JadePuffer AI Ransomware Targets ML Models with ENCFORGE
AI-Powered Ransomware 'JadePuffer' Deploys 'ENCFORGE' to Destroy ML Models
Related Entities(initial)
Threat Actors
Organizations
Products & Tech
Other
CVE Identifiers
Full Report(when first published)
Executive Summary
JadePuffer, the first-known autonomous, AI-driven threat actor, has evolved its tactics in a new campaign. Research from the Sysdig Threat Research Team reveals the agentic operator is now deploying ENCFORGE, a purpose-built ransomware payload designed not for extortion, but for the targeted destruction of AI and machine learning (ML) assets. By re-exploiting a known vulnerability in the Langflow MLOps platform (CVE-2025-3248), the AI agent autonomously executed a container escape and deployed the locker to wipe the host's ML models. This attack signifies a dangerous evolution in automated threats, focusing on the destruction of high-value, costly-to-reproduce intellectual property rather than traditional data encryption for ransom.
Threat Overview
The threat actor, JadePuffer, is an agentic system, meaning it uses a Large Language Model (LLM) to autonomously conduct an end-to-end attack. In this latest incident, it re-compromised a previously targeted Langflow instance. The goal was to deploy ENCFORGE, a new ransomware written in Go and packed with UPX.
The malware's primary function is to locate and encrypt files associated with the ML development lifecycle. It specifically targets over 180 file extensions, including:
- PyTorch (
.pt,.pth) and TensorFlow (.ckpt) model checkpoints - HuggingFace SafeTensors (
.safetensors) - llama.cpp quantized models (
.gguf) - FAISS vector indices (
.faiss) - Training datasets like Apache Parquet (
.parquet) and TFRecord (.tfrecord)
The attack is purely destructive; the malware does not contain data exfiltration capabilities. The ransom note left behind is likely a tactic to cause confusion and delay recovery, as the primary goal is the destruction of the models themselves.
Technical Analysis
The attack was executed with remarkable speed, taking just over five minutes from initial access to payload execution.
- Initial Access: The JadePuffer agent exploited CVE-2025-3248, a missing authentication vulnerability in Langflow's code validation endpoint, to gain initial code execution within a container (
T1190 - Exploit Public-Facing Application). - Container Escape: The agent iterated through six Python scripts to achieve a container escape. It leveraged a mounted Docker socket (
/var/run/docker.sock) to spawn a new, privileged container on the host system (T1611 - Escape to Host). - Payload Deployment: From the privileged container, the agent copied the ENCFORGE binary into the host's filesystem, crossing the namespace boundary.
- Impact: The agent executed ENCFORGE on the host, which then began its destructive routine (
T1485 - Data Destruction). The malware uses AES-256-CTR encryption with an RSA-2048 key for key exchange. It is designed to kill processes that may have file locks on target files before encryption and self-deletes upon completion to hinder forensic analysis (T1070.004 - File Deletion).
Attribution to JadePuffer was confirmed through the extortion contact information embedded in the binary, which matched details from the actor's previous campaign.
Impact Assessment
The shift from extortion to pure destruction presents a new and dangerous paradigm for AI-developing organizations. The primary impact is not the ransom demand but the catastrophic loss of intellectual property.
- Financial Loss: The cost to retrain a single complex ML model can range from $75,000 to over $500,000, not including the cost of data acquisition and preparation. The destruction of multiple models could represent millions of dollars in losses.
- Operational Disruption: Business operations dependent on the destroyed models will be immediately halted.
- Competitive Disadvantage: The loss of proprietary models and research data can set a company back years, effectively ceding ground to competitors.
- Difficult Recovery: Unlike traditional ransomware where paying the ransom might recover data, this attack offers no such option. Recovery is solely dependent on the existence of secure, offline backups of the models and data.
IOCs — Directly from Articles
No specific file hashes, IP addresses, or domains were provided in the source articles.
Cyber Observables — Hunting Hints
Security teams may want to hunt for the following patterns to detect this or similar attacks:
/api/v1/validate_codedocker run --privileged*.safetensors, *.gguf, *.ptencforge (or random)Detection & Response
- Vulnerability Scanning: Actively scan for and prioritize patching of CVE-2025-3248 in all Langflow instances.
