• 2 min read
JadePuffer shifts to AI ransomware attacks
Sysdig says JadePuffer now deploys EncForge, malware built to encrypt AI model checkpoints, vector databases, and training datasets.
Image: BleepingComputer
JadePuffer, the autonomous threat actor disclosed earlier this month, has been upgraded with custom ransomware aimed squarely at AI and machine learning infrastructure. According to Sysdig, the new malware, called EncForge, is designed to encrypt training datasets, vector databases, model checkpoints, and embedding indexes rather than conventional business files.
Sysdig says the attacker revisited a previously breached Langflow instance vulnerable to CVE-2025-3248. After gaining access, the intruder searched for cloud credentials, API tokens, and reachable internal services, then found an exposed Docker socket that granted root-level control.
When the first attempt to download the ransomware failed, Sysdig says the operator adapted quickly, creating and deploying six Python scripts in five minutes. The final script, deploy.py v2, fixed the delivery problem and completed the attack chain.
“deploy.py v2 is the completed payload: a fully autonomous pipeline that discovers the target PID, copies ENCFORGE across the namespace boundary via procfs, runs a try-mode scan, launches the live encryption pass, and then counts .locked files to verify execution,” Sysdig explained.
EncForge targets modern AI stacks
Sysdig says the Go-based ransomware binary, also referred to as lockd, is packed with UPX and targets about 180 file extensions across the AI stack, including:
Recommended reading
Free 0Patch fix arrives for Windows LegacyHive zero-day
- Hugging Face SafeTensors files
- PyTorch and TensorFlow models
- GGUF and GGML weights
- FAISS vector indexes
- Training data formats such as Parquet, Arrow, TFRecord, NumPy, and DuckDB
The researchers said the command-line help also references LoRA adapters and legacy GGML files, which they see as a sign the malware was built specifically for AI environments.
EncForge uses AES-256 in counter mode for file encryption, with the symmetric key protected by an RSA-2048 public key. To speed things up, it encrypts only parts of each file, appends the .locked extension, and drops a ransom note with a unique identifier for the victim.
Sysdig said it found no evidence of data exfiltration during the intrusion, and EncForge does not appear to include a built-in data theft feature. The Linux sample also contains Windows anti-recovery functions such as shadow copy deletion and boot recovery disabling. A macOS version is hinted at in the code but remains unconfirmed.
Sysdig estimates that losing model weights, training datasets, and vector indexes to encryption could set organizations back weeks or months and cost between $75,000 and $500,000 per model, depending on size and purpose. The firm recommends updating to Langflow 1.3.0 or later, restricting Docker socket access, running Langflow containers as non-root, and applying filesystem-level controls to model weight directories.
Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.
via BleepingComputer
