Sysdig reports JadePuffer ransomware targeting AI model assets
Sysdig reported on July 20 that the operator it tracks as JadePuffer returned to a vulnerable Langflow deployment and used a Go ransomware binary called ENCFORGE against AI and machine-learning assets. The malware targets about 180 file extensions, including model checkpoints, vector indexes and training datasets, after exploitation of CVE-2025-3248 and access through an exposed Docker socket.
Sysdig Threat Research reported on July 20 that the operator it tracks as JADEPUFFER returned to a previously compromised Langflow instance and deployed ENCFORGE, a Go ransomware binary designed to encrypt files used in AI and machine-learning systems. BleepingComputer separately reported the findings after reviewing Sysdig's disclosure.
How the reported intrusion unfolded
Sysdig said the entry point remained CVE-2025-3248, an unauthenticated code-execution flaw in Langflow's /api/v1/validate/code endpoint. After gaining access, the operator searched for cloud credentials, API tokens and internal services, then found a writable Docker socket. Access to that socket allowed commands to reach the host outside the original container.
When an initial attempt to fetch the ransomware failed, Sysdig observed six Python scripts created over about five minutes. The final version located a target process, copied ENCFORGE across the namespace boundary through procfs, ran a scan, started encryption and counted files renamed with .locked to confirm execution.
Sysdig classifies JadePuffer as an agentic threat actor based on behavioral evidence including rapid failure correction and self-narrating payloads. That attribution should be read as the research team's assessment; the public evidence does not independently establish which model or orchestration system controlled the operation.
What ENCFORGE targets
Sysdig's binary analysis found roughly 180 targeted extensions across the ML stack, including:
- •PyTorch, TensorFlow, ONNX, SafeTensors, GGUF and GGML model files
- •FAISS vector indexes
- •Parquet, Arrow, TFRecord, NumPy and DuckDB data files
- •LoRA adapters and other fine-tuning artifacts
The researchers said the UPX-packed binary uses AES-256-CTR for file encryption and wraps the symmetric key with an embedded RSA-2048 public key. It encrypts selected file regions, appends .locked, terminates processes holding targeted files and can delete itself after running. Sysdig found no evidence of data exfiltration during the observed session and no network-based theft capability in the recovered binary.
The concrete defensive fixes
GitHub's reviewed advisory lists Langflow versions before 1.3.0 as affected by CVE-2025-3248 and version 1.3.0 as patched. It assigns the flaw a 9.3 CVSS v4 score and confirms that an unauthenticated attacker could execute arbitrary code through the validation endpoint.
For teams operating Langflow or adjacent ML infrastructure, the immediate controls follow directly from the observed path: update affected deployments, remove unnecessary Docker socket mounts, run containers without root privileges, restrict filesystem access to model stores and keep immutable recovery copies of model artifacts, datasets and experiment metadata. The incident is a reminder that checkpoints and vector indexes are production assets; their recovery plan should be tested alongside databases and application data.
Key Points
- 1Sysdig says ENCFORGE targets roughly 180 AI and ML file extensions, including model checkpoints, vector indexes and training datasets.
- 2The observed path combined Langflow CVE-2025-3248 with a writable Docker socket, allowing the payload to move from the application container to the host.
- 3GitHub lists Langflow 1.3.0 as the patched release; teams should also restrict container privileges and keep immutable copies of ML artifacts.
Scoring Rationale
This is a notable AI infrastructure security development because the recovered ransomware explicitly targets common model, vector-index and training-data formats. The incident offers concrete defensive lessons for exposed Langflow and container deployments, while the agentic attribution and campaign details remain primarily based on one vendor research team's observations.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
