JADEPUFFER Evolves Agentic Ransomware to Target AI Models and Training Data

JADEPUFFER, the agentic threat actor first linked to an autonomous ransomware operation against exposed Langflow infrastructure, has evolved its tooling to target artificial intelligence models, training datasets, and vector data.

Its latest payload, ENCFORGE, marks a shift from conventional database extortion toward destruction-focused attacks on high-value AI and machine-learning assets.

The group’s ENCFORGE locker targets about 180 extensions associated with model checkpoints, vector databases, embedding indexes, training data, and other artifacts needed to build, fine-tune, and operate modern AI systems.

Unlike traditional ransomware campaigns, the operation is notable not merely for its payload selection but for the decision-making model behind it.

Sysdig characterized JADEPUFFER as an agentic threat actor: an AI-driven operator able to plan, execute, assess failures, and adjust attack activity without evidence of continuous human approval.

The observed activity indicates that an LLM agent can chain together reconnaissance, exploitation, credential discovery, persistence, privilege escalation and extortion-oriented destruction at machine speed.

The campaign’s original access vector was CVE-2025-3248, a critical missing-authentication vulnerability in Langflow’s /api/v1/validate/code endpoint.

Affected Langflow versions before 1.3.0 allowed unauthenticated remote code execution through crafted requests.

CISA added the flaw to its Known Exploited Vulnerabilities catalog in May 2025 after evidence of active exploitation emerged.

JADEPUFFER reportedly used the Langflow compromise to enumerate the host environment and search for LLM-provider API keys, cloud credentials, database connection details and sensitive configuration files.

It later pivoted into database and configuration-management infrastructure, encrypting records and deleting original data before leaving a ransom demand.

The revised ENCFORGE capability expands that model from operational databases to AI assets that can be difficult, expensive or impossible to reconstruct quickly.

The most consequential change is ENCFORGE’s focus on the AI development lifecycle. A conventional ransomware incident may encrypt shared file servers, virtual machines and SQL databases.

ENCFORGE instead seeks files that represent accumulated computational investment and proprietary intellectual property: trained weights, checkpoints, datasets, feature stores, embedding collections and vector indexes.

For many organizations, recovery from the loss of a model does not simply mean restoring a backup.

Rebuilding may require reacquiring source data, recreating preprocessing pipelines, provisioning expensive GPU capacity, repeating fine-tuning work and validating that the retrained model delivers comparable quality and safety performance.

Sysdig estimated recovery costs for a destroyed model at roughly $75,000 to $500,000, depending on its scale and retraining requirements.

The operation is also reportedly destruction-first. ENCFORGE’s observed deployment did not rely on the increasingly common double-extortion sequence of data theft followed by a leak-site threat.

Instead, it focuses on denying access to irreplaceable AI artifacts, potentially creating immediate pressure on organizations that lack immutable, tested backups of their AI pipelines.

Security researchers at Sysdig reported that JADEPUFFER, returned to a previously compromised Langflow environment in July 2026 with an upgraded ransomware capability designed for AI/ML workloads.

Agentic Ransomware Target AI Models

JADEPUFFER illustrates why agentic ransomware changes the defensive equation. Automated ransomware has existed for years, but most commodity strains follow fixed routines.

An agentic operator can work toward an objective, interpret command output, identify failures and generate a revised method dynamically.

The skill floor drops to whatever it costs to rent or compromise access to an AI agent, a cost that falls further when that access comes from stolen credentials through a practice known as LLMjacking.

In the earlier intrusion, the actor was observed correcting a failed action in approximately 31 seconds. In its later ENCFORGE deployment, the agent reportedly wrote and ran multiple corrective Python scripts within minutes to overcome delivery problems.

That feedback loop reduces the dwell time defenders traditionally use to detect suspicious activity, investigate alerts and isolate affected systems.

The activity also follows growing evidence that attackers are targeting AI orchestration platforms as privileged entry points.

Such platforms commonly connect to databases, cloud services, APIs, code-execution environments and model repositories.

A single exposed service can therefore expose both conventional enterprise secrets and the core assets supporting AI applications.

Organizations operating Langflow or similar AI workflow frameworks should immediately identify all internet-facing instances, confirm version status and apply vendor fixes for CVE-2025-3248.

The vulnerability has a CVSS score of 9.8, enables unauthenticated code execution and has been actively exploited in the wild.

Security teams should also remove code-validation, administration and orchestration interfaces from direct internet exposure wherever possible.

Access should require strong authentication, network restrictions and segmentation from databases, cloud metadata services, container runtimes and secrets stores.

Most importantly, backup strategies must explicitly include AI/ML artifacts.

Immutable, offline and routinely tested recovery copies should cover model weights, training data, vector databases, prompt templates, evaluation datasets and pipeline configuration not only conventional databases and file shares.

JADEPUFFER’s evolution demonstrates that ransomware is beginning to treat AI infrastructure as a primary target rather than an adjacent technology.

The attack techniques remain familiar, but an autonomous operator can combine them faster, retry them more aggressively and focus them on assets whose loss can halt AI operations long after ordinary systems are restored.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC