the one disclosed in the prior report — assessing "the same operator with a materially upgraded toolkit." Infosecurity Magazine corroborates the campaign (Infosecurity Magazine, 2026-07-20).
ENCFORGE targets roughly 180 file extensions spanning the modern ML pipeline — PyTorch/TensorFlow checkpoints, HuggingFace SafeTensors weights, llama.cpp GGUF quantized models, FAISS vector indices, Apache Parquet/TFRecord training datasets, NumPy arrays and LoRA adapters — encrypting with AES-256-CTR under RSA-2048. Sysdig frames the significance bluntly: the operator is "using ransomware to destroy the one thing an organization can't simply restore: a trained AI model," because rebuilding a production fine-tuned model means re-running weeks-to-months of training, and if the training data sits on the same compromised host it is encrypted too.
In a new development, the operator behind JADEPUFFER has doubled down on that bet, using ransomware to destroy the one thing an organization can't simply restore: a trained AI model.
Defender actions
- For any Langflow or self-hosted AI-pipeline estate, confirm model checkpoints and training datasets are backed up to storage isolated from the compute host — ENCFORGE encrypts ~180 ML-artifact file types and any training data sitting on the same host, so a co-located backup is inside the blast radius and recovery would otherwise mean re-training from scratch.
ATT&CK mapping
3 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Privilege Escalation TA0004
T1611Escape to Host
Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.
Impact TA0040
T1486Data Encrypted for Impact
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Update chain
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.