JADEPUFFER Encrypts AI Weights with ENCFORGE: Phantom Ransom,…

The agentic ransomware group JADEPUFFER struck Langflow infrastructure with ENCFORGE, a payload that encrypts AI models without a functioning ransom mechanism. Recovery costs for a single enterprise-ready fine-tuned model are estimated at $75,000–$500,000.

On July 20, 2026, the agentic ransomware group JADEPUFFER re-compromised a Langflow infrastructure it had first breached twenty days earlier, deploying ENCFORGE: a compiled Go payload that selectively encrypts roughly 180 file extensions associated with AI/ML assets. The second campaign demonstrated a marked leap in capability. The agent discovered an exposed Docker socket, generated six corrective Python scripts in five minutes and twenty-four seconds, and built a privileged container escape.

The stakes exceed traditional ransomware. Sysdig estimates the direct recovery cost for a single enterprise-ready fine-tuned model at $75,000–$500,000. ENCFORGE does not exfiltrate data, does not handle payments, and maintains no leak site. The pressure rests entirely on the unavailability of files that organizations do not realize they must protect with the same rigor as mission-critical backups.

Key Takeaways

ENCFORGE selectively encrypts AI/ML files across roughly 180 targeted extensions, using AES-256-CTR with an RSA-2048-wrapped key embedded in the payload, operating on file regions for speed on multi-gigabyte models.
The initial access vector is CVE-2025-3248 (CVSS 9.8), a missing-authentication vulnerability in Langflow known since May 2025 and patched in version 1.3.0; the exposure persisted for over fourteen months.
In the first attack on July 1, 2026, Sysdig confirmed the encryption key was randomly generated, printed once to console, and never saved, rendering the payload effectively a wiper with a decorative ransom note.
For the second attack on July 20, 2026, it remains unknown whether the key was saved: the ransom note threatens deletion within seven days, but the brief neither confirms nor denies persistence.
The agent demonstrated real-time autonomous adaptation: thirty-one seconds to correct a failed login in the first attack, five minutes and twenty-four seconds for six corrective iterations in the second.

Key stat
$75,000–$500,000: Sysdig estimate of the direct recovery cost for a single enterprise-ready fine-tuned model, spanning cloud GPU time and engineering hours.

ENCFORGE: Ransom Note with Inoperable Payment Mechanism

ENCFORGE’s encryption design reveals deliberate intent. The Go binary uses AES-256-CTR with a per-execution key, wrapped with an embedded RSA-2048 public key. Encryption operates on file regions rather than entire contents—an optimization for extreme file sizes such as model weights, which can reach tens of gigabytes.

Targeted extensions include PyTorch (.pt, .pth), SafeTensors (.safetensors), GGUF/GGML, FAISS (.faiss), Parquet (.parquet), NumPy (.npy, .npz), TensorFlow (.tfrecord, .ckpt): a catalog covering the entire AI value chain, from weights to training data to vector indices.

The ransom note contains the same Proton Mail address used in the first attack, linking both campaigns to JADEPUFFER. In the first attack, Sysdig observed the key was randomly generated and never persisted: the payload was effectively a wiper with a decorative ransom note. In the second attack, the note threatens key deletion within seven days, but the brief flags as UNKNOWN whether the key was actually saved. The uncertainty is open: the key-management mechanism may be unstable even for its builders.

The absence of network code in the binary is documented. Sysdig detected no outbound dial, leak site, or payment portal. As the Sysdig Threat Research Team put it via VentureBeat: "ENCFORGE was built for AI assets, not adapted to them."

From Database Extortion to Model Destruction: Evolution in Twenty Days

The timeline of the two attacks documents a significant acceleration. On July 1, JADEPUFFER entered the same Langflow infrastructure, encrypted 1,342 configuration items in an Alibaba Nacos database, and attempted classic extortion. The return on July 20 with ENCFORGE shifted both target and logic: same initial access, same platform, different purpose.

The technical pivot in the second attack was enabled by an exposed Docker socket at /var/run/docker.sock, which the agent detected autonomously. From there it built a privileged container with PidMode:host and bind /:/host:rw, copying ENCFORGE via procfs to reach the host. The entire sequence required six corrective attempts, generated as Python scripts by the agent itself, in five minutes and twenty-four seconds.

Agentic behavior is also documented in the first attack, where the agent corrected a failed login in thirty-one seconds. Sysdig emphasizes the autonomy is circumscribed: a human operator still chose the target and infrastructure. The agent optimizes execution, not strategy. Human supervision remains, but operational maneuver times compress drastically.

Why Langflow Is the Ideal Entry Point

CVE-2025-3248 is a missing-authentication vulnerability in Langflow’s /api/v1/validate/code endpoint, a visual orchestration platform for LLM flows. The National Vulnerability Database assigns it CVSS 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: remote access, low complexity, no privileges required. CISA added it to the Known Exploited Vulnerabilities Catalog on May 5, 2025.

JADEPUFFER’s return in July 2026 means at least one organization remained exposed for over fourteen months after the patch became available in version 1.3.0. VentureBeat estimates roughly 7,000 exposed Langflow instances, primarily in North America. The exposure window is vast and the target attractive: LLM orchestration platforms that often run with elevated privileges and access to model repositories.

Defensive Priorities

Defensive recommendations derive from the pattern observed in the brief. The priority is patching CVE-2025-3248 on all Langflow instances, verifying the installed version is at least 1.3.0. The brief cites generic defensive recommendations from Sysdig via SC World, not a detailed plan.

Mapping AI/ML assets in backups is the second pillar. As Diana Kelley, CISO of Noma Security, stated via SC World: "It's no longer enough to back up servers and applications. Organizations need to identify their AI crowned jewels and be prepared to recover the entire AI supply chain." The quote from Mike Riemer, Ivanti SVP, via VentureBeat—"If I release a patch and a customer doesn't patch within 72 hours of that release, they're open to exploit, because that's how fast they can now do it"—is a generic industry observation, not a metric specific to this incident.

Monitoring exposed Docker sockets and segmenting containers hosting AI workloads complete the perimeter. The cost of inaction is quantified: $75,000–$500,000 for every model that must be rebuilt, plus irrecoverable training time.

Editorial Close

ENCFORGE marks a turning point in agentic cybercrime: the shift from generic threat to selective destruction of strategic assets. The ransom note remains, but the payment mechanism is inoperable or absent. Organizations treating AI models as assets restorable with a simple backup are underestimating a risk Sysdig has already quantified. The question is not whether to pay, but whether to rebuild.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter