JadePuffer Returns with New Ransomware Targeting AI Models and Infrastructure

JadePuffer resurfaces with ransomware designed to attack AI models and infrastructure

The Threat Group’s New Ransomware

A threat group known as JadePuffer has reemerged, deploying a new ransomware variant called ENCFORGE that specifically targets artificial intelligence and machine learning (AI/ML) infrastructure. This development follows a prior campaign in which the same actor used an AI-powered agent to execute an end-to-end extortion operation. The latest iteration of the attack leverages ENCFORGE, a Go-based ransomware tool capable of encrypting approximately 180 file types, with a focus on critical components of AI/ML systems such as model checkpoints, vector databases, training datasets, and embedding indices.

Attack Details

Exploiting Vulnerabilities

The threat actor first gained attention earlier this month when researchers from Sysdig identified an attack chain involving an AI-driven agent. The initial breach exploited a known vulnerability (CVE-2025-3248) in the open-source Langflow framework, which is used for building AI agents and workflows. The attacker compromised an internet-facing Langflow instance, then pivoted to a publicly exposed production server. Once inside, the agent encrypted a MySQL database and an Alibaba Nacos configuration service, though data exfiltration remains unconfirmed.

AI Agent’s Role

Sysdig’s analysis indicated the attack was orchestrated by an AI agent, citing natural-language commentary in payloads and the agent’s ability to rapidly diagnose and correct its own errors. The attack highlighted the risks of outdated infrastructure, as the threat actor exploited a 2021 Nacos authentication bypass vulnerability and an unchanged default signing key. Researchers noted that AI agents can systematically scan historical vulnerabilities, making unpatched systems increasingly vulnerable. This approach underscores the growing threat of automated tools that exploit legacy issues at scale.

ENCFORGE’s Impact

ENCFORGE’s deployment marks a significant escalation. Sysdig’s Michael Clark reported that the actor returned to the same Langflow instance and deployed the ransomware, which targets AI/ML environments with precision. The tool’s capabilities extend beyond traditional file encryption, focusing on critical AI assets that are often irreplaceable. For example, encrypted production models may require costly retraining, with estimated recovery costs ranging from $75,000 to $500,000 per model.

Mitigation Strategies

The attack process involved the AI agent extracting cloud provider credentials, database connection strings, and API tokens to gain access to internal services. It then attempted to deploy ENCFORGE, succeeding on the second attempt after adapting to initial failures. Clark emphasized that the integration of Langflow as an entry point and ENCFORGE as a payload is deliberate. Langflow deployments are inherently linked to AI infrastructure, making them a strategic target for attackers seeking to disrupt model development and deployment pipelines.

Sysdig researchers advised organizations to mitigate risks by addressing known vulnerabilities in internet-facing systems, restricting Docker socket access, and running Langflow containers with non-root privileges. Additional recommendations include enabling the noexec flag on writable directories, securing AI orchestration tools, and maintaining offline backups of model artifacts. They also warned against storing API keys within Langflow’s runtime environment and urged the removal of default or compromised credentials.

Implications for AI Security

The use of AI agents in cyberattacks raises new challenges for detection and response. The ability of these agents to narrate their actions through natural-language payloads provides a unique opportunity for defenders to identify and triage incidents. However, the sophistication of such attacks necessitates proactive measures to protect AI infrastructure, which is becoming a critical component of modern enterprise operations.

About Author

Anuj

See author's posts