Sysdig Says JadePuffer Used EncForge Ransomware to Target AI/ML Assets
Summary
Sysdig says JadePuffer used custom Go ransomware EncForge against a vulnerable Langflow instance, exploiting an exposed Docker socket to encrypt AI/ML assets. Researchers found no evidence of data theft and recommend patching Langflow and restricting socket access.
Key points
- Sysdig reports JadePuffer returned to a Langflow instance vulnerable to CVE-2025-3248.
- The attacker found an exposed Docker socket that provided root-level control after searching for cloud credentials, API tokens, and reachable internal services.
- After an initial payload download failed, the operator developed and deployed six Python scripts in five minutes; the final script resolved delivery issues.
- The Go-based EncForge ransomware targets about 180 file extensions, including AI model checkpoints, vector indexes, and training datasets.
- EncForge encrypts selected portions of files using AES-256 in counter mode, protects the symmetric key with RSA-2048, and appends .locked to encrypted files.
- Sysdig found no evidence of data exfiltration and says EncForge does not appear to include a data-stealing mechanism.
- Recommendations include updating Langflow to version 1.3.0 or later, restricting Docker socket access, running containers as non-root, and applying filesystem access controls.
Article Details
- Attack Vectors
- JadePuffer exploited a previously breached Langflow instance vulnerable to CVE-2025-3248.
- An exposed Docker socket provided root-level control.
- After an initial payload download failed, the operator developed and deployed six Python scripts; the final script copied EncForge across a namespace boundary via procfs and launched encryption.
- Defensive Notes
- Apply available security updates, including Langflow version 1.3.0 or later.
- Restrict Docker socket access and run Langflow containers as non-root.
- Apply filesystem-level access controls to model-weight directories.
MITRE ATT&CK
T1027.002 · Software PackingThe EncForge Linux binary was packed using UPX.T1057 · Process DiscoveryThe final deployment script discovered the target PID before copying and running EncForge.T1059.006 · PythonJadePuffer developed and deployed six Python scripts to resolve payload delivery problems; the final script launched the encryption workflow.T1190 · Exploit Public-Facing ApplicationJadePuffer exploited the vulnerable Langflow instance, identified as susceptible to CVE-2025-3248, for initial access.T1486 · Data Encrypted for ImpactEncForge encrypted AI and ML files, appending the .locked extension.T1611 · Escape to HostThe exposed Docker socket provided JadePuffer root-level control.