--- title: JADEPUFFER evolves: The agentic threat actor deploys... description: The Sysdig Threat Research Team documents a new evolution of JADEPUFFER, an agentic threat actor that exploits CVE-2025-3248 in Langflow to deploy ENCFORGE — a... canonical: https://daily.dev/posts/jadepuffer-evolves-the-agentic-threat-actor-deploys-ransomware-built-to-destroy-ai-models-2jlb20g00 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI models | daily.dev og:description: The Sysdig Threat Research Team documents a new evolution of JADEPUFFER, an agentic threat actor that exploits CVE-2025-3248 in Langflow to deploy ENCFORGE — a... og:url: https://daily.dev/posts/jadepuffer-evolves-the-agentic-threat-actor-deploys-ransomware-built-to-destroy-ai-models-2jlb20g00 og:image: https://api.daily.dev/og/posts/2jLb20G00.png og:image:alt: JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI models og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI models **[Sysdig Blog](https://daily.dev/sources/sysdig-blog)** · 19 min read · 1 upvotes · 0 comments ## Summary The Sysdig Threat Research Team documents a new evolution of JADEPUFFER, an agentic threat actor that exploits CVE-2025-3248 in Langflow to deploy ENCFORGE — a compiled, UPX-packed Go ransomware purpose-built for AI/ML infrastructure. ENCFORGE targets approximately 180 file extensions covering model checkpoints (.gguf, .safetensors, .ckpt, .pt), vector databases (.faiss), and training datasets (.parquet, .tfrecord, .npy), using AES-256-CTR with RSA-2048 key encapsulation. When the binary fetch from C2 failed, JADEPUFFER autonomously constructed a Docker socket escape toolkit in under six minutes, copying the binary across namespace boundaries via procfs. Unlike double-extortion ransomware, ENCFORGE is destruction-first with no exfiltration capability. Recovery costs for encrypted AI models range from $75,000 to $500,000 per model. The post includes full IOCs, a YARA rule, and hardening recommendations including patching Langflow to 1.3.0+, restricting Docker socket access, and maintaining offline model artifact backups. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What CVE does JADEPUFFER exploit to gain initial access to Langflow deployments? JADEPUFFER exploits CVE-2025-3248, a missing-authentication vulnerability in Langflow's /api/v1/validate/code endpoint that allows unauthenticated remote code execution. It was added to CISA's Known Exploited Vulnerabilities catalog in May 2025. Organizations should update Langflow to version 1.3.0 or later to remediate it, since the remediation deadline has already passed. _Teams patching Langflow deployments can track ransomware campaigns exploiting this CVE on daily.dev._ ### What file types does the ENCFORGE ransomware target on AI infrastructure? ENCFORGE targets approximately 180 file extensions covering the modern AI/ML stack, including model checkpoints (.ckpt, .h5, .onnx, .pt, .safetensors, .gguf), vector indices (.faiss), and training datasets (.parquet, .arrow, .tfrecord, .npy). It uses AES-256-CTR with RSA-2048 key wrapping and renames encrypted files with a .locked extension, making recovery impossible without backups. _Anyone hardening AI pipeline backups against ransomware can follow coverage of ENCFORGE's targeting on daily.dev._ ### How much does it cost to recover a fine-tuned AI model destroyed by ransomware? Direct recovery costs for a representative enterprise-ready, fine-tuned model range from $75,000 to $500,000, reflecting cloud GPU rates across multiple training runs plus engineering labor. Costs scale with model size and training data complexity, and production environments often run multiple variants on shared storage that a single ransomware invocation can encrypt simultaneously, multiplying the total loss. _Teams budgeting for AI infrastructure risk can track incidents like this one on daily.dev._ ## Similar posts on daily.dev - [JadePuffer ransomware used AI agent to automate entire attack](https://daily.dev/posts/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack-egb37hxoo) · BleepingComputer · 12 upvotes · 4 comments - [AI agent runs first end-to-end ransomware