JADEPUFFER's 19-Day Upgrade: Ransomware Built to Destroy AI Models

TL;DR

Sysdig’s Threat Research Team published two JADEPUFFER writeups 19 days apart, and in the second one the actor is back on the same unpatched Langflow instance staging ENCFORGE: a compiled Go binary that hunts roughly 180 AI/ML file extensions, from .safetensors and .gguf checkpoints to .faiss vector indices. Sysdig puts the rebuild cost of a single destroyed model at $75,000 to $500,000. Both intrusions came through CVE-2025-3248, an unauthenticated RCE in Langflow that CISA added to its Known Exploited Vulnerabilities catalog in May 2025. Securonix’s independent re-analysis accepts that an LLM agent did much of the tactical execution, and stops short of calling the operation fully autonomous. Patch Langflow, and keep model artifacts on storage the Docker socket cannot reach.

The number worth sitting with is 19 days. On 1 July, Sysdig TRT published its first writeup of JADEPUFFER, an intrusion built from improvised Python that chewed through MySQL and Alibaba Nacos servers. On 20 July, the follow-up described the same operator back on the same box with a compiled, packed, purpose-built Go ransomware family.

Nineteen days between those two publications is a fast tooling-maturity curve by any reading. It holds regardless of how much of the work an LLM did.

ENCFORGE Targets Artifacts Backups Rarely Cover

ENCFORGE is a static Go 1.22.12 binary packed with UPX 5.20 and dropped as lockd. It encrypts with AES-256-CTR under an RSA-2048 key encapsulation scheme and appends .locked. Standard construction, competently done.

The extension list is the interesting part. Sysdig counts roughly 180 targets, and the ones that matter are .gguf, .safetensors, .ckpt, .pt, .onnx, .parquet, .arrow, .pkl and .faiss. Model checkpoints, training datasets, embedding indices, vector stores. Someone sat down and enumerated the AI/ML stack.

Encrypting a database annoys a company with backups. Encrypting a fine-tuned checkpoint that took six weeks of GPU time destroys something with no clean restore path, so Sysdig’s estimate of $75,000 to $500,000 per destroyed model reads as a floor. Vector indices and embedding stores sit in the same awkward category: expensive to regenerate, and frequently outside whatever backup policy covers the Postgres box.

Getting the binary onto the host took a detour. The initial fetch failed, so the operator pivoted to the exposed Docker socket at /var/run/docker.sock and used nsenter --target 1 to break out into the host namespace. If your container runtime hands out that socket, container isolation is decoration.

The Langflow Hole Has Been Public Since April 2025

Both campaigns walked in through the same door. CVE-2025-3248 is an unauthenticated code-execution flaw in Langflow’s code-validation endpoint. Horizon3.ai published a technical writeup and PoC in April 2025, and CISA added it to the KEV catalog on 5 May 2025, 452 days before today.

The instance JADEPUFFER hit in July 2026 stayed unpatched between the two campaigns, which tells you something about how AI orchestration tooling gets deployed. Langflow is a low-code builder for LLM pipelines. It ends up on internal hosts with database credentials nearby, installed by teams whose patch calendar covers the application stack they think of as production.

Strip the agent framing out of this incident and you still have a KEV-listed RCE, exposed for over a year, sitting one hop from the model artifacts.

”Autonomous” Is Carrying More Weight Than the Evidence Supports

Sysdig’s behavioural evidence for agentic operation is specific: payloads that narrate their own reasoning as they run, in-session comprehension of natural-language context planted on the host, and a failure-diagnosis-and-fix sequence that Sysdig logs between 19:34:24 and 19:35:18 UTC. Sysdig reads that sub-minute correction as machine speed.

Securonix Threat Labs went back over the first Sysdig post on 7 July and reached a narrower conclusion. Their reassessment puts medium-to-high confidence on an LLM agent performing “a large share of the tactical execution,” while stating the indicators do “not, on their own, prove that the full operation was autonomous or that a human operator had no role in tasking, infrastructure setup, target selection, or payment configuration.” Their preferred label is “agent-driven or agent-assisted,” and it fits the facts better. A fast fix is evidence about who wrote the fix. It says nothing about who chose the victim, rented the C2 at 45.131.66.106, or set up the Proton address collecting the ransom.

The scope claims deserve the same discount. The Hacker News reported on 21 July that Sysdig has disclosed a single observed session, published no count of files actually encrypted, named no victim, and confirmed no further ENCFORGE deployments, and that Sysdig had left questions about campaign breadth unanswered by publication time. Everything known about ENCFORGE in the wild traces to one telemetry source and one intrusion.

Say that plainly, because the reflex with an AI-flavoured threat report is to read it as a trend. One documented deployment is one documented deployment.

What Actually Reduces Exposure

The defensive work here is unglamorous, and most of it predates the agent question:

Patch Langflow, or take it off any network path reaching the internet. A KEV listing since May 2025 means this one is already being exploited at scale.
Stop mounting /var/run/docker.sock into containers. It converts a container compromise into host root.
Treat model checkpoints, vector indices and training sets as tier-one backup targets, with an offline or immutable copy. Most organisations back up the database and forget the models/ directory.
Alert on credential replay across service boundaries. JADEPUFFER’s lateral movement in the first campaign ran on harvested credentials reused against MySQL and Nacos, and it AES-encrypted 1,342 Nacos configuration items with a key it never persisted.

That last detail is the one to remember. The key was never saved, so those config items were unrecoverable by anyone, the attacker included. Whether that was a deliberate wiper move or an agent losing the plot mid-run, Sysdig does not say.

Sources: JADEPUFFER: Agentic ransomware for automated database extortion • JADEPUFFER evolves: ransomware built to destroy AI models • CISA Adds One Known Exploited Vulnerability to Catalog

Coverage: New ENCFORGE Ransomware Targets AI Model Files • Securonix Threat Labs reassessment