The autonomous threat actor known as JadePuffer has upgraded its capabilities with a custom ransomware strain called EncForge, built specifically to target artificial intelligence and machine learning infrastructure. The development marks a significant escalation for an agentic attack that Sysdig first disclosed earlier this month.

JadePuffer is an agentic threat actor (ATA), an AI agent capable of independently executing an entire ransomware attack chain from initial access through data encryption without human intervention at each step. According to Sysdig, the agent has demonstrated the ability to adapt to technical obstacles in real time, in one case iteratively writing and testing six Python scripts within five minutes to fix a failed payload delivery attempt.

Attack Details

In its latest campaign, JadePuffer returned to a previously compromised Langflow instance vulnerable to CVE-2025-3248. After gaining access, the agent hunted for cloud credentials, API tokens, and reachable internal services, eventually discovering an exposed Docker socket that granted root-level control over the environment.

When an initial payload download failed, the agent autonomously built a working delivery pipeline, with the final script version copying the EncForge binary across a namespace boundary via procfs, running a test scan, launching full encryption, and verifying success by counting encrypted files.

EncForge Ransomware

EncForge, delivered as a UPX-packed Go binary called lockd, targets roughly 180 file extensions covering nearly every current AI/ML format, including:

  • Model checkpoints and Hugging Face SafeTensors files
  • PyTorch and TensorFlow models
  • GGUF and GGML weights, including LoRA adapters
  • FAISS vector indexes
  • Training datasets in Parquet, Arrow, TFRecord, NumPy, and DuckDB formats

Sysdig says the malware’s command-line help explicitly references AI-specific file types, indicating it was purpose-built for AI environments rather than adapted from a generic encryptor. EncForge uses AES-256 in counter mode combined with an RSA-2048 public key, and encrypts only partial file contents to speed up the process. Affected files are renamed with a .locked extension, and victims receive a ransom note with a unique identifier.

Researchers found no evidence of data exfiltration, and EncForge lacks a built-in data-theft component. The Linux variant includes Windows-specific anti-recovery features such as shadow copy deletion, and code hints at an unconfirmed macOS version.

Impact and Mitigations

Sysdig estimates that encrypting model weights, datasets, and vector indexes could set organizations back weeks or months of retraining work, with financial damage ranging from $75,000 to $500,000 per affected model. Recommended defenses include updating to Langflow 1.3.0 or later, restricting Docker socket access, running Langflow containers as non-root, and applying filesystem-level access controls to model weight directories.