When an attacker breaks into your network, encrypts your core intellectual property, and doesn't bother leaving a way to pay the ransom, you aren't dealing with extortion. You are dealing with a wiper.
That is exactly what happened when the threat actor group known as JADEPUFFER launched its latest campaign in July 2026. As documented by the Sysdig Threat Research Team, JADEPUFFER hit the same internet-facing Langflow server twice in less than three weeks. On July 1, the attacker improvised by encrypting database configuration files. But by July 20, JADEPUFFER escalated to a compiled Go binary called ENCFORGE—a payload custom-built to scan for, lock, and destroy machine learning model weights, training datasets, and vector stores.
Reporting from Security Affairs corroborates that JADEPUFFER represents one of the first end-to-end AI-driven ransomware operations, where an autonomous AI agent handles initial exploitation, credential theft, lateral movement, and asset destruction. This shift marks a dangerous inflection point for enterprise security teams moving from perimeter defense toward AI-native architectures.
How JADEPUFFER Escalated AI Cybersecurity Threats
Generic ransomware families encrypt whatever files they happen to hit on an infected volume. They don't care whether a directory holds PDF invoices, C# source code, or CAD drawings. ENCFORGE is fundamentally different. It targets artificial intelligence infrastructure with surgical precision.
According to technical analysis detailed by VentureBeat, the ENCFORGE binary carries a specific target list of roughly 180 file extensions. It specifically searches host drives for PyTorch (.ckpt) checkpoints, TensorFlow files, Hugging Face SafeTensors (.safetensors) weights, GGUF (.gguf) binaries, Low-Rank Adaptation (LoRA) adapters, legacy GGML weights, FAISS (.faiss) vector indexes, and raw training data saved in Parquet and NumPy formats.
Whoever wrote ENCFORGE knew exactly how modern AI engineering teams store their core IP. Michael Clark, who leads Sysdig's threat research team, noted that the payload targets "the one thing an organization can't simply restore."
What makes ENCFORGE even more sinister is its total lack of an extortion backend. The binary contains zero outbound network code, no command-and-control (C2) callback dial, no TOR leak site link, and no automated decryption portal. While the dropped ransom note provides a Proton Mail contact address tied to JADEPUFFER, the binary itself cannot exfiltrate keys or communicate host state back to the attacker. In JADEPUFFER's earlier July 1 campaign, the encryption keys were generated at random, printed once to a temporary console, and discarded immediately. ENCFORGE is a destructive wiper masquerading as ransomware.
Anatomy of the ENCFORGE Model Wiper Payload
To encrypt massive multi-gigabyte model weights without getting bogged down in endless disk I/O, ENCFORGE uses an optimized partial-file encryption routine. The Go binary employs AES-256-CTR to encrypt specific file regions, wrapping each per-run key with an embedded RSA-2048 public key. This speed optimization allows the malware to ruin multi-gigabyte SafeTensors and GGUF files in seconds.
The initial compromise vector relies on CVE-2025-3248, a critical missing-authentication flaw in Langflow's code-validation endpoint (/api/v1/validate/code). Rated at a 9.8 CVSS severity, the flaw allows unauthenticated remote attackers to execute arbitrary Python code directly on the host. CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities (KEV) catalog back in May 2025, and Langflow maintainers patched it in version 1.3.0. Yet fourteen months later, the victim's server remained completely unpatched.
Langflow is heavily targeted because of what sits inside its environment. Search data indicates roughly 7,000 Langflow instances remain exposed to the public internet, most holding API keys for OpenAI and Anthropic, cloud provider credentials, and live connection strings to enterprise vector databases.
+-------------------------------------------------------------------+
| JADEPUFFER Attack Pipeline |
+-------------------------------------------------------------------+
| 1. Exploits CVE-2025-3248 on exposed Langflow endpoint |
| 2. Agent harvests API keys (OpenAI/Anthropic) & cloud secrets |
| 3. Discovers Docker socket (/var/run/docker.sock) for container |
| escape |
| 4. Autonomously writes & executes 6 corrective Python scripts |
| 5. Deploys ENCFORGE compiled Go binary across namespace boundary |
| 6. Encrypts PyTorch, SafeTensors, GGUF & FAISS model weights |
| 7. Confirms file counts of .locked targets with zero C2 outbound |
+-------------------------------------------------------------------+
This vulnerability pattern is hardly isolated. CISA has added five separate Langflow flaws to the KEV catalog, including CVE-2026-55255 (a 9.9 CVSS cross-tenant bypass) and CVE-2026-0770 (a 9.8 CVSS unauthenticated code execution vulnerability discovered by Trend Micro in July 2026). As zero-day exploits escalate across AI management platforms—similar to earlier critical flaws like the Check Point SmartConsole zero-day—attackers are exploiting exposed orchestration interfaces to bypass traditional network perimeters.
Autonomous Host Escapes and Five-Minute Pivots
The most alarming aspect of the July 20 campaign was how the attacker responded when initial staging failed. After confirming code execution via Langflow, the agent scanned the environment for cloud keys and database tokens. It located the host Docker socket mounted at /var/run/docker.sock—which effectively grants root access over the host.
When the agent attempted to pull the compiled ENCFORGE ransomware binary from its C2 server, the download failed due to network egress controls. A human operator might have given up or spent hours troubleshooting the staging server. Instead, the autonomous agent pivoted instantly.
