The upgraded JadePuffer autonomous AI agent now utilizes custom malware named EncForge, specifically designed to encrypt crucial AI assets, including training datasets, vector databases, and model checkpoints.
Earlier this month, JadePuffer was identified as an agentic threat actor (ATA) capable of autonomously executing various stages of a ransomware attack, ranging from initial access to data encryption.
According to Sysdig, a leading cloud security firm, their AI agents can adapt to technical challenges in real-time, optimizing intrusion techniques and identifying resolutions within just one minute.
Latest Attack Insights
In a recent report, Sysdig revealed that attackers employed the Go-based EncForge ransomware, which is specifically tailored for AI and machine learning (ML) infrastructures, to target previously compromised Langflow instances vulnerable to CVE-2025-3248.
“This binary is designed to target approximately 180 file extensions and offers extensive coverage of modern AI/ML stacks, including model checkpoints, vector databases, and a variety of training datasets,” noted Sysdig.
After successfully accessing the system, the attacker searched for cloud credentials and API tokens, eventually discovering an exposed Docker socket that granted root-level control.
When the initial attempt to download the ransomware failed, the operator rapidly developed and deployed six Python scripts within five minutes, with the final script (deploy.py v2) resolving the delivery obstacle.
“deploy.py v2 represents the completed payload—an autonomous pipeline that identifies the target PID, transfers ENCFORGE across namespace boundaries via procfs, performs a tri-mode scan, initiates a live encryption process, and verifies execution by counting .locked files.” Sysdig provides further details.
About EncForge Ransomware
The Go-based binaries (lockd) are compressed using the Ultimate Packer for eXecutables (UPX) and target 180 file extensions, including:
- AI model checkpoints
- Hug Face SafeTensors files
- PyTorch and TensorFlow models
- GGUF and GGML weights
- FAISS vector index
- Training datasets in formats like Parquet, Arrow, TFRecord, NumPy, and DuckDB
The command-line interface also incorporates LoRA adapters and conventional GGML files as examples of additional targeted files, indicating that this ransomware has been specifically engineered for AI environments, not as a generic file encryption tool.
EncForge employs the AES-256 algorithm in counter mode to selectively encrypt files, utilizing a hybrid scheme where the symmetric key is safeguarded by an RSA-2048 public key.
To enhance performance, this malware encrypts only specific sections of each file, leaving victims with files appended with a .locked extension, accompanied by a ransom note that includes a unique victim identifier.
Source: Sysdig
Experts found no indication that JadePuffer exfiltrated data during the breach, and EncForge reportedly lacks any mechanisms for data theft.
Analysis of the Linux variants reveals anti-recovery features targeting Windows, such as the removal of shadow copies and the disabling of boot recovery options, while a macOS version is hinted at but remains unconfirmed.
Sysdig emphasized that encrypting model weights, training datasets, and vector indexes can take organizations weeks or even months to train and fine-tune, incurring estimated costs ranging from $75,000 to $500,000 per model based on its size and purpose.
Recommended defenses include applying security updates (especially for Langflow versions 1.3.0 and later), restricting Docker socket access, running the Langflow container as a non-root user, and implementing filesystem-level access controls for the model weights directory.
Security teams document 54% of successful attacks yet issue warnings for only 14%. The remaining incidents go undetected within the environment.
Picus’ whitepaper provides insights on testing your SIEM and EDR rules through breach and attack simulations to ensure threats remain visible.
Source: www.bleepingcomputer.com