The autonomous AI agent known as JadePuffer has been enhanced with a custom malware named EncForge, which is designed to encrypt AI-related assets, including training datasets, vector databases, and model checkpoints.
Earlier this month, JadePuffer was identified as an agentic threat actor (ATA) capable of autonomously executing all phases of a ransomware attack, from gaining initial access to encrypting data.
According to cloud security firm Sysdig, the AI agent was able to adapt to technical challenges in real time, optimizing its intrusion methods to identify the appropriate solution in under a minute.
In a report released today, Sysdig noted that the attacker revisited the previously compromised Langflow instance, which was vulnerable to CVE-2025-3248, utilizing the Go-based EncForge ransomware specifically designed for AI and machine learning (ML) infrastructures.
“The binary targets around 180 file extensions, casting a wide net over the modern AI/ML stack, including model checkpoints, vector databases, training datasets, and embedding indices in nearly all current formats,” Sysdig stated.
After gaining access and searching for cloud credentials, API tokens, and accessible internal services, the threat actor found an exposed Docker socket that granted root-level access.
When the initial attempt to download the ransomware payload was unsuccessful, the operator iteratively created and deployed six Python scripts in just five minutes, with the final script (deploy.py v2) resolving the delivery issues.
“Deploy.py v2 is the finalized payload: a fully autonomous pipeline that identifies the target PID, transfers ENCFORGE across the namespace boundary via procfs, conducts a try-mode scan, initiates the live encryption process, and counts .locked files to confirm execution,” Sysdig elaborated.
EncForge Ransomware
The Go-based binary (lockd) is compressed using the Ultimate Packer for eXecutables (UPX) and targets 180 file extensions, which include:
- AI model checkpoints
- Hugging Face SafeTensors files
- PyTorch and TensorFlow models
- GGUF and GGML weights
- FAISS vector indexes
- Training datasets, including Parquet, Arrow, TFRecord, NumPy, and DuckDB formats
Its command-line help also references LoRA adapters and legacy GGML files as additional targets, which Sysdig interprets as evidence that the ransomware was intentionally designed for AI environments rather than being a generic file encryptor.
EncForge employs the AES-256 algorithm in counter mode to encrypt files using a hybrid approach, where the symmetric key is protected by an RSA-2048 public key.
To enhance performance, the malware encrypts only specific sections of each file instead of the entire file. Encrypted files receive the .locked extension, and a ransom note is left to inform the victim of the attack, indicating that a unique identifier has been assigned.
Researchers found no indication that JadePuffer exfiltrated any data during the breach, and EncForge itself does not seem to incorporate a data-stealing feature.
Analysis of the Linux variant showed the inclusion of Windows anti-recovery functions, such as shadow copy deletion and disabling boot recovery. Although hinted at in the code, a macOS version remains unverified.
Sysdig warns that the encryption of model weights, training datasets, and vector indexes could result in organizations losing weeks or even months of training and fine-tuning, with financial losses estimated between $75,000 and $500,000 per model, depending on its size and function.
Recommendations for defense include applying available security updates, particularly Langflow version 1.3.0 or later, limiting Docker socket access, running Langflow containers as non-root, and implementing filesystem-level access controls for model weight directories.
Test Every Layer Before Attackers Do
Security teams log 54% of successful attacks but only alert on 14%. The remainder navigate through your environment unnoticed.
The Picus whitepaper illustrates how breach and attack simulation can test your SIEM and EDR rules, ensuring that threats do not evade detection.
Source: Original article
