The Return of a First-of-Its-Kind Threat

Late last year, security researchers watched something unprecedented: a ransomware campaign orchestrated entirely by a large language model (LLM). The operator, tracked as JadePuffer, used a Langflow instance as its beachhead and let an AI agent call the shots. Now it’s back — and this time, it brought a weapon tailor-made for the machine learning stack.

On July 20, the Sysdig Threat Research Team (TRT) published a detailed breakdown of JadePuffer’s second act. The group re-entered the same vulnerable Langflow server it compromised in its earlier campaign. Inside, it staged a new payload called ENCFORGE: a UPX-packed Go ransomware binary that targets roughly 180 file extensions spanning the modern ML pipeline.

This is not opportunistic spray-and-pray malware. The targeting is surgical.

ENCFORGE’s Hit List: PyTorch, TensorFlow, HuggingFace, and More

Sysdig’s analysis reveals that ENCFORGE explicitly hunts for the artifacts that data scientists and ML engineers spend weeks — sometimes months — building. The binary’s extension list includes:

• PyTorch and TensorFlow checkpoints — the saved state of a model mid-training.
• HuggingFace SafeTensors weights — the serialized parameters of popular transformer models.
• llama.cpp GGUF quantized models — the compressed, deployable versions of LLMs like Llama and Mistral.
• FAISS vector indices — the searchable embeddings that power retrieval-augmented generation (RAG) pipelines.
• Apache Parquet and TFRecord training datasets — the formatted data that feeds the training loop.
• NumPy arrays — the raw numerical backbone of nearly every scientific Python workload.

The binary also includes a --include command-line flag, letting operators append custom extensions per campaign. The help text inside ENCFORGE actually names LoRA fine-tune adapters and legacy GGML weights as examples. The attackers know the ML stack intimately — or at least, they’ve studied it closely enough to know exactly where it hurts.

The Real Cost: Rebuilding, Not Ransom

Here’s the twist that makes JadePuffer genuinely dangerous. Most ransomware groups demand payment in exchange for a decryption key. But ENCFORGE carries no data-exfiltration capability. There is no leak site. No double-extortion playbook.

The threat is the destruction itself.

Sysdig estimates that rebuilding a production-grade model from scratch — after the last clean backup — costs between $75,000 and $500,000 in cloud GPU time and engineering labor. That gap between the backup snapshot and the attack often represents weeks or months of training runs, hyperparameter tuning, and data curation. If the training data sat on the same host as the encrypted model, recovery is blocked entirely until that data is reconstructed.

ENCFORGE sweeps every model variant on shared storage in a single pass. One encryption run can wipe out an entire team’s work for a quarter.

Container Escape in Under Six Minutes

The entry point is familiar but still effective. JadePuffer again exploited CVE-2025-3248, a missing-authentication flaw in Langflow’s code validation endpoint. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog back in May 2025.

Once inside the Langflow container, the AI agent ran through reconnaissance and credential harvesting — the same routine seen in the first campaign. When it discovered a mounted Docker socket, it pivoted to fetch the ransomware payload from its command-and-control (C2) server.

That fetch failed inside the container. So the operator — still working through the Langflow RCE channel — rebuilt the delivery mechanism on the fly.

Over five minutes and 24 seconds, the agent iterated through six Python scripts. It converged on a working pipeline that used the mounted Docker socket to spawn a privileged escape container, copied the locker across the namespace boundary via the host’s procfs, and then ran the encryption pass on the host filesystem — completely outside the original container’s isolation.

ENCFORGE itself uses AES-256-CTR with an RSA-2048 key exchange. It kills processes holding file locks before encrypting, then self-deletes after execution. Clean, precise, and hard to trace.

What This Means for AI Teams

JadePuffer’s return signals a shift in how ransomware groups think about targets. Traditional encryption attacks hit databases, documents, and financial records. But the ML stack — checkpoints, weights, vector indices — is becoming just as valuable, and far harder to replace.

For teams running Langflow, securing Langflow instances against known CVEs is the obvious first step. But the deeper lesson is about defense-in-depth for ML infrastructure. Container escape via a mounted Docker socket is a classic vector, yet it still works because many data science environments prioritize flexibility over isolation.

