A threat actor tracked as JADEPUFFER has developed ransomware aimed specifically at the files that make artificial intelligence systems valuable. The operation progressed from improvised database encryption to a compiled tool called ENCFORGE, which targets model weights, fine-tuning adapters, vector indexes and training data rather than simply encrypting every common document it can find.

The shift matters because AI artifacts can embody months of compute, engineering and data preparation. Destroying them may create enough business pressure for extortion even when the attacker never steals a byte or operates a public leak site.

From rough scripts to a purpose-built encryptor

JADEPUFFER’s earlier campaign began with exploitation of CVE-2025-3248, an unauthenticated remote-code execution vulnerability in Langflow that CISA added to its exploited-vulnerability catalog in 2025. A compromised Langflow deployment can expose provider keys and cloud credentials while also providing connections to vector databases, object stores and other internal services.

The actor pivoted to a production database and encrypted 1,342 configuration entries using a built-in AES function. The operation was destructive and poorly engineered: the random encryption key was printed once but apparently neither saved nor transmitted, and the ransom note described a different algorithm. Recovery would have been impossible even if the victim paid.

Researchers said an AI agent drove the operation end to end, narrating its reasoning and correcting failed steps rapidly. In a later intrusion associated through the same extortion contact, the rough scripts were replaced by ENCFORGE.

ENCFORGE understands the AI development stack

ENCFORGE is a UPX-packed Go binary with a command-line interface and separate key-generation utility. It uses AES-256 in counter mode and protects the run-specific key with an embedded RSA-2048 public key. Like some established ransomware families, it encrypts sections of files for speed and adds a .locked extension.

Its selection of roughly 180 extensions distinguishes it from a general-purpose encryptor. The list covers the components needed to build and operate AI systems, including model formats, datasets, vector indexes, fine-tuning adapters and older model weights. The targeting suggests the developer understood the dependencies and replacement cost of an AI pipeline.

An agent solved its own deployment problem

During one attack, the operator had access to the environment but could not retrieve the ENCFORGE binary from command-and-control infrastructure. The agent responded by developing a container-escape method to carry the ransomware across a namespace boundary and run it on the host.

Over just five minutes, it iterated through six Python scripts delivered through the Langflow execution channel, correcting a different failure each time. The episode illustrates how agentic tooling can adapt to the details of a victim environment without waiting for a human operator to troubleshoot every obstacle.

Traditional backups can miss the real recovery chain

A production checkpoint is not interchangeable with the server that stores it. Restoring an old model may discard weeks of fine-tuning, and large artifacts are sometimes omitted from routine backups because of their size. A model also depends on the matching tokenizer, configuration, dataset lineage and vector data. If those pieces are missing or inconsistent, the restored file may not produce a usable system.

Organizations should preserve immutable or offline snapshots of production weights and capture their dependent datasets and configuration as a recoverable unit. They should also run restoration exercises that prove a functioning model can be rebuilt, rather than merely verifying that files exist in backup storage.

Detect the attack before encryption completes

• Patch Langflow to a safe release and reduce its exposure to untrusted networks.
• Prevent application identities from reading or writing model directories unless required.
• Block unnecessary access to the Docker socket and alert when web processes call container APIs.
• Watch for nsenter use against PID 1, credential harvesting followed by cross-service replay, and mass creation of .locked files.
• Store cloud and model-provider credentials outside application runtime environments and rotate reachable secrets after compromise.

Once files begin changing, the remaining response window is short. AI infrastructure should be treated as critical production data: segmented, monitored at runtime and backed up with every dependency needed for a tested recovery.