Agentic JADEPUFFER Exploits Langflow Flaw to Deploy ENCFORGE AI Ransomware

A ransomware campaign is now targeting the assets behind artificial intelligence systems. The threat actor known as JADEPUFFER has evolved from damaging databases to deploying ENCFORGE, a ransomware strain designed to encrypt AI models, training data, and vector databases.

The operation begins by exploiting CVE-2025-3248, a critical missing-authentication flaw in Langflow’s code-validation endpoint.

The bug allows an unauthenticated attacker to run Python code on exposed servers, creating a direct path into environments that often hold cloud keys, API tokens, and database credentials.

Readers can review how the critical Langflow vulnerability enables code injection in earlier coverage.

Researchers at Sysdig identified the latest activity after observing JADEPUFFER return to a previously compromised Langflow instance with a more capable toolkit. 

Sysdig said in a report shared with Cyber Security News (CSN) that the actor autonomously performed reconnaissance, collected credentials, tested internal services, and prepared a route from a container to the host system.

The impact can extend beyond ordinary file recovery. A lost production model may represent months of training, tuning, data preparation, and engineering work.

Even where backups exist, organizations may lose work completed after the latest clean snapshot, while rebuilding proprietary training datasets can delay recovery further.

Agentic JADEPUFFER Exploits Langflow Flaw

After gaining access, JADEPUFFER searched for credentials and examined the Docker socket, which can give a process the ability to create powerful containers.

The actor initially tried to download ENCFORGE but adapted when the file transfer failed, creating scripts that copied the payload through the container process filesystem and launched it on the host.

This method used privileged containers, host process access, and host filesystem mounts to escape the original container boundary.

It reflects a risk long associated with weak container setups, as seen when attackers abuse Docker and Kubernetes misconfigurations to access secrets and broader infrastructure.

ENCFORGE is a compiled Go ransomware binary packed with UPX. It encrypts files using AES-256-CTR with an RSA-2048 public key, adds the .locked extension, kills processes holding files open, and can remove itself after execution.

The malware also drops ransom notes using names including README, HOWTODECRYPT, and READMEDECRYPT.

Unlike many ransomware operations, researchers found no evidence that ENCFORGE included data theft or a leak-site component. Its pressure comes from encryption alone.

The ransom contact embedded in the malware matched the contact used in JADEPUFFER’s earlier campaign, linking the newer ransomware operation to the same actor.

AI Assets Face New Risk

ENCFORGE stands apart because its default file list deliberately covers approximately 180 extensions, including AI model checkpoints, vector indexes, datasets, embeddings, and machine-learning pipeline files.

The targeted formats include .ckpt, .safetensors, .onnx, .gguf, .faiss, .parquet, .pkl, and .pt, showing that model artifacts are central to the campaign’s objective.

The incident reinforces concerns raised in previous reporting on agentic ransomware using Base64 Python payloads, where JADEPUFFER demonstrated rapid adjustment when commands failed.

In this case, the actor built six scripts in just over five minutes, ultimately creating a working host-escape process and verifying whether encryption had succeeded.

Organizations using Langflow should upgrade to version 1.3.0 or later and restrict access to vulnerable deployments.

CISA previously added CVE-2025-3248 to its Known Exploited Vulnerabilities catalog after evidence of active exploitation, making prompt remediation especially important for exposed AI workflow servers.

Defenders should also limit Docker socket access, avoid mounting it into application containers, run Langflow without root privileges, and alert on nsenter activity from containers.

AI model directories and training datasets need strict access controls and offline or immutable backups, while credentials accessible to the Langflow process should be reviewed and rotated after suspected exposure.

Security teams can monitor for privileged container creation, Docker API calls from web applications, unusual Python execution under the Langflow process, and rapid creation of .locked files in model-storage paths.

These checks complement guidance from reports covering active Langflow RCE vulnerability exploitation, where attackers used the same flaw to deploy other payloads.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.