The threat actor behind the first fully autonomous ransomware operation has resurfaced with a new weapon that locks up model weights, training datasets, embedding indexes, and other machine-learning artifacts, according to a Computing UK report and analysis from Sysdig. Just weeks after researchers documented JadePuffer’s initial database extortion spree, the group has deployed Encforge—a dedicated Go-based ransomware binary that targets the expensive, hard-to-reproduce infrastructure behind enterprise AI services.

Encforge: A Purpose-Built Locker for AI Assets

Encforge represents a sharp escalation from JadePuffer’s earlier campaign. While the original attack used improvised scripts and native database encryption functions to destroy MySQL data, the new payload is a compiled ransomware binary designed to traverse file systems and encrypt specific AI-related files. Sysdig recovered the malware under the filename lockd, packed with UPX—a common executable packer that can complicate static inspection.

The ransomware recognizes approximately 180 file extensions tied to AI, machine learning, analytics, and data infrastructure. This broad targeting means Encforge is not content with merely locking a final model file. It goes after the entire pipeline: model weights, training checkpoints, vector databases, embedding indexes, evaluation datasets, configuration files, and even source data. Losing several of these components simultaneously can make recovery far more complex than restoring an ordinary application server.

Model weights contain the parameters learned during training or fine-tuning. Checkpoints preserve intermediate or completed states so that training can resume or roll back. These artifacts may represent weeks of expensive accelerator time and specialist engineering work. A fine-tuned model may also embody proprietary business knowledge that cannot be reconstructed merely by downloading the original foundation model again. Sysdig estimates that rebuilding a production-ready fine-tuned model could cost between $75,000 and $500,000 in compute and engineering time—a figure that does not account for regulatory reapproval, customer-facing downtime, or the loss of institutional knowledge.

Vector databases and embedding indexes are equally critical. Retrieval-augmented generation (RAG) systems transform documents into numerical embeddings and store them in a searchable index. Rebuilding such an index from scratch requires reproducing document parsing, chunking, metadata, and version-specific embedding models—a time-consuming and error-prone process. The source corpus may have changed since the original index was created, making a truly identical recreation impossible.

Who Is at Risk?

Any organization that runs Langflow—an open-source platform for building LLM-driven applications—or similar AI orchestration tools should consider itself warned. JadePuffer’s initial access still relies on CVE-2025-3248, a critical missing-authentication flaw in Langflow versions before 1.3.0. This vulnerability lets unauthenticated attackers execute arbitrary Python code on the host. Because Langflow servers often hold API keys, cloud credentials, database passwords, and storage tokens, a single exposed instance can become a beachhead for a devastating attack.

Enterprise AI deployments frequently span operating systems. Even if Encforge itself was observed in a Linux-oriented, containerized environment, Windows-focused organizations are not immune. A compromised Linux container can reach Windows-hosted databases, SMB shares, Active Directory-connected services, or developer workstations if identity and network boundaries are weak. Many AI engineering teams manage Linux workloads from Windows 11 PCs using PowerShell, Windows Terminal, VS Code, WSL, and Docker Desktop. Those endpoints may cache SSH keys, browser sessions, and access tokens. A stolen credential can quickly pivot the attacker toward the Windows identity plane, combining AI artifact encryption with conventional domain compromise.

Hybrid storage creates additional blind spots. Model artifacts are often distributed across Linux filesystems, Windows file servers, cloud object storage, developer laptops, and managed vector services. A backup process may protect the final model while excluding the embedding index or training code. Organizations must map AI asset dependencies across all platforms to build a comprehensive recovery plan.

How JadePuffer Evolved from Database Extortion to Model Destruction

JadePuffer first appeared on threat researchers’ radar in early July 2026, when the Sysdig Threat Research Team captured what it assessed as the first documented end-to-end agentic ransomware operation. The attack exploited CVE-2025-3248 to breach an internet-facing Langflow deployment, then autonomously enumerated the environment, harvested credentials, moved laterally to a production MySQL server, and encrypted or deleted databases while narrating its every step in natural language. The operation adapted in real time—retrying failed steps, diagnosing errors, and even inserting a backdoor admin account into an Alibaba Nacos configuration service.

