Agentic Ransomware: JADEPUFFER Runs End-to-End AI Attack While ENCFORGE Locker Destroys Models and Training Data
Sysdig and SOCRadar both document JADEPUFFER, an AI-agent-driven ransomware campaign entering through CVE-2025-3248 in Langflow and deploying the ENCFORGE locker against roughly 180 AI/ML file extensions; SOCRadar says the agent executed the full attack chain…
Sysdig reports that the agentic ransomware actor JADEPUFFER returned in July 2026 to a previously compromised Langflow environment wielding ENCFORGE, a locker targeting about 180 file extensions tied to model checkpoints, vector databases, embedding indexes, and training data. Entry came via CVE-2025-3248 (CVSS 9.8), described by Sysdig as an unauthenticated RCE in Langflow versions before 1.3.0 and by SOCRadar as a missing-authentication flaw in Langflow's code-validation endpoint enabling unauthenticated Python execution; the vulnerability was added to CISA's KEV catalog in May 2025 after active exploitation. The agent searched hosts for LLM-provider API keys and cloud credentials, encrypted and deleted data, and left a ransom demand — destruction-first rather than double extortion. SOCRadar adds that the agent abused default-credential MinIO access, forged a token with Nacos's public default signing key, inserted a backdoor administrator account, encrypted 1,342 configuration records, and generated over 600 purposeful payloads. Sysdig estimates rebuilding a destroyed model at $75,000–$500,000 and observed the agent correcting a failed action in about 31 seconds. SOCRadar's IoC table attributes the activity to the Lynx/INC ransomware groups with C2 at 45.131.66[.]106 (Sysdig does not name an affiliate) and links CVE-2026-24858 to FortiBleed, a related 14-agent framework still supporting human-operated intrusions. Sysdig recommends patching Langflow, isolating AI orchestration platforms, and keeping immutable backups of AI/ML artifacts.
- Initial access vector: CVE-2025-3248 (CVSS 9.8), an unauthenticated RCE in Langflow versions before 1.3.0 (Sysdig), described as a missing-authentication flaw in Langflow's code-validation endpoint allowing unauthenticated Python execution…
- ENCFORGE locker targets roughly 180 file extensions tied to model checkpoints, vector databases, embedding indexes, and training data (both sources).
- Sysdig reports JADEPUFFER returned in July 2026 to a previously compromised Langflow environment with ENCFORGE.
- Per SOCRadar, the agent abused default-credential MinIO access, forged a token with Nacos's public default signing key, inserted a backdoor administrator account, and encrypted 1,342 configuration records.
- The campaign produced over 600 purposeful payloads and left a ransom demand, favoring data destruction over double extortion.
- Sysdig estimates rebuilding a destroyed model costs $75,000–$500,000.
- The agent autonomously corrected a failed action in about 31 seconds and wrote corrective Python scripts within minutes (Sysdig).
- SOCRadar's IoC table attributes the activity to the Lynx/INC ransomware groups with C2 at 45.131.66[.]106; Sysdig's report does not name an affiliate group.
Coverage timelineoldest first · each row is one article
- · 2h agoJADEPUFFER Evolves Agentic Ransomware to Target AI Models and Training Data
GBHackers· 76
Sysdig links JADEPUFFER, an AI-driven ransomware actor, to ENCFORGE, a new locker encrypting and destroying AI models, training data, and vector databases.
- · 1h agoAI Agents Now Run Ransomware Attacks End-to-End Without Human Operators
Cyber Security News· 80
SOCRadar documented JADEPUFFER, an AI agent that autonomously executed a ransomware campaign from Langflow exploit through encryption and extortion.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-3248 | Unauthenticated RCE in Langflow /api/v1/validate/code Langflow, an open-source visual framework for building LLM and agentic AI applications, contains a missing authentication flaw (CWE-306) in its /api/v1/validate/code endpoint. A remote attacker with network reachability to the endpoint can send crafted HTTP requests without any credentials, causing arbitrary code execution on the server. Successful exploitation yields code execution under the application's privileges, enabling data theft, backdoor installation, and, per CISA, ransomware deployment. Any running Langflow instance is affected; the tool is typically self-hosted by development teams building AI workflows, so real-world exposure depends on whether each instance is reachable from untrusted networks. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2025-05-05 with known ransomware use, EPSS assigns a 100% probability of exploitation within 30 days (100th percentile), and a public PoC is available. Do: Upgrade Langflow to the latest patched release identified in the vendor's advisory; federal agencies must apply mitigations per vendor instructions under BOD 22-01 or discontinue use if mitigations are unavailable. Until patched, restrict network access to the /api/v1/validate/code endpoint via reverse-proxy authentication, firewall rules, or VPN placement, and avoid exposing Langflow directly to the internet. Because ransomware use is confirmed, review access and process-execution logs for signs of prior compromise. | 9.8 | 100% | KEV ransomware PoC ×2 |
| moderatetens of thousands of self-hosted deployments, with likely only hundreds to low thousands directly exposed to the internet | |
| CVE-2026-24858 | FortiCloud SSO Authentication Bypass Across Multiple Fortinet Products CVE-2026-24858 is an authentication bypass (CWE-288) in FortiCloud single sign-on that lets an attacker who owns a FortiCloud account with any registered device log in to other customers' Fortinet devices that have FortiCloud SSO authentication enabled. It affects a wide range of 7.x/8.x builds of FortiOS, FortiProxy, FortiWeb, FortiAnalyzer, FortiManager, FortiNAC-F, and the Siemens RUGGEDCOM APE 1808. An attacker gains unauthorized access to devices registered to other accounts, and related reporting describes FortiGate devices being exploited to breach networks and steal service account credentials. Any organization running an affected build with FortiCloud SSO enabled is exposed. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2026-01-27 and Fortinet patched it after active FortiOS SSO exploitation was detected, and EPSS assigns an 86.1% probability of exploitation within 30 days. Do: Upgrade all affected Fortinet products to the fixed releases specified in Fortinet's PSIRT advisory for CVE-2026-24858; as an interim mitigation, disable FortiCloud SSO authentication on affected devices and audit which devices are registered to your FortiCloud account. Review device logs for unexpected administrative logins or signs of service-account credential theft on FortiGate, and federal agencies must apply mitigations per BOD 22-01 (including CISA's cloud services guidance) or discontinue use of the product. | 9.8 | 86% | KEV |
| masshundreds of thousands of devices potentially affected (Fortinet's FortiGate install base is in the millions and public internet scans have long shown hundreds… |