JADEPUFFER agentic ransomware returns, targets AI assets with ENCFORGE payload

JADEPUFFER, revealed as the first known agentic ransomware threat actor in early July, was found to have launched a subsequent attack utilizing a new payload called ENCFORGE to target and encrypt AI assets, Sysdig reported Monday.  

A few days after the first recorded attack, the AI agent exploited the same Langflow vulnerability that was used in the earlier attack and located an exposed Docker socket that it leveraged to create a privileged escape container and deploy the ENCFORGE payload.

Signs of AI generated code, such as extensive narrative comments and machine-speed adaptation, were seen in both attacks, with a 31-second fix for a login failure being one of the key signs of JADEPUFFER’s agentic nature in the first attack.

In the latest attack, Sysdig found that JADEPUFFER built a complex solution to an initial payload-fetch failure in just five minutes and 24 seconds, generating six Python scripts to construct privileged escape containers, copy ENCFORGE across the namespace boundary via procfs, trigger encryption and verify its success by enumerating encrypted files with the .locked extension.

ENCFORGE, a Go binary hosted on the attacker’s command-and-control server at the “/.lockd” endpoint, uses a hybrid encryption scheme in which files are encrypted via AES-256-CTR and the per-run symmetric key is encrypted with RSA-2048. This is in contrast to the previous attack, which used MySQL’s native AES_ENCRYPT() function to encrypt database files.

The ransomware specifically targets AI-related files with about 180 extensions including model formats such as PyTorch (.pt, .pt2 and .pth), SafeTensors (.safetensors) and llama.cpp quantized models (.ggml and .gguf), training dataset formats such as Apache Arrow (.arrow and .feather), Apache Parquet (.parquet) and TensorFlow (.tfrecord), and other key records such as NumPy arrays (.npy and .npz), TensorFlow and PyTorch chekpoints (.ckpt) and Facebook AI Similarity Search indices (.faiss).

Diana Kelley, CISO at Noma Security, told SC Media that JADEPUFFER and ENCFORGE’s targeted focus on encrypting AI file types “marks an important shift in attacker priorities.”

“Attackers invariably go after what the business values most because that’s what organizations will pay to recover. As enterprise AI becomes a strategic business asset, we should expect attackers to target those assets directly, not just the infrastructure that supports them,” Kelley said.

The ransom note dropped by ENCFORGE threatens deletion of the decryption key if contact is not made with the threat actor within seven days. Sysdig noted that the email address included in the ransom note is the same one used in the note from the first JADEPUFFER attack.

No files were exfiltrated in the attack and there’s no evidence of a leak site being maintained by the attacker, however, Sysdig notes that encryption of critical AI assets such as trained models and training datasets can be highly disruptive and costly for organizations without up-to-date backups.

“Direct recovery costs for a representative enterprise-ready, fine-tuned model run from around $75,000 to $500,000, reflecting current cloud GPU rates across multiple training runs and the engineering hours required to manage them,” the Sysdig researchers wrote.

Kelley said CISOs should be factoring their AI assets into their cyber resilience strategy.

“It’s no longer enough to back up servers and applications. Organizations need to identify their AI crowned jewels and be prepared to recover the entire AI supply chain: deployed and fine-tuned models, training and evaluation data, vector stores, model registries, and the governance artifacts that establish provenance and trust,” Kelley said.

To protect themselves from JADEPUFFER and ENCFORGE attacks, Sysdig recommended organizations patch the Langflow vulnerability tracked as CVE-2025-3248, restrict Docker socket access, avoid running Langflow containers as root and apply filesystem-level access controls for key AI assets such as model weights and training datasets. The researchers also recommended maintaining offline or immutable snapshots of production model artifacts and avoiding storing AI provider API keys in Langflow’s runtime environment.  

Detection opportunities for JADEPUFFER intrusions include Python subprocess execution under the Langflow process user, Docker Engine API calls from any application process, container creation requests with settings such as “Privileged: true”, “PidMode: host”, and “Binds: [“/:/host:rw”]”, and mass creation of “.locked” files.

“The response starts with recognizing that every AI tool in your environment is a privileged identity with access to sensitive systems, credentials and data. Secrets need to be managed outside of the application environment, access boundaries need to be defined and enforced, and what those identities are doing needs to be continuously monitored,” noted Shane Barney, CISO at Keeper Security, in comments to SC Media.