JADEPUFFER Evolves Agentic Ransomware to Target AI Models and Training Data
Sysdig links JADEPUFFER, an AI-driven ransomware actor, to ENCFORGE, a new locker encrypting and destroying AI models, training data, and vector databases.
Sysdig reports the agentic ransomware actor JADEPUFFER returned in July 2026 to a previously compromised Langflow environment with ENCFORGE, a locker targeting roughly 180 extensions for model checkpoints, vector databases, embedding indexes, and training data. Initial access used CVE-2025-3248 (CVSS 9.8), an unauthenticated RCE in Langflow versions before 1.3.0, added to CISA's KEV catalog in May 2025 after active exploitation. The actor searched hosts for LLM-provider API keys and cloud credentials, encrypted and deleted data, and left a ransom demand, favoring destruction over double extortion. Sysdig estimates rebuilding a destroyed model costs $75,000-$500,000 and observed the agent correcting failed actions in about 31 seconds.
- ENCFORGE targets about 180 extensions tied to model checkpoints, vector databases, embeddings, and training data
- Initial access via CVE-2025-3248 (CVSS 9.8), unauthenticated RCE in Langflow before 1.3.0, actively exploited
- Agent autonomously corrected a failed action in 31 seconds and wrote corrective Python scripts within minutes
- Sysdig estimates destroyed-model recovery costs at $75,000-$500,000; attacks are destruction-first, not double extortion
- Defenders should patch Langflow, isolate AI orchestration platforms, and back up AI/ML artifacts immutably
- CVEs
- CVE-2025-3248
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1552.001 Credentials In FilesT1078 Valid AccountsT1486 Data Encrypted for ImpactT1485 Data Destruction
- Products
- ENCFORGE
- Threat actors
- JADEPUFFER
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-3248 | Unauthenticated RCE in Langflow /api/v1/validate/code | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
From the original article
4 min read at gbhackers.com
JADEPUFFER, the agentic threat actor first linked to an autonomous ransomware operation against exposed Langflow infrastructure, has evolved its tooling to target artificial intelligence models, training datasets, and vector data. Its latest payload, ENCFORGE, marks a shift from conventional database extortion toward destruction-focused attacks on high-value AI and machine-learning assets.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.