JADEPUFFER Deploys ENCFORGE Ransomware Targeting AI Model Assets
Summary
Sysdig reports that JADEPUFFER exploited a Langflow flaw and deployed ENCFORGE, ransomware targeting AI model files and datasets. Researchers analyzed its encryption and container-escape techniques and found no evidence of data exfiltration.
Key points
- JADEPUFFER exploited CVE-2025-3248, an unauthenticated code execution flaw in Langflow, before harvesting credentials and probing internal services.
- The operator iterated Python scripts that used the Docker socket, privileged containers, procfs and nsenter to move the payload toward the host.
- ENCFORGE is a UPX-packed Go ransomware binary targeting roughly 180 file extensions, including model checkpoints, vector indexes and training datasets.
- The binary uses AES-256-CTR and an embedded RSA-2048 public key, encrypts file regions and appends the .locked suffix.
- Sysdig linked the activity to the earlier JADEPUFFER campaign through a shared extortion contact; it found no evidence of exfiltration during the session.
- Researchers recommend upgrading Langflow to 1.3.0 or later, restricting Docker socket access and maintaining offline or immutable snapshots of model artifacts.
Article Details
- Attack Vectors
- JADEPUFFER exploited unauthenticated Python code execution in Langflow's /api/v1/validate/code endpoint, then searched for credentials and probed internal services.
- The operator used the Docker socket to create privileged containers and developed scripts using nsenter and procfs to move ENCFORGE across the container boundary. The initial binary fetch failed; the article does not establish successful encryption during the session.
- ENCFORGE encrypts selected files, including AI model artifacts and datasets, and adds the .locked extension. Its analyzed code also contains Windows recovery-disabling functionality.
- Defensive Notes
- Update Langflow to version 1.3.0 or later and monitor subprocess execution under its application user.
- Restrict Docker socket access, alert on privileged container creation and nsenter from containers, and run Langflow containers as non-root with noexec on writable directories.
- Maintain offline or immutable snapshots of model artifacts, restrict access to model weights and training datasets, and monitor ML asset paths for .locked file creation.
- Audit and rotate credentials exposed to vulnerable Langflow processes; avoid storing AI provider API keys in their runtime environment.
- Use the article's YARA rule to detect unpacked ENCFORGE binaries.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
e78393397@proton[.]me | Extortion contact in ENCFORGE and the prior JADEPUFFER operation. | |
| IPV4 | 34[.]153[.]223[.]102 | C2 and ENCFORGE binary hosting infrastructure. |
| IPV4 | 45[.]131[.]66[.]106 | Source IP associated with the JADEPUFFER operation. |
| SHA256 | 8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2 | SHA-256 of the UPX-packed ENCFORGE ransomware sample. |
| SHA256 | ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328 | SHA-256 of the unpacked ENCFORGE ransomware sample. |
| URL | hxxp[:]//34[.]153[.]223[.]102:9191/.lockd | Attacker-hosted ENCFORGE ransomware download URL. |
| URL | hxxp[:]//34[.]153[.]223[.]102:9191/lockd | Attempted ransomware download URL; the article reports that the fetch failed. |
MITRE ATT&CK
T1027.002 · Software PackingThe analyzed ENCFORGE ransomware binary was packed with UPX.T1027.013 · Encrypted/Encoded FileThe operator delivered escape scripts through an inline base64 decode inside the Langflow execution channel.T1046 · Network Service DiscoveryJADEPUFFER probed internal services for reachability using /dev/tcp.T1059.006 · PythonThe operator built and executed Python escape scripts through the Langflow code-execution channel.T1082 · System Information DiscoveryThe operator collected host information using uname -m and hostname after gaining execution.T1087 · Account DiscoveryThe operator ran id to inspect its execution identity.T1105 · Ingress Tool TransferThe operator attempted to download ENCFORGE from attacker-controlled infrastructure, although the observed fetch failed.T1190 · Exploit Public-Facing ApplicationJADEPUFFER exploited CVE-2025-3248 in Langflow's unauthenticated code-validation endpoint for initial access.T1486 · Data Encrypted for ImpactENCFORGE encrypts targeted files, including AI model artifacts, and renames them with a .locked extension.T1489 · Service StopENCFORGE includes functionality to kill processes holding file locks before encryption.T1490 · Inhibit System RecoveryThe analyzed binary contains Windows code invoking vssadmin.exe and bcdedit.exe to delete shadow copies and disable recovery; the article does not report its execution on Windows.T1611 · Escape to HostThe escape scripts created privileged containers with host access and used nsenter to cross into host namespaces.
CVE
Threat Actors
Malware
Products
DockerThe campaign used Docker socket abuse, privileged escape containers, and nsenter-based host escape techniques to move the payload onto the host.LangflowJADEPUFFER returned to a Langflow instance using CVE-2025-3248 and deployed ENCFORGE, a Go-based ransomware built to destroy AI and machine learning assets such as model checkpoints, vector databases, and training