ENCFORGE Ransomware: Anatomy of an AI-Focused Cyber Attack

Summary

ENCFORGE is a newly identified ransomware strain associated with the threat actor JADEPUFFER, representing an evolution in ransomware campaigns by specifically targeting artificial intelligence (AI) and machine learning infrastructure. Unlike traditional ransomware that primarily encrypts business documents and databases, ENCFORGE targets critical AI assets, including model checkpoints, training datasets, vector databases, and AI-related files. The attack begins by exploiting the Langflow vulnerability CVE-2025-3248, enabling unauthenticated remote code execution. After gaining access, the attacker performs reconnaissance, identifies valuable AI resources, and deploys the ENCFORGE ransomware payload to disrupt AI workloads and damage critical AI assets.

ENCFORGE specifically targets AI framework files and platforms, including PyTorch, TensorFlow, Hugging Face SafeTensors, ONNX models, GGUF/GGML models, FAISS indexes, and training data formats. By encrypting these assets, ENCFORGE can render AI models unusable and create significant recovery challenges. This attack highlights the growing threat of ransomware campaigns targeting AI infrastructure and intellectual property, emphasizing the need for organizations to strengthen protection for AI models, datasets, and supporting environments against emerging cyber threats.

Background

JADEPUFFER is an emerging threat actor known for using automated and AI-assisted techniques to conduct cyberattacks against organizations, with a focus on compromising AI infrastructure and valuable digital assets. The group represents a shift toward more advanced “agentic” cyber threats, where attackers use automated workflows for reconnaissance, exploitation, and post-compromise activities. JADEPUFFER gained attention after exploiting vulnerabilities in AI-related platforms, including Langflow, an open-source framework used to build AI applications. By abusing security weaknesses such as CVE-2025-3248, the attacker was able to gain unauthorized access, perform environment discovery, search for credentials, and move across compromised networks.

Initially, JADEPUFFER activity involved opportunistic attacks against databases and infrastructure. However, the threat actor later evolved its approach by deploying ENCFORGE ransomware, a tool specifically designed to target AI assets such as models, datasets, and related resources. This shift highlights the growing risk of cyberattacks against AI environments, as threat actors increasingly target AI systems and intellectual property. Organizations adopting AI technologies should strengthen vulnerability management, access controls, monitoring, and backup strategies to reduce the impact of emerging AI-focused threats.

Vulnerability Details

Attack Methodology of ENCFORGE Ransomware Attack

JADEPUFFER represents a shift from traditional infrastructure-focused ransomware toward specialized attacks targeting AI environments. The campaign combines exploitation of CVE-2025-3248, automated reconnaissance, credential harvesting, Docker escape techniques, and the ENCFORGE ransomware payload to compromise AI workloads. By specifically targeting machine learning models, datasets, and AI development resources, the operation creates significant operational disruption and threatens valuable organizational intellectual property.

Evolution of JADEPUFFER Ransomware Campaigns

Prior Campaign
│
├── Database-only encryption
├── Python scripts
├── Single production server
└── Credential theft (AI keys)

                ↓ Evolution

Latest Campaignch
│
├── Hybrid AES-256-CTR + RSA-2048 encryption
├── Go-based ransomware
├── Filesystem-wide encryption (~180 extensions)
└── Destructive targeting of AI/ML assets

Indicators of Compromise (IOCs)

Network Indicators

Binary Hashes (SHA-256)

Build-Stable Indicators

Source: Sysdig

MITRE ATT&CK Mapping

Visual Attack Flow

Mitigation

1. Patch Langflow immediately. Upgrade to Langflow version 1.3.0 or later to remediate CVE-2025-3248, which has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Avoid exposing Langflow execution endpoints directly to the internet unless protected by appropriate access controls.
2. Harden the container environment. Restrict Docker socket access and avoid mounting /var/run/docker.sock into Langflow containers. If Docker socket access is unavoidable, use a scoped socket proxy that permits only required API calls. Run Langflow containers as non-root users, apply noexec protections on writable directories, and monitor for suspicious container-based nsenter activity.
3. Protect AI model assets. Apply filesystem access controls to model weights and training datasets to prevent unauthorized access from application processes. Maintain offline or immutable backups of production AI artifacts such as .gguf, .safetensors, and .ckpt files, and monitor for unauthorized creation of .locked files in model storage paths.
4. Secure AI provider credentials. Do not store OpenAI, Anthropic, Hugging Face, or other AI provider API keys in the Langflow runtime environment. Store secrets in a dedicated secrets management solution with strict access controls and rotate any credentials that may have been exposed.
5. Perform credential hygiene reviews. Audit all credentials accessible to the Langflow process, including environment variables, cloud instance metadata, and local credential files. Rotate any secrets present on systems that previously ran vulnerable Langflow versions.
6. Implement access controls and network restrictions. Apply least-privilege permissions, restrict unnecessary outbound connectivity, and use firewall or egress filtering controls to reduce the risk of command-and-control activity or data exfiltration.
7. Monitor for malicious activity. Deploy runtime detection and logging to identify suspicious container behavior, unauthorized code execution, abnormal access to AI model files, credential harvesting attempts, and indicators of compromise associated with exploitation of vulnerable Langflow deployments.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.