Organizations should consider AI model backup strategies that separate training data and model artifacts from the compute environment. Immutable storage and air-gapped snapshots can close the gap between the last clean copy and the attack. And monitoring for unusual container spawns or procfs access should be part of any ML-specific detection rule set.

JadePuffer isn’t going away. The group proved it can adapt, rebuild delivery chains in minutes, and target the most expensive assets in the modern AI stack. The question is whether the industry will adapt fast enough to keep up.

A New Crypter on the Block

In the underground malware ecosystem, a new service is making waves. It’s called Cruciferra, and it’s been quietly powering attacks that spread AsyncRAT, Agent Tesla, Remcos, XWorm, ValleyRAT, and Snake Keylogger. The price tag? Between $450 and $2,000 a month, depending on the tier.

On July 20, Proofpoint published a deep dive into this crypter. First spotted for sale on the Exploit forum in autumn 2025, Cruciferra has already been linked to dozens of campaigns. The researchers found both active samples and what look like test builds, suggesting the developers are still iterating.

On dark web forums, the service bills itself as “the underground’s most lethal crypter.” The evidence suggests that’s not just marketing.

How Cruciferra Gets Past Defenses

Every observed Cruciferra attack follows the same initial pattern: DLL side-loading. Victims receive a ZIP file containing a legitimate executable paired with a malicious DLL. When the executable runs, it loads the DLL, which checks the environment before dropping the payload.

The DLL itself is a clever piece of obfuscation. It contains hundreds of decoy exported functions that point to junk code. Only one or two actually call the real routine. That makes it harder for automated analysis tools to figure out what’s happening.

Before executing the final payload, Cruciferra goes to work unhooking endpoint detection and response (EDR) tools. It patches the Import Address Table. It reads a clean copy of ntdll.dll from disk to source indirect syscalls, bypassing user-land hooks. And it disables kernel-level telemetry by loading a vulnerable signed driver — in this case, GoFlyDrv.sys — then issuing IOCTL commands to kill security processes.

This bring-your-own-vulnerable-driver (BYOVD) approach is the same technique used by the GentleKiller framework, which the Gentlemen ransomware gang distributes to its affiliates. It’s a known tactic, but it’s effective.

More Than 90 Encryption Routines — and Rarely the Same One Twice

The payloads themselves sit in the binary’s .reloc section. To unpack them, Cruciferra uses one of over 90 encryption routines. These routines are assembled from parts of established algorithms — Keccak, Threefish, Feistel variants — mixed and matched so that the cipher covering one sample almost never matches the next.

That variability makes signature-based detection nearly useless. Even if a security vendor catches one variant, the next sample might use a completely different encryption scheme.

Process Ghosting — With a Twist

The final execution step is where Cruciferra really shows its sophistication. It uses a modified form of process ghosting. The classic technique creates a temporary file marked for deletion, fills it with the payload, and uses it as the backing image for a suspended process. The result: a running process backed by a PE image that no longer exists on disk in scannable form.

But Cruciferra adds two anti-inspection layers. First, it patches ZwQueryVirtualMemory so that EDR queries against the ghosted memory return a sanitized result. Second, it neuters NtManageHotPatch, the kernel function that can validate a loaded image against its on-disk counterpart.

In plain English: even if a security tool tries to peek at the ghosted process, it gets back clean data. And the kernel can’t compare the in-memory image to the file on disk because the file is already gone.

Who’s Behind the Attacks

Proofpoint attributed multiple campaigns using Cruciferra to the Chinese-speaking group TA4922. Between late April and early June, TA4922 used tax-themed lures impersonating the Indian Income Tax Department to deliver AsyncRAT.

In separate May campaigns, the group spoofed the US Social Security Administration to drop XWorm. And in late June, they used bed-bug guest-complaint lures against hospitality organizations to deliver zgRAT.

The targeting appears opportunistic. Financial services made up 34% of observed victims, healthcare 25%, and government 10%. But Proofpoint noted that new Cruciferra-packed samples appeared on VirusTotal every few minutes on July 9. That’s a lot of volume for a service that’s only been around since autumn 2025.

