The JADEPUFFER threat actor is targeting AI infrastructure by exploiting Langflow vulnerabilities to deploy ENCFORGE, a specialized ransomware strain designed to encrypt model weights, datasets, and vector indexes.

Key Points

• The JADEPUFFER operator exploits CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow versions prior to 1.3.0.
• ENCFORGE is a Go-based ransomware that specifically targets approximately 180 file extensions, including PyTorch, TensorFlow, Hugging Face SafeTensors, and GGUF model formats.
• The attacker uses the Docker socket to break out of containers, gaining host-level access to encrypt AI assets using AES-256-CTR and RSA-2048 encryption.
• Sysdig researchers identified the campaign through a shared Proton Mail address (e78393397@proton.me) used in both the initial Nacos database attacks and this new ENCFORGE deployment.
• Security teams are advised to patch Langflow to version 1.9.1 or later and restrict access to the Docker socket to prevent unauthorized host-level container creation.

Why it Matters

The emergence of ENCFORGE signals a shift toward ransomware specifically engineered to cripple AI development pipelines by destroying expensive model weights and training data. Organizations face significant financial risk, as the cost to reconstruct encrypted AI models can reach $500,000 per instance in compute and engineering resources.