Rise of AI-Targeting Ransomware: The JadePuffer Campaign
In a significant development in the cybersecurity landscape, researchers have identified a sophisticated ransomware campaign executed end-to-end by a large language model (LLM). This operation, dubbed "JadePuffer," has been reported as the first of its kind, and it is particularly concerning due to its focus on dismantling artifacts associated with trained AI models.
According to new insights shared by the Sysdig Threat Research Team (TRT) on July 20, JadePuffer revisited a Langflow instance that it previously targeted and deployed a newly designed ransomware payload known as ENCFORGE. This Go-based binary is meticulously crafted to seek out and encrypt approximately 180 different file extensions that are prevalent within the modern machine learning (ML) framework.
The targeting strategy employed by the ransomware is systematic rather than random, reflecting a chilling precision. Notable formats at risk include checkpoints generated by PyTorch and TensorFlow, weights utilized in HuggingFace SafeTensors, quantized models from llama.cpp, vector indices from FAISS, Apache Parquet files, TFRecord training datasets, and even NumPy arrays. The implications of such targeted attacks extend beyond mere disruption; they threaten the very infrastructure that supports AI development.
The High Costs of Recovery
The ramifications of this ransomware attack are profound, particularly when considering the challenges posed in the recovery of encrypted business data. While backups are often seen as a safety net for restoring lost information, they do not necessarily guarantee a seamless recovery for production models. The critical interval between the last uncorrupted snapshot and the actual attack may represent weeks or even months of painstaking training, fine-tuning, and careful data curation, all of which can be lost in an instant.
Research from Sysdig indicates that re-creating this gap involves substantial financial investment, ranging from $75,000 to $500,000 for each model in terms of cloud GPU usage and engineering expertise. This expense escalates even further if the necessary training data resides on the same machine targeted by the ransomware, as recovery is entirely obstructed until that data can be reconstructed.
The ENCFORGE binary employed in this operation is particularly alarming, as it was capable of sweeping every model variant stored on shared storage in a singular pass. An innovative command-line interface allowed operators to append custom extensions for their campaigns, with the binary’s embedded help text explicitly naming examples like LoRA fine-tune adapters and legacy GGML weights, further demonstrating the ruthlessness and forethought behind its design.
Intrusion Techniques: Real-Time Adaptation
The entry point for this ransomware was through a known vulnerability labeled CVE-2025-3248. This missing-authentication issue in Langflow’s code validation endpoint was flagged by the Cybersecurity and Infrastructure Security Agency (CISA) and added to its catalog of known exploited vulnerabilities in May 2025. This vulnerability enabled the actor to infiltrate the system and initiate a series of reconnaissance activities along with credential harvesting, consistent with behaviors noted in previous campaigns.
Upon securing access, the operator quickly located a mounted Docker socket, utilizing it to fetch the ransomware payload. However, when an initial attempt to retrieve this payload from JadePuffer’s command-and-control server failed within the container, the operator exhibited remarkable adaptability. They devised a new delivery mechanism in real time, iterating through six separate Python scripts across the Langflow RCE channel. This ingenuity culminated in a successful construction of a pipeline that leveraged the Docker socket to spawn a privileged escape container, allowing the locker to traverse across namespace boundaries via the host’s procfs. The final outcome was a successful encryption of files located on the host filesystem, circumventing the isolation typically imposed by the original container.
The ENCFORGE binary itself employs sophisticated encryption techniques, utilizing AES-256-CTR in tandem with RSA-2048 for key exchange. The ransomware even ensures efficient operation by terminating processes that hold file locks prior to encryption and subsequently self-deleting post-execution, minimizing its footprint and complicating detection efforts.
Importantly, Sysdig observed that the binary does not possess capabilities for data exfiltration nor does it have a leak site, marking a distinct deviation from the double-extortion strategies commonly employed by many ransomware-as-a-service (RaaS) groups. Instead, the primary threat posed by JadePuffer lies in the act of destruction itself, rather than any intent to disclose sensitive data.
As the cybersecurity community grapples with the evolving threats posed by ransomware, the JadePuffer campaign serves as a chilling reminder of the unique vulnerabilities facing AI-powered infrastructures. With its targeted approach wreaking havoc on machine learning models, entities involved in AI development must remain vigilant and prepared to defend against such sophisticated attacks.