When Ransomware Targets AI Models: Defending the AI/ML Recovery Chain

Sysdig's JADEPUFFER ransomware campaign deployed the ENCFORGE Go binary via Langflow CVE-2025-3248 to encrypt AI models, datasets, and vector stores for destruction-based extortion.

Sysdig Threat Research Team tracks a threat actor dubbed JADEPUFFER that progressed from crude database extortion to ENCFORGE, a UPX-packed Go ransomware binary purpose-built to destroy AI and ML assets. Initial access exploited Langflow CVE-2025-3248, an unauthenticated RCE added to CISA's KEV catalog in May 2025; the first campaign encrypted 1,342 configuration items with the database's own AES_ENCRYPT function and a key that was never saved, making recovery impossible. ENCFORGE uses AES-256 in counter mode with the key wrapped in an embedded RSA-2048 public key, renames files with a .locked extension, and targets roughly 180 file extensions covering model weights, LoRA adapters, vector indices, and training datasets. In one attack, the AI-driven agent spent 5 minutes 24 seconds iterating six Python scripts to build a container escape and run the payload on the host after the C2 binary fetch failed.