JADEPUFFER Deploys ENCFORGE Ransomware Built to Destroy AI Models and Training Data

JADEPUFFER has escalated from automated database extortion to purpose-built AI model destruction, deploying a custom Go ransomware dubbed ENCFORGE to encrypt and effectively wipe high‑value AI and ML artifacts across an entire stack.

A missing‑authentication bug in the /api/v1/validate/code endpoint that enables unauthenticated arbitrary Python execution on the host.

That initial operation chained reconnaissance, credential harvesting, lateral movement and an automated database extortion playbook against MySQL and Alibaba Nacos, with clear signals of autonomy including self‑narrating payloads, rapid failure‑diagnosis cycles, and in‑session comprehension of natural‑language traps.

Following Sysdig’s first publication on July 3, 2026, JADEPUFFER returned to the same Langflow instance, this time staging ENCFORGE as lockd, a compiled, UPX‑packed Go locker engineered explicitly for AI and ML infrastructure rather than generic file encryption.

Langflow remains JADEPUFFER’s persistent entry vector, and its role is strategic: deployments commonly hold LLM API keys, cloud credentials, and connections to vector databases and object stores, making the framework a high‑value orchestration hub to pivot from.

After confirming code execution via simple identity commands, JADEPUFFER swept for cloud keys, database strings and API tokens, then probed internal services via /dev/tcp before replaying harvested credentials against downstream databases and caches.

When an attempted direct fetch of lockd from a remote C2 at 34.153.223[.]102:9191 failed, the operator adapted in‑session, iteratively constructing an escape pipeline that used Docker’s privileged socket.

Host PID discovery and procfs copy operations to transport the ransomware binary out of the container and onto the host, culminating in an autonomous deploy.py v2 script that performs try‑run scanning, full encryption and post‑run verification in one pass.

Researchers retrieved the packed ENCFORGE binary from a hidden .lockd path on the C2, revealing a UPX 5.20‑compressed Go 1.22.12 executable with no initial antivirus detections and internal project identifiers encfile.

On July 1, 2026, Sysdig’s Threat Research Team (TRT) first documented JADEPUFFER as an agentic threat actor exploiting Langflow via CVE‑2025‑3248.

The locker targets roughly 180 file extensions with deliberate coverage of AI model checkpoints, Hugging Face SafeTensors, PyTorch and TensorFlow artifacts, llama.cpp GGUF and GGML weights, FAISS vector indexes.

Training datasets in Parquet, Arrow, TFRecord, NumPy and DuckDB formats, alongside macOS‑aware developer and credential files such as .keychain, .keychain-db, .xcodeproj, .pages and .numbers.

JADEPUFFER Deploys ENCFORGE Ransomware

ENCFORGE’s –include flag allows operators to append campaign‑specific formats to the default allowlist, with the help text explicitly citing LoRA adapters and legacy GGML files as high‑value additions, underscoring that this is purpose‑built AI infrastructure ransomware rather than a repurposed generic encryptor.

ENCFORGE implements a hybrid scheme combining region‑based AES‑256‑CTR encryption with an embedded RSA‑2048 public key used as a key encapsulation mechanism, renaming processed files with a .locked extension while supporting idempotent resume and self‑deletion after completion.

The binary embeds live Windows anti‑recovery logic explicit vssadmin.exe and bcdedit.exe invocations and a process‑kill list spanning database and productivity applications indicating a single Go codebase compiled per target OS and suggesting potential cross‑platform builds beyond the analyzed Linux sample.

Sysdig’s analysis recovered a classic ransom note referencing “military‑grade encryption,” instructions to email e78393397@proton.me with a unique victim ID, strict warnings against third‑party recovery tools, and a per‑victim key model, but found no network exfiltration paths.

Tor payment portals or leak‑site infrastructure, positioning ENCFORGE as single‑extortion, destruction‑first ransomware whose leverage is the irreversible loss of AI assets.

By encrypting model weights, checkpoints, vector indices and training data resident on shared storage, a single ENCFORGE run can simultaneously destroy multiple production‑grade, fine‑tuned models.

Forcing victims to re‑run weeks or months of training at direct recovery costs estimated between $75,000 and $500,000 per model in compute and engineering time.

Even when backups exist, organizations are rolled back to the snapshot state, losing all intermediate experiments, fine‑tuning iterations, and curated data accumulated since; co‑located training data or inference artifacts must be reconstructed before any retraining can begin, amplifying downtime and operational risk in AI‑dependent environments.

The reuse of the extortion contact e78393397@proton.me, the progression from improvised Python and MySQL AES‑native encryption to a compiled Go locker, and staged yet unused homoglyph‑named CPython interpreters at the C2 all point to a developing adversary investing in reusable.

AI‑aware tooling whose core objective is no longer data theft, but the permanent destruction of AI models and training pipelines.

Indicators of compromise

File	SHA-256
lockd (packed, UPX 5.20)	8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2
lockd (unpacked, Go 1.22.12)	ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328
Staged CPython 3.14	ab9824b61587c77a8d8649545cdbdc63ed2c384e45c9aba534e3f457f96efa7a

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide