A sophisticated ransomware campaign is now targeting the core assets of artificial intelligence systems. The threat actor known as JADEPUFFER has evolved from compromising databases to deploying ENCFORGE, a ransomware strain specifically designed to encrypt AI models, training data, and vector databases.
The operation begins by exploiting CVE-2025-3248, a critical vulnerability in Langflow’s code-validation endpoint. This flaw allows unauthenticated attackers to execute arbitrary Python code on exposed servers, providing a direct pathway into environments that often contain sensitive information such as cloud keys, API tokens, and database credentials.
Researchers at Sysdig identified this activity after observing JADEPUFFER returning to a previously compromised Langflow instance with a more advanced toolkit. The actor autonomously performed reconnaissance, collected credentials, tested internal services, and prepared a route from a container to the host system.
The impact of such an attack extends beyond typical file recovery. Losing a production AI model can represent months of training, tuning, data preparation, and engineering work. Even with backups, organizations may lose work completed after the latest clean snapshot, and rebuilding proprietary training datasets can further delay recovery.
JADEPUFFER’s Exploitation of Langflow Flaw
After gaining access, JADEPUFFER searched for credentials and examined the Docker socket, which can grant a process the ability to create powerful containers. The actor initially attempted to download ENCFORGE but adapted when the file transfer failed, creating scripts that copied the payload through the container process filesystem and launched it on the host.
This method utilized privileged containers, host process access, and host filesystem mounts to escape the original container boundary. It reflects a risk long associated with weak container setups, as seen when attackers abuse Docker and Kubernetes misconfigurations to access secrets and broader infrastructure.
ENCFORGE is a compiled Go ransomware binary packed with UPX. It encrypts files using AES-256-CTR with an RSA-2048 public key, adds the .locked extension, terminates processes holding files open, and can remove itself after execution. The malware also drops ransom notes with names such as README, HOWTODECRYPT, and READMEDECRYPT.
Unlike many ransomware operations, researchers found no evidence that ENCFORGE included data theft or a leak-site component. Its pressure comes from encryption alone. The ransom contact embedded in the malware matched the contact used in JADEPUFFER’s earlier campaign, linking the newer ransomware operation to the same actor.
AI Assets Face New Risk
ENCFORGE stands out because its default file list deliberately targets approximately 180 extensions, including AI model checkpoints, vector indexes, datasets, embeddings, and machine-learning pipeline files. The targeted formats include .ckpt, .safetensors, .onnx, .gguf, .faiss, .parquet, .pkl, and .pt, indicating that model artifacts are central to the campaign’s objective.
This incident underscores the growing threat landscape for AI infrastructure. As organizations increasingly integrate AI into their operations, the security of these systems becomes paramount. The targeted nature of ENCFORGE highlights the need for robust security measures, including timely patching of vulnerabilities like CVE-2025-3248, to protect valuable AI assets from sophisticated cyber threats.
