The agentic operator documented as the first ransomware campaign run end-to-end by a large language model (LLM) has returned with a purpose-built locker designed to destroy trained AI model artifacts.
According to new research from the Sysdig Threat Research Team (TRT) published one July 20, JadePuffer re-entered the same Langflow instance it hit in its earlier campaign and staged ENCFORGE, a UPX-packed Go ransomware binary that targets roughly 180 file extensions across the modern machine learning stack.
The payload’s targeting is deliberate rather than opportunistic. Named formats include PyTorch and TensorFlow checkpoints, HuggingFace SafeTensors weights, llama.cpp GGUF quantized models, FAISS vector indices, Apache Parquet and TFRecord training datasets and NumPy arrays.
Read more on AI-framework exploitation: Hackers Exploit Critical Langflow Bug in Just 20 Hours
Rebuilding Costs Where Backups Do Not Help
Backups can restore encrypted business data, but for production model, the gap between the last clean snapshot and the attack often represents weeks or months of training runs, fine-tuning iterations and data curation.
Sysdig said reproducing that gap requires re-running training at $75,000 to $500,000 per model in cloud GPU and engineering time. If the training data is on the same host, recovery is blocked entirely until that data is reconstructed.
The observed ENCFORGE binary swept every model variant on shared storage in one pass. A command-line interface –include flag let operators append custom extensions per campaign, and the binary’s own help text named LoRA fine-tune adapters and legacy GGML weights as the example.
Sysdig attributed the operation to JadePuffer on the strength of the extortion contact embedded in the binary, which matches the address disclosed in its earlier report.
Container Escape Built in Real Time
Entry was again through CVE-2025-3248, a missing-authentication flaw in Langflow’s code validation endpoint that CISA added to its Known Exploited Vulnerabilities catalog in May 2025.
Once inside, the agent ran through the familiar reconnaissance and credential-harvest routine seen in the first campaign, then discovered a mounted Docker socket and moved to fetch the ransomware payload.
When the binary fetch from JadePuffer’s command-and-control (C2) server failed inside the container, the operator rebuilt the delivery mechanism on the fly.
Over five minutes and 24 seconds, it iterated six Python scripts through the Langflow RCE channel, converging on a working pipeline that used the mounted Docker socket to spawn a privileged escape container, copied the locker across the namespace boundary via the host’s procfs, then ran the encryption pass on the host filesystem outside the original container’s isolation.
ENCFORGE itself uses AES-256-CTR with an RSA-2048 key exchange, kills processes holding file locks before encrypting and self-deletes after running.
Sysdig found no data-exfiltration capability in the binary and no leak site, which places JadePuffer outside the double-extortion model used by most ransomware-as-a-service (RaaS) groups. The threat is the destruction itself, not disclosure.