attack](https://daily.dev/posts/ai-agent-runs-first-end-to-end-ransomware-attack-ulfxi7gog) · The Next Web · 1 upvotes · 0 comments - [JadePuffer Signals a New Era of AI-Driven Ransomware](https://daily.dev/posts/jadepuffer-signals-a-new-era-of-ai-driven-ransomware-rvacyt3ln) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#golang](https://daily.dev/tags/golang), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/jadepuffer-evolves-the-agentic-threat-actor-deploys-ransomware-built-to-destroy-ai-models-2jlb20g00) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI models","url":"https://daily.dev/posts/jadepuffer-evolves-the-agentic-threat-actor-deploys-ransomware-built-to-destroy-ai-models-2jlb20g00","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/jadepuffer-evolves-the-agentic-threat-actor-deploys-ransomware-built-to-destroy-ai-models-2jlb20g00"},"datePublished":"2026-07-20T13:50:07.928Z","dateModified":"2026-09-14T06:14:42.898Z","description":"The Sysdig Threat Research Team documents a new evolution of JADEPUFFER, an agentic threat actor that exploits CVE-2025-3248 in Langflow to deploy ENCFORGE — a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b5463f31912005df85d255305727d2b6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b5463f31912005df85d255305727d2b6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sysdig Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sysdig Blog","logo":"https://media.daily.dev/image/upload/s--1S2uMy2c--/f_auto,q_auto/v1780213305/logos/sysdig-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/sysdig-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/jadepuffer-evolves-the-agentic-threat-actor-deploys-ransomware-built-to-destroy-ai-models-2jlb20g00","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"golang,ransomware","timeRequired":"PT19M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sysdig Blog","item":"https://daily.dev/sources/sysdig-blog"},{"@type":"ListItem","position":3,"name":"JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI models"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/jadepuffer-evolves-the-agentic-threat-actor-deploys-ransomware-built-to-destroy-ai-models-2jlb20g00#faq","mainEntity":[{"@type":"Question","name":"What CVE does JADEPUFFER exploit to gain initial access to Langflow deployments?","acceptedAnswer":{"@type":"Answer","text":"JADEPUFFER exploits CVE-2025-3248, a missing-authentication vulnerability in Langflow's /api/v1/validate/code endpoint that allows unauthenticated remote code execution. It was added to CISA's Known Exploited Vulnerabilities catalog in May 2025. Organizations should update Langflow to version 1.3.0 or later to remediate it, since the remediation deadline has already passed. Teams patching Langflow deployments can track ransomware campaigns exploiting this CVE on daily.dev."}},{"@type":"Question","name":"What file types does the ENCFORGE ransomware target on AI infrastructure?","acceptedAnswer":{"@type":"Answer","text":"ENCFORGE targets approximately 180 file extensions covering the modern AI/ML stack, including model checkpoints (.ckpt, .h5, .onnx, .pt, .safetensors, .gguf), vector indices (.faiss), and training datasets (.parquet, .arrow, .tfrecord, .npy). It uses AES-256-CTR with RSA-2048 key wrapping and renames encrypted files with a .locked extension, making recovery impossible without backups. Anyone hardening AI pipeline backups against ransomware can follow coverage of ENCFORGE's targeting on daily.dev."}},{"@type":"Question","name":"How much does it cost to recover a fine-tuned AI model destroyed by ransomware?","acceptedAnswer":{"@type":"Answer","text":"Direct recovery costs for a representative enterprise-ready, fine-tuned model range from $75,000 to $500,000, reflecting cloud GPU rates across multiple training runs plus engineering labor. Costs scale with model size and training data complexity, and production environments often run multiple variants on shared storage that a single ransomware invocation can encrypt simultaneously, multiplying the total loss. Teams budgeting for AI infrastructure risk can track incidents like this one on daily.dev."}}]} ```