What This Means for Defenders

Cruciferra is a reminder that the malware-as-a-service economy keeps innovating. For $450 a month, any criminal group can get a crypter that uses process ghosting, kernel driver abuse, and custom encryption to bypass modern defenses.

For security teams, the key takeaways are straightforward. First, DLL side-loading remains a common entry point — monitor for unusual executable/DLL pairings. Second, BYOVD attacks require kernel-level visibility; if you can block known vulnerable drivers like GoFlyDrv.sys, you raise the bar. And third, process ghosting is no longer a niche technique. It’s now available as a service.

Cruciferra may call itself the most lethal crypter on the underground. Whether or not that’s true, it’s clearly effective enough to worry about.

No Clicks, No Permissions: How a Critical Opera GX Flaw Worked

A serious security hole in Opera GX, the gaming-focused browser from Opera, allowed any website to silently install a customization mod — and then use that mod to siphon data from sites the victim had visited. The attack required zero user interaction. No clicking. No permission prompts. Just a hidden frame loading a file.

Discovered by an independent researcher known as zhero_web_security, the Opera GX flaw exploited the browser’s GX Mods system. Unlike standard browser extensions, GX Mods are supposed to be lightweight — they customize the browser’s look, sounds, and website styling, but carry no permissions and can’t execute JavaScript. That’s what made the discovery so unsettling: the mods weren’t supposed to be dangerous. Yet the researcher found a way to weaponize them.

Auto-Install: The Core of the Opera GX Vulnerability

Here’s the mechanical problem. When a user downloads a GX Mod file, it installs automatically. No dialogue box asks for approval. No permission request pops up. The researcher realized that an attacker could place a mod file inside a hidden HTML frame on a malicious website. As soon as the page loads, the mod lands in the browser — completely silent.

Once installed, the mod’s CSS (cascading style sheets) applies to every single tab and page the victim opens. Ordinary CSS injection is usually confined to one page. This was different. The Opera GX vulnerability gave the attacker a persistent foothold across the entire browser session.

Gmail Addresses and Browser Crashes: Proof of Concept

CSS cannot read a page’s content directly. But it can be cleverly crafted to trigger network requests based on what a page contains. That technique, known as an XS-Leak (cross-site leak), lets an attacker extract data bit by bit, character by character.

Using this method, the researcher built a zero-click exploit that recovered a victim’s full Gmail address. The attack silently redirected the browser to a Google account page, then used the injected CSS to leak the email address character by character. The researcher noted the method is not limited to Gmail — any data rendered on a page could theoretically be targeted.

The same auto-install behavior also enabled a denial-of-service (DoS) attack against both Opera and Opera GX. Chromium-based browsers block extensions in private or Incognito windows. Forcing a mod to install in Incognito mode caused the browser to crash — and wiped all open tabs in the process. Any file with a .crx extension triggered the crash, whether or not it was a legitimate mod.

From Low Priority to Critical: Opera’s Bug Bounty Response

The researcher reported the Opera GX flaw in February 2024 through Opera’s Bugcrowd bug bounty program. Initially, the team triaged it as low priority. That changed quickly. Opera’s security team reassessed the issue and reclassified it as critical.

A patch shipped on May 8, 2024, and the researcher received a $5,000 bounty payment. The full proof of concept was published on July 3, tested against Opera GX version 127.0.5778.41 — after the fix had already been distributed.

What This Means for Browser Security and Users

This isn’t the first time browser customization features have opened unexpected attack surfaces. But the Opera GX vulnerability is a sharp reminder that even permissionless systems can be dangerous. GX Mods were designed to be safe because they lack extension-level privileges. But CSS injection, combined with auto-installation, turned that safety assumption into a liability.

For users, the fix is straightforward: update Opera GX to the latest version. The browser should update automatically, but it’s worth checking. Anyone running a version prior to the May 8 patch is still exposed.

For the broader security community, the case raises questions about how browsers handle file-based installations and whether similar flaws exist in other Chromium-based browsers. The researcher’s work demonstrates that even a seemingly harmless mod can become a data theft tool — as long as it arrives without a click.