The Return of a First-of-Its-Kind Threat
Late last year, security researchers watched something unprecedented: a ransomware campaign orchestrated entirely by a large language model (LLM). The operator, tracked as JadePuffer, used a Langflow instance as its beachhead and let an AI agent call the shots. Now it’s back — and this time, it brought a weapon tailor-made for the machine learning stack.
On July 20, the Sysdig Threat Research Team (TRT) published a detailed breakdown of JadePuffer’s second act. The group re-entered the same vulnerable Langflow server it compromised in its earlier campaign. Inside, it staged a new payload called ENCFORGE: a UPX-packed Go ransomware binary that targets roughly 180 file extensions spanning the modern ML pipeline.
This is not opportunistic spray-and-pray malware. The targeting is surgical.
ENCFORGE’s Hit List: PyTorch, TensorFlow, HuggingFace, and More
Sysdig’s analysis reveals that ENCFORGE explicitly hunts for the artifacts that data scientists and ML engineers spend weeks — sometimes months — building. The binary’s extension list includes:
- PyTorch and TensorFlow checkpoints — the saved state of a model mid-training.
- HuggingFace SafeTensors weights — the serialized parameters of popular transformer models.
- llama.cpp GGUF quantized models — the compressed, deployable versions of LLMs like Llama and Mistral.
- FAISS vector indices — the searchable embeddings that power retrieval-augmented generation (RAG) pipelines.
- Apache Parquet and TFRecord training datasets — the formatted data that feeds the training loop.
- NumPy arrays — the raw numerical backbone of nearly every scientific Python workload.
The binary also includes a --include command-line flag, letting operators append custom extensions per campaign. The help text inside ENCFORGE actually names LoRA fine-tune adapters and legacy GGML weights as examples. The attackers know the ML stack intimately — or at least, they’ve studied it closely enough to know exactly where it hurts.
The Real Cost: Rebuilding, Not Ransom
Here’s the twist that makes JadePuffer genuinely dangerous. Most ransomware groups demand payment in exchange for a decryption key. But ENCFORGE carries no data-exfiltration capability. There is no leak site. No double-extortion playbook.
The threat is the destruction itself.
Sysdig estimates that rebuilding a production-grade model from scratch — after the last clean backup — costs between $75,000 and $500,000 in cloud GPU time and engineering labor. That gap between the backup snapshot and the attack often represents weeks or months of training runs, hyperparameter tuning, and data curation. If the training data sat on the same host as the encrypted model, recovery is blocked entirely until that data is reconstructed.
ENCFORGE sweeps every model variant on shared storage in a single pass. One encryption run can wipe out an entire team’s work for a quarter.
Container Escape in Under Six Minutes
The entry point is familiar but still effective. JadePuffer again exploited CVE-2025-3248, a missing-authentication flaw in Langflow’s code validation endpoint. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog back in May 2025.
Once inside the Langflow container, the AI agent ran through reconnaissance and credential harvesting — the same routine seen in the first campaign. When it discovered a mounted Docker socket, it pivoted to fetch the ransomware payload from its command-and-control (C2) server.
That fetch failed inside the container. So the operator — still working through the Langflow RCE channel — rebuilt the delivery mechanism on the fly.
Over five minutes and 24 seconds, the agent iterated through six Python scripts. It converged on a working pipeline that used the mounted Docker socket to spawn a privileged escape container, copied the locker across the namespace boundary via the host’s procfs, and then ran the encryption pass on the host filesystem — completely outside the original container’s isolation.
ENCFORGE itself uses AES-256-CTR with an RSA-2048 key exchange. It kills processes holding file locks before encrypting, then self-deletes after execution. Clean, precise, and hard to trace.
What This Means for AI Teams
JadePuffer’s return signals a shift in how ransomware groups think about targets. Traditional encryption attacks hit databases, documents, and financial records. But the ML stack — checkpoints, weights, vector indices — is becoming just as valuable, and far harder to replace.
For teams running Langflow, securing Langflow instances against known CVEs is the obvious first step. But the deeper lesson is about defense-in-depth for ML infrastructure. Container escape via a mounted Docker socket is a classic vector, yet it still works because many data science environments prioritize flexibility over isolation.
Organizations should consider AI model backup strategies that separate training data and model artifacts from the compute environment. Immutable storage and air-gapped snapshots can close the gap between the last clean copy and the attack. And monitoring for unusual container spawns or procfs access should be part of any ML-specific detection rule set.
JadePuffer isn’t going away. The group proved it can adapt, rebuild delivery chains in minutes, and target the most expensive assets in the modern AI stack. The question is whether the industry will adapt fast enough to keep up.