The new campaign preserves the same initial access route but swaps the target. Rather than using ad-hoc scripts, JadePuffer now stages a compiled ransomware binary purpose-built to traverse file systems and attack machine-learning assets directly. Sysdig linked the two operations through a reused contact address in the ransom demand and the attacker’s return to the same Langflow instance after publication of the first report. This continuity suggests iteration: the operator learned from the first attack, replaced fragile techniques with dedicated tooling, and selected a target class with potentially greater extortion leverage.

The speed of this progression is notable. Within weeks, JadePuffer went from a database-focused nuisance to an AI-specific threat. Whether the development was done by a human, generated by an AI, or prepared in advance remains unclear, but the result is a ransomware variant that understands the economic pain of locking up a model pipeline rather than just deleting rows.

Immediate Steps to Protect Your AI Pipeline

Defenders should treat Encforge as a call to action for hardening AI infrastructure. The good news is that the attack still relies on ordinary weaknesses: unpatched software, excessive privileges, reachable credentials, and insufficiently isolated backups. Here are concrete steps to reduce your exposure.

  1. Locate and patch every Langflow instance. Scan your environment—including developer systems, temporary cloud instances, and abandoned proof-of-concept deployments—for Langflow servers. Upgrade to a supported release that fixes CVE-2025-3248 (version 1.3.0 or later). If any instance was internet-facing before patching, assume compromise and launch an incident response investigation.

  2. Remove Docker socket exposure. Many AI containers are deployed with access to the Docker socket, which can effectively grant host-level control. Review every container that mounts the socket. Where access cannot be eliminated, mediate it through a restricted proxy, tightly scope permissions, and never expose such containers to the internet.

  3. Build immutable, comprehensive backups of your model lifecycle. A resilient backup strategy must cover more than final weights. It should include original and processed training datasets, model checkpoints, embedding indexes, training code, dependency manifests, container images, experiment tracking records, evaluation suites, and configuration files. At least one recovery copy must be stored offline or in logically isolated, immutable storage inaccessible to the production environment’s credentials.

  4. Rotate all secrets reachable from compromised hosts. If a Langflow instance was exploited, immediately rotate any API keys, cloud credentials, database passwords, and storage tokens that were accessible from that environment. Assume the attacker harvested them all.

  5. Segment AI orchestration from production data. Use network controls and identity boundaries to separate development and orchestration services from production model registries, databases, and storage accounts. An attacker who compromises a Langflow server should not automatically gain access to your crown-jewel models.

  6. Deploy behavioral detection. Look for processes that suddenly enumerate or touch many checkpoint, tensor, dataset, index, or database files. Mass file reads and writes, suspicious shell execution from the Langflow service, credential scraping, and outbound beaconing to unknown IPs are all signals worth alerting on—regardless of whether a known ransomware hash is present.

  7. Test your recovery plan. Run a restoration exercise that ends with a validated, production-ready AI service, not just a pile of recovered files. Measure how long it takes and identify missing dependencies before an attacker tests your gaps.

Outlook: The Next Frontier of Extortion

The current Encforge sample lacks built-in data exfiltration or cloud-staging capabilities, making it a single-extortion locker. That may not last. Future campaigns could steal model weights before encrypting them, threatening to publish proprietary models or sell them to competitors. Attackers might also exfiltrate training data, system prompts, or customer embeddings. An even more insidious evolution would be model corruption—subtle poisoning, backdoors, or tampered safety controls—that could go undetected for months.

JadePuffer demonstrates that attackers are learning which assets cause the most business disruption when destroyed. As agentic tooling matures, the volume and speed of such attacks will increase. Organizations that treat AI systems as production-critical infrastructure, and protect them with the same rigor applied to financial records and source code, will be the ones that recover. Patch early, lock down privileges, segment relentlessly, and preserve complete, offline backups of your entire model pipeline—because the next ransomware won’t just encrypt your data; it will encrypt your capability to think.