EncForge: JadePuffer Hits Irrecoverable AI Models With Agentic…

The agentic threat actor JadePuffer has deployed EncForge, ransomware purpose-built for AI/ML assets. Encrypted models cannot be recovered from backups; retraining costs range from $75,000 to $500,000 per model.

On July 20, 2026, the agentic threat actor JadePuffer executed an attack that marks a breaking point in ransomware targeting: the deployment of EncForge, a payload specialized in encrypting artificial intelligence and machine learning assets. According to analysis by the Sysdig Threat Research Team, the operation combines an initial access vector in an AI orchestration framework — Langflow, exploited via CVE-2025-3248 — with a Go-based ransomware that targets roughly 180 file extensions specific to the ML stack, from model checkpoints to vector databases. The stakes are not data theft: they are the destruction of irrecoverable assets, with recovery costs ranging from $75,000 to $500,000 per model.

Key Takeaways

EncForge targets approximately 180 AI/ML stack file extensions, including Parquet, Arrow, TFRecord, LoRA adapters, and embedding indexes, using AES-256-CTR and RSA-2048 algorithms.
JadePuffer operates as an Agentic Threat Actor: it iterated six Python scripts in five minutes and 24 seconds to correct an initial deployment failure, converging on deploy.py v2 with a working container escape.
The escape mechanism exploits an exposed /var/run/docker.sock to create privileged containers with a bind mount of the host root and copies the binary via procfs.
No evidence of data exfiltration in EncForge: the objective is pure encryption of assets that conventional backups cannot recover, with estimated retraining times of months.

From Script to Compiled Tooling: JadePuffer's Agentic Evolution

JadePuffer is classified as an Agentic Threat Actor, an operational profile that distinguishes this operator from traditional ransomware groups. Sysdig documentation describes autonomous diagnosis-and-fix cycles: in the previous campaign, the actor completed failure-to-fix cycles in 31 seconds. In the July 20 EncForge attack, the iteration was more complex — six Python scripts in five minutes and 24 seconds — but maintained the same pattern of real-time self-correction.

The final payload, deploy.py v2, is a fully autonomous pipeline that identifies the target PID, copies EncForge across the namespace boundary via procfs, runs a proof-of-concept scan, launches live encryption, and finally counts files with the .locked extension to verify execution. Natural-language comments inside the code — termed "self-narrating payloads" by researchers — confirm the automation is not merely mechanical but goal-oriented, with intermediate verification steps.

The EncForge binary, alias 'lockd', is compiled in Go and packed with UPX. According to Sysdig, its structure reflects deliberate development: it is not an opportunistic script adapted for the purpose, but tooling built for the specific objective. The partial SHA-256 recovered is 8cb0c223b018cecef1d990ec81c67b826eb3c.

CVE-2025-3248 and the Langflow Compromise Chain

The initial access vector is CVE-2025-3248, a missing-authentication vulnerability in Langflow's /api/v1/validate/code endpoint, added to the CISA KEV catalog in May 2025. The AI orchestration framework — used to build Retrieval-Augmented Generation pipelines and LLM agent flows — represents a natural bridge to downstream infrastructure.

According to Michael Clark, Director of Threat Research at Sysdig: "The combination of Langflow as an initial access vector and EncForge as a payload is not coincidental. Langflow deployments sit adjacent to the infrastructure EncForge is designed to destroy." Compromised instances typically host credentials for vector databases, model endpoints, and training-set storage: a position that allows the threat actor to map and strike assets beyond the initial container.

From the initial compromise, JadePuffer exploited an exposed Docker socket at /var/run/docker.sock to create a privileged container with explicit parameters: PidMode set to 'host', bind mount of /:/host:rw, and the Privileged flag active. The lockd binary was copied through /proc/ /root/tmp/.sk/lockd, achieving escape with root control over the host.