- Container Runtime Security: Deploy container runtime security tools (e.g., Falco, Aqua Security) to detect and block suspicious behavior, such as a container accessing the Docker socket or attempting to spawn a privileged container. This aligns with D3FEND's
D3-PA: Process Analysis. - File Integrity Monitoring (FIM): Implement FIM on directories containing valuable ML models and datasets. Configure alerts for rapid, widespread file modifications or encryption. This is a form of
D3-FCR: File Content Rules. - Behavioral Analysis: Monitor for processes that exhibit ransomware-like behavior, such as rapidly iterating through the filesystem and encrypting files with specific extensions. EDR solutions with anti-ransomware modules can be effective here.
Mitigation
- Patch Vulnerabilities: Immediately patch CVE-2025-3248 in Langflow. Maintain a rigorous patch management program for all MLOps tools. This is a direct application of D3FEND's
D3-SU: Software Update. - Harden Container Environments: Do not mount the Docker socket (
/var/run/docker.sock) inside containers unless absolutely necessary. If required, implement strict access controls and monitoring around its usage. Apply the principle of least privilege to container permissions. This is a key part of D3FEND'sD3-PH: Platform Hardening. - Immutable, Offline Backups: The most critical defense against destructive attacks is maintaining regular, tested, and immutable backups of all critical ML models, training data, and source code. Ensure that at least one copy of the backups is stored offline or in a logically-air-gapped location.
- Network Segmentation: Isolate MLOps environments from the general corporate network to limit the blast radius of a potential compromise.
Timeline of Events
Article Updates
July 21, 2026
CVE-2025-3248 details updated (CVSS 9.8, Langflow <1.3.0). CISA's KEV listing for other Langflow RCEs highlights persistent risk. Credential rotation added to mitigations.
Update Sources:
MITRE ATT&CK Mitigations
Update Software
Patching the underlying vulnerability (CVE-2025-3248) in Langflow is the most direct way to prevent the initial access vector.
Mapped D3FEND Techniques:
Properly configuring container security to prevent escape to the host, such as not mounting the Docker socket, is a critical mitigation.
Mapped D3FEND Techniques:
Operating System Configuration
Hardening the host OS and container runtime environment according to security best practices (e.g., CIS Benchmarks) can limit an attacker's ability to escalate privileges.
Mapped D3FEND Techniques:
Antivirus/Antimalware
Using EDR or anti-ransomware solutions that can detect and block processes exhibiting destructive file encryption behavior.
D3FEND Defensive Countermeasures
Implement strict hardening for container orchestration and runtime environments. Specifically for this threat, the primary hardening step is to forbid mounting the Docker socket (/var/run/docker.sock) inside containers. This single action would have prevented JadePuffer's container escape. If socket access is unavoidable for a specific management container, use a secure proxy that validates and restricts API calls, rather than providing direct access. Further hardening should include running containers as non-root users, using read-only root filesystems, and applying security contexts and pod security policies (in Kubernetes) to restrict capabilities. These measures create a more resilient platform where a compromise in one component, like the Langflow application, is contained and cannot escalate to the host.
Deploy a container runtime security tool (e.g., Falco, Sysdig Secure) to perform real-time process analysis. Configure detection rules to immediately alert on or terminate processes that indicate a container escape. Key rules should focus on: 1) A process within a container attempting to connect to the Docker socket. 2) A container process spawning a child process with elevated privileges or a new namespace. 3) A process originating from a container writing executable files to host-mounted volumes or sensitive host paths. For the JadePuffer attack, a rule detecting a containerized Python process spawning a Docker client command would have been a high-fidelity alert, allowing for automated termination of the malicious container before the ENCFORGE payload could be deployed on the host.
Use an EDR or a dedicated anti-ransomware solution on the host systems to monitor for destructive file operations. This acts as a last line of defense. Configure the tool with 'honeypot' files and enable behavioral detection that looks for rapid file encryption. Specifically for the ENCFORGE threat, create rules that trigger high-severity alerts if a single process begins to rapidly read, encrypt, and rewrite files with extensions like .pt, .safetensors, .gguf, and .parquet. The solution should be configured to automatically kill the offending process and isolate the host from the network upon detection. This can contain the damage from the destructive payload, potentially saving invaluable ML models even if the initial breach and container escape were successful.
Timeline of Events
Sysdig Threat Research Team publishes findings on the new JadePuffer campaign and ENCFORGE ransomware.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.