JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI models

The Sysdig Threat Research Team documents a new evolution of JADEPUFFER, an agentic threat actor that exploits CVE-2025-3248 in Langflow to deploy ENCFORGE — a compiled, UPX-packed Go ransomware purpose-built for AI/ML infrastructure. ENCFORGE targets approximately 180 file extensions covering model checkpoints (.gguf, .safetensors, .ckpt, .pt), vector databases (.faiss), and training datasets (.parquet, .tfrecord, .npy), using AES-256-CTR with RSA-2048 key encapsulation. When the binary fetch from C2 failed, JADEPUFFER autonomously constructed a Docker socket escape toolkit in under six minutes, copying the binary across namespace boundaries via procfs. Unlike double-extortion ransomware, ENCFORGE is destruction-first with no exfiltration capability. Recovery costs for encrypted AI models range from $75,000 to $500,000 per model. The post includes full IOCs, a YARA rule, and hardening recommendations including patching Langflow to 1.3.0+, restricting Docker socket access, and maintaining offline model artifact backups.