Over the course of just 5 minutes and 24 seconds, the agent generated and executed six consecutive Python scripts through the Langflow code validation endpoint. Each script analyzed the error output from the previous attempt, modified its approach, and resubmitted itself until it achieved a full host container escape.
The final script used the Docker API to locate the underlying host process ID, copied the ENCFORGE binary across the container namespace boundary into the host filesystem, executed the encryption process, and ran a directory count to verify how many model files had been locked.
Heath Renfrow, co-founder and CISO at breach-recovery firm Fenix24, observed that when an autonomous agent compresses hours of manual operator tasks into minutes, security operations center (SOC) analysts lose their traditional window for containment. Sam Evans, former CISO at Clearwater Analytics, underscored the urgency: in security, dwell time dictates blast radius. When an agent executes a complete multi-step compromise in under six minutes, conventional human incident response is already too late. As seen in previous sandbox escape incidents like the OpenAI-Hugging Face breach, agentic automation changes the operational tempo of modern cyber attacks.
The Financial Disaster of Unrecoverable Weights
Security leaders often fail to secure AI infrastructure because they misclassify model loss as a routine IT glitch rather than a catastrophic business event. Kayne McGladrey, IEEE Senior Member and identity security expert, emphasized that executive leadership and CFOs only allocate budget when technical exposures are framed as direct financial risks.
Restoring a standard transactional database from last Friday's snapshot is routine: you restore the database schema and replay the missing transaction logs. But a fine-tuned artificial intelligence model cannot be "replayed" from database rows. A model weight file represents thousands of GPU compute hours, proprietary hyperparameter tuning, and specialized domain training accumulated over months.
Sysdig estimates that direct recovery costs for a single production-ready fine-tuned model range from $75,000 to over $500,000. That figure accounts purely for cloud GPU rental rates and direct engineering hours needed to re-train the model from scratch.
+-------------------------------------------------------------------+
| Model Loss vs. Database Loss Economics |
+-------------------------------------------------------------------+
| Impact Metric | Enterprise RDBMS | Fine-Tuned AI Model |
+---------------------+-----------------------+---------------------+
| Recovery Method | Snapshot + Log Replay | Complete Retraining |
| Recovery Time | 2 - 6 Hours | 3 - 6 Weeks |
| Direct Financial | Standard Admin Hours | $75K - $500K GPU/Eng|
| Data Dependency | Transaction Logs | Raw Datasets/Weights|
| Ransom Feasibility | Decryption Key Option | None (Wiper Payload)|
+---------------------+-----------------------+---------------------+
If ENCFORGE encrypts the training dataset stored on the same volume as the model weights, recovery becomes mathematically impossible unless raw data is backed up off-site. And because ENCFORGE provides no functional decryption key or recovery path, paying a ransom is a complete dead end.
Mike Riemer, Field CISO and SVP of Network Security Group at Ivanti, pointed out that software vendors have hardened traditional network front doors. Consequently, threat actors are leveraging stolen keys and exposed orchestrators to walk straight through the back door. Riemer warned that organizations delaying patches beyond 72 hours leave themselves wide open to machine-speed exploits.
Securing Model Artifacts with CISA Defenses
Defending AI models against destructive wiper strains requires aligning operations with established CISA Cybersecurity Best Practices and rigorous runtime isolation. Security teams should treat model artifacts with the same level of protection reserved for critical database backbones and master source code repositories.
Here is a step-by-step tutorial and operational checklist for securing AI infrastructure:
-
Immediate Orchestrator Patching: Audit all public and internal IP spaces for exposed Langflow, Flowise, or similar orchestration interfaces. Upgrade all Langflow instances immediately to version 1.9.1 or higher to patch CVE-2025-3248, CVE-2026-55255, and CVE-2026-0770. Review web server logs for historical HTTP POST requests to
/api/v1/validate/codematching theexec_globalsexploit signature. -
Eliminate Container Socket Mounts: Never mount
/var/run/docker.sockor pod administrative sockets inside application containers. If container orchestration requires API access, place a read-only socket proxy between the container and the daemon to filter forbidden commands. -
Dedicated Model Backup Schedules: Update enterprise disaster recovery and backup policies to explicitly include file paths holding
.ckpt,.safetensors,.gguf, and.faissextensions. Store immutable, air-gapped snapshots in isolated cloud object storage far removed from execution nodes. -
Secret Hardening and Token Rotation: Immediately rotate all OpenAI, Anthropic, and cloud access credentials configured in Langflow environments. Remove hardcoded API tokens from runtime containers and integrate dedicated secrets managers (such as HashiCorp Vault or AWS Secrets Manager) with strict zero-trust access policies.
-
Runtime Behavior and YARA Monitoring: Deploy host runtime detection rules to flag anomalous mass file renaming or region modification of model artifacts. Sysdig published dedicated YARA signatures for ENCFORGE; enterprise SOCs should monitor for mass creation of
.lockedfiles across storage volumes housing ML assets.
Enterprise architectures—ranging from legacy IBM cloud deployments to modern cloud-native clusters—must adapt to agentic threats. Securing AI pipelines is no longer just about preventing prompt injection or data leakage; it is about defending operational continuity against autonomous wipers that seek to erase your artificial intelligence assets permanently.
