Threat Overview

The Sysdig Threat Research Team (TRT) has released a detailed report on JADEPUFFER, an agentic threat actor that has upgraded its tactics from database‑centric extortion to targeted destruction of artificial intelligence (AI) and machine learning (ML) assets. The new ransomware payload, named ENCFORGE, is engineered explicitly for AI infrastructure, encrypting or destroying model checkpoints, vector indices, training datasets, and other critical artifacts.

Entry Vector: CVE‑2025-3248 in Langflow

The actor exploits a missing-authentication vulnerability (CVE‑2025-3248) in the open‑source AI orchestration framework Langflow. An unauthenticated attacker can execute arbitrary Python code against the /api/v1/validate/code endpoint. Once inside, JADEPUFFER sweeps for credentials, including cloud provider keys and database connection strings stored in Langflow’s Postgres backend.

Attack Phases

Phase 1 – Reconnaissance & Credential Harvesting: After execution, the actor collects host information (uname, hostname) and probes for internal services via /dev/tcp. Credentials are validated against internal databases and caches.

Phase 2 – Docker Socket Discovery & Binary Retrieval: JADEPUFFER identifies /var/run/docker.sock. It attempts to download the ransomware binary from its command‑and‑control (C2) server at hxxps://34[.]153[.]223[.]102:9191/.lockd. When the download fails, the actor pivots to a host‑escape mechanism.

Phase 3 – Host Escape Toolkit Construction: Using successive Python RCE calls, the actor builds an escape container that mounts the host filesystem and copies the binary from /proc//root into a writable location on the host. The final script deploy.py v2 performs this in under five minutes.

Technical Breakdown of ENCFORGE

The ransomware is a statically compiled Go binary (Go 1.22.12) packed with UPX and then unpacked for analysis. It targets roughly 180 file extensions, including:

• .ckpt, .h5, .onnx, .pb, .pkl, .pt, .safetensors, .ggml, .gguf, .model
• .faiss, .arrow, .parquet, .tfrecord, .npy, .vec, .duckdb
• macOS‑specific formats such as .keychain and .xcodeproj

Encryption uses AES‑256‑CTR for bulk data and wraps the session key with an embedded RSA‑2048 public key. The binary renames encrypted files with a .locked suffix, ensuring idempotent execution.

Detection Opportunities

• CVE‑2025-3248 exploitation: Monitor subprocess creation under the Langflow process owner; any invocation of subprocess.run or check_output is suspicious.

• Docker socket abuse: Alerts on API calls to /containers/create or /start from non‑root application processes.

• Privileged container creation with PID host mode and bind mounts of / indicate escape attempts.

• Mass generation of .locked files in AI asset directories. A sudden flood of encrypted extensions should trigger an investigation.

• YARA detection: The unpacked binary contains Go package paths (encfile/internal/cli/enc) and the embedded RSA public key prefix, enabling reliable signature‑based detection.

Recommendations

• Patch Langflow to version 1.3.0 or later; CVE‑2025-3248 has a remediation deadline in CISA KEV.
• Restrict Docker socket access: mount only the minimal subset of API calls required, and run Langflow containers as non-root with noexec on writable directories.
• Implement filesystem ACLs to limit read/write access to model weight directories for the application user.
• Maintain immutable backups of production AI artifacts (model checkpoints, vector indices) and store them offline or in a versioned snapshot system.
• Configure alerts for creation of .locked files on paths containing .gguf, .safetensors, .ckpt, etc.
• Audit and rotate all credentials exposed to Langflow: environment variables, instance metadata, and credential files.

Conclusion

JADEPUFFER’s progression from a database‑centric attacker to a specialized AI infrastructure saboteur underscores the evolving threat landscape for organizations deploying machine learning pipelines. The ransomware’s focus on irrecoverable assets—model checkpoints, training data, vector indices—means that victims face not only ransom payments but also substantial retraining costs ranging from $75,000 to $500,000 per model. Protecting AI assets requires the same rigorous patching, least‑privilege principles, and backup practices applied to traditional business data.