The 180-Extension Crosshairs: Why Backups Don't Save Models

EncForge stands out for the specificity of its targeting. According to Sysdig: "The binary targets approximately 180 file extensions, with deliberately broad coverage of the modern AI/ML stack, including model checkpoints, vector databases, training datasets, and embedding indexes in nearly every current format." The list includes Parquet, Apache Arrow, TFRecord, NumPy files, DuckDB databases, LoRA adapters, and GGML formats — a range covering the entire model lifecycle from data collection to production deployment.

Encryption operates with AES-256 in counter mode, with the symmetric key protected by an RSA-2048 public key. To optimize performance, EncForge encrypts selected portions of files rather than their entire contents, and appends the .locked extension to processed files. The Linux variant is confirmed; the code contains references to Windows-typical anti-recovery functions — shadow copy deletion and boot recovery disablement — but the actual existence of a macOS version, hinted at but unverified, is not confirmed.

The fact that alters the threat model is the absence of data-stealing mechanisms. EncForge does not exfiltrate: it encrypts and demands ransom. The extortion contact e78393397@proton.me matches JadePuffer's previous campaign, confirming — as Sysdig stated via HelpNetSecurity — that this is "the same operator with a materially updated toolkit."

Immediate Actions

Verify exposure of Langflow instances: CVE-2025-3248 carries a CVSS 9.8 CRITICAL rating and requires missing authentication on the /api/v1/validate/code endpoint; its presence in the CISA KEV indicates patching priority.
Isolate or remove Docker socket (/var/run/docker.sock) exposure from AI orchestration containers: the bind mount represents a documented and automated escape vector in this attack.
Review backup strategy for AI/ML assets: trained models, intermediate checkpoints, and vector databases require tested recovery plans, not assuming conventional backups cover the full stack.
Monitor for binaries with a partial SHA-256 matching 8cb0c223b018cecef1d990ec81c67b826eb3c and for Python scripts with self-narration patterns and rapid iteration in the cluster.

"Encrypted business files can be restored from backups, but encrypted production models often cannot. Not only can the ransom cost you millions of dollars, but rebuilding and retraining your models can cost $75,000 to $500,000 each."
— Michael Clark, Director of Threat Research, Sysdig

The Cost of Irreversibility

The EncForge attack exposes a fracture in the disaster recovery model of AI-native organizations. Business data encrypted by traditional ransomware is recoverable from backups; production models are not. Retraining requires compute, historical data often no longer available in the same composition, and months of engineering time. Sysdig's estimate — $75,000 to $500,000 per model — does not include the opportunity cost of downtime.

Agentic automation reduces attack time to scale and enables exploitation of known vulnerabilities — CVE-2025-3248 was disclosed months earlier — with efficiency a human operator could not replicate. The task-id 'gcp_h1' in JadePuffer's code suggests, without confirming, a potentially broader campaign on Google Cloud Platform infrastructure; the dossier does not specify geographic scope or victim count beyond the documented Langflow instance.

It is unknown whether the operator has actually collected ransoms, nor is the original distribution channel for the lockd binary verifiable — the C2 URL is partially redacted in the Sysdig report. What is documented is the intentionality of the targeting: the ML ecosystem is mapped as a standalone attack surface, with tools built for its specific recovery vulnerabilities.

FAQ

Why is EncForge different from traditional ransomware?

Because it does not encrypt generic data but specific AI/ML assets — roughly 180 extensions — and because it lacks exfiltration mechanisms. The objective is the destruction of models that conventional backups cannot rebuild, shifting the extortion leverage from the threat of publication to the irreversibility of the damage.

What makes JadePuffer "agentic" rather than a standard ransomware group?

The documented capacity for real-time self-correction: 31-second diagnosis-and-fix cycles in the previous campaign, and six Python script iterations in just over five minutes for the EncForge attack. The behavior is goal-oriented with intermediate verification, not rigidly sequential.

Is patching CVE-2025-3248 sufficient to mitigate the risk?

The patch addresses the known initial access vector, but Sysdig's analysis shows the container escape exploits a separate misconfiguration — an exposed Docker socket — that persists independently of the Langflow vulnerability. Mitigation requires both: patching the framework and removing the socket exposure.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references