An updated ransomware campaign is targeting an important but often overlooked asset in artificial intelligence environments: trained AI models and their supporting data. Researchers have discovered a ransomware strain that encrypts AI model weights, vector indexes, and training data, but no ransom payment mechanism appears to have been established.
The Threat Research Team at Sysdig attributed the activity to the threat actor JADEPUFFER, who previously compromised the same internet-facing Langflow server. This attack exploited the critical vulnerability CVE-2025-3248 that allows remote Python code execution due to a critical missing authentication vulnerability in Langflow's code-validation endpoint.
Although Langflow fixed the vulnerability in version 1.3.0, the targeted server remained vulnerable even after it was publicly reported.
An ENCFORGE binary was deployed in the second campaign that searched for 180 different file extensions using a compiled Go-based ransomware binary. As opposed to conventional ransomware that may incidentally encrypt model files, ENCFORGE identifies AI-related assets specifically, including PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors weights, GGUF files for large language models within the local region, FAISS vector indexes, as well as training data stored in Parquet and NumPy formats.
During the second campaign, ENCFORGE was deployed, a Go binary powered by UPX that searches for 180 file extensions across a wide range of machine-learning applications.
In contrast to conventional ransomware, which may encrypt model files incidentally, ENCFORGE is specifically designed to identify AI-related assets, such as PyTorch and TensorFlow checkpoints, Hugging Face SafeTensor weights, GGUF files associated with local large language models, FAISS vector indexes, Apache Parquet and TFRecord training datasets, and NumPy arrays, among others.
A command-line interface for adding custom file extensions has been provided by attackers, along with examples of LoRA fine-tuning adapters and legacy GGML weights, further demonstrating that the malware was specifically designed for artificial intelligence environments. According to researchers, the ransomware encrypts portions of files with AES-256-CTR encryption keys protected by embedded RSA-2048 keys, although there appears to be no network functionality to facilitate data theft or ransom collections.
ENCFORGE was not identified by Sysdig as a leak site, outbound communication, or payment portal. Instead of a Proton Mail address in the ransom note, a Proton Mail address was included, suggesting that the operation was primarily oriented toward rendering the victim's AI assets useless, rather than stealing them to conduct double extortion. ENCFORGE differs from double-extortion ransomware by lacking an exfiltration mechanism.
A leak site and functional capability for stealing and publishing victim data were not discovered by researchers. Instead, the primary objective of the campaign is to destroy AI assets by rendering model files and related data unusable. JadePuffer's earlier campaign also included a contact address that corresponded to the malware, indicating that this campaign is related to JadePuffer.
Due to the fundamental difference between restoring a trained AI model and restoring a conventional database, the potential impact is significant. Sysdig estimates that it could cost between $75,000 and $500,000 to rebuild a production-ready fine-tuned model directly, depending on GPU resources and engineering efforts. If training data is compromised, recovery becomes even more challenging.
Model artifacts and associated training data are particularly difficult to recover when the system hosting them contains both. In this case, restoring the model may not be possible until the dataset has been recovered and the necessary training processes have been repeated. Because organizations often maintain multiple model variants on shared storage, one encryption event can have a significant impact on several production or development assets concurrently.
It is also evidenced in the campaign that attackers are increasingly adapting their attacks around artificial intelligence infrastructure. The attacker generated multiple Python scripts using the compromised Langflow environment, as the ransomware could not initially be downloaded from the command-and-control server. During the first five minutes, the scripts were able to develop a method for exiting the container environment through the exposed Docker socket and executing the ransomware on the host machine.
Rapid escalation is a result of broader trends in ransomware operations in which attackers are increasing the speed at which they can gain access and deploy ransomware. As a result of the JadePuffer incident, the delivery mechanism was rebuilt within minutes after the original download failed, leaving little time to detect and contain the intrusion before it began encryption. Six Python scripts progressively refined the escape procedure during the escape process.
By launching a privileged container over the mounted Docker socket, the ransomware was moved across the container boundary through the host's proc file system and executed against the host file system outside the original container's isolation using the mounted Docker socket. Following encrypting the targeted files, ENCFORGE terminated processes holding file locks and deleted itself once the encryption was complete. The incident highlighted an increasing security vulnerability in the AI asset ecosystem.
The backups should be separated from the systems that host production models to ensure that a compromise of the artificial intelligence environment does not also compromise the recovery copies. Organizations should ensure model checkpoints, vector indexes, and training data are backed up in immutable, tested versions, remove unnecessary Docker sockets, rotate credentials that are accessible from compromised systems, and monitor for mass encryption of AI-specific files.
In response to the increasing value of artificial intelligence models in businesses, ransomware operators have begun targeting the files containing the accumulated work behind the systems. As a result of the ENCFORGE campaign, AI infrastructure must now be protected as critical assets rather than as ordinary files, by treating model weights and associated datasets accordingly.
Among other things, ENCFORGE emphasizes the importance of treating artificial intelligence model weights, training data, and related artifacts as critical digital assets for organizations. In order to limit the impact of future attacks, it will be necessary to protect these assets with isolated backups, enhanced access controls, and timely vulnerability remediation. As attackers increasingly tailor ransomware to emerging technologies, it is imperative to protect these assets.
