JADEPUFFER Agentic Ransomware Resurfaces, Attacks AI Assets with ENCFORGE Payload

Post Views: 7

A newly identified threat campaign involving the JADEPUFFER group has emerged, leveraging a novel payload named ENCFORGE to compromise artificial intelligence infrastructure.

Attack Details

Security researchers at Sysdig disclosed that the attack exploited a previously documented Langflow vulnerability to access an unsecured Docker socket, enabling the creation of a privileged container for deploying the ENCFORGE malware. The attack demonstrated autonomous decision-making capabilities, with the AI-driven threat actor resolving an initial payload delivery failure within five minutes and 24 seconds. This process involved generating six Python scripts to establish a privileged escape container, transfer ENCFORGE across namespace boundaries using procfs, initiate encryption, and validate success through file enumeration with the .locked extension.

Encryption Method

ENCFORGE, a Go-based binary hosted on the attacker’s command-and-control server at the “/.lockd” endpoint, employs a dual-encryption approach. Files are encrypted using AES-256-CTR, while per-session symmetric keys are secured via RSA-2048. This contrasts with earlier attacks that utilized MySQL’s native AES_ENCRYPT() function for database file encryption.

Targeted File Types

The ransomware specifically targets AI-related data, including model formats like PyTorch (.pt, .pt2, .pth), SafeTensors (.safetensors), and llama.cpp quantized models (.ggml, .gguf), as well as training datasets in Apache Arrow (.arrow, .feather), Apache Parquet (.parquet), and TensorFlow (.tfrecord) formats. Additional targets include NumPy arrays (.npy, .npz), TensorFlow and PyTorch checkpoints (.ckpt), and AI Similarity Search indices (.faiss).

Expert Quotes

“The focus on encrypting AI-specific file types reflects a strategic evolution in adversary priorities,” she stated. “As enterprises increasingly rely on AI as a core asset, attackers are directly targeting these resources rather than secondary infrastructure.”

Ransom Note and Impact

The ransom note distributed by ENCFORGE warns of key deletion if communication with the threat actor is not established within seven days. The contact address matches that used in the initial JADEPUFFER attack. While no data exfiltration occurred and no leak site was detected, Sysdig emphasized the financial impact of encrypting critical AI assets. Recovery costs for enterprise-grade models can range from $75,000 to