Ransomware Targets AI Models: What Happened and What Remains Unclear

A new ransomware program is targeting something many businesses may not yet be protecting properly: their artificial intelligence models.

Known as ENCFORGE ransomware, the malware searches for model weights, training datasets, vector indexes, checkpoints and other files used to build or operate AI systems. Security researchers have linked it to JadePuffer, an operator previously observed using an AI-driven agent to adjust attack methods when its first attempts failed.

The attack started through a known vulnerability in Langflow, an open-source platform for building AI workflows. The attacker then accessed an exposed Docker socket, moved outside the original container and attempted to encrypt AI-related files stored on the underlying host.

This incident matters as companies increasingly connect AI tools for business automation with cloud services, databases, internal APIs and valuable company information. A compromised AI workflow can therefore become an entry point into much more sensitive infrastructure.

Here is what happened, how ENCFORGE works and what organisations should do next.

What Is ENCFORGE Ransomware?

ENCFORGE is a file-encryption program written in the Go programming language. According to Sysdig’s threat research, it was created specifically to attack artificial intelligence and machine-learning infrastructure.

Traditional ransomware often searches for office documents, business databases, images and financial records. ENCFORGE focuses on files associated with:

• AI model weights
• Model checkpoints
• Training datasets
• Fine-tuning adapters
• Vector indexes
• Embedding files
• Local large language models
• Machine-learning databases
• Data-processing formats

The analysed version uses AES-256-CTR to encrypt file contents. It then protects the encryption key with an embedded RSA-2048 public key.

This makes ENCFORGE more structured than the improvised encryption method used in JadePuffer’s earlier operation. Sysdig also found approximately 180 targeted file extensions in the unpacked binary.

Who Is JadePuffer?

JadePuffer is the name Sysdig assigned to the operator behind the activity.

Researchers believe an AI-driven agent helped analyse the compromised environment, generate scripts and revise commands when they failed. The available evidence points to fast, adaptive behaviour, but it does not show exactly how much human supervision was involved.

For this reason, JadePuffer should not automatically be described as a completely autonomous cybercriminal group.

The incident is better understood as an example of agentic or AI-assisted attacking. Similar agentic systems are also being introduced into legitimate enterprise platforms such as UiPath AI, where agents carry out multi-step business processes. The difference is that JadePuffer appears to have applied adaptive automation to malicious activity.

Sysdig first documented JadePuffer in a database-extortion campaign published on 1 July 2026.

What Happened in the Latest JadePuffer Attack?

The ENCFORGE attack began with an internet-facing Langflow server.

Langflow allows developers to build AI agents and workflows through a visual interface. These systems may connect with model providers, databases, vector stores, API credentials and locally stored AI files.

That makes an exposed or poorly protected Langflow deployment a valuable target.

Initial Access Through CVE-2025-3248

The attacker exploited CVE-2025-3248, a critical vulnerability affecting Langflow versions earlier than 1.3.0.

The flaw allowed an unauthenticated attacker to execute Python code through a vulnerable validation endpoint. It received a CVSS score of 9.8, which places it in the critical severity range.

In simple terms, an attacker could run code on a vulnerable server without first signing in.

Version 1.3.0 fixed this particular vulnerability. However, organisations should install a currently supported Langflow release and review newer security advisories rather than treating version 1.3.0 as a permanent security baseline.

The Attacker Explored the Environment

After entering the Langflow server, JadePuffer reportedly searched for:

• Credentials
• Internal databases
• Docker configuration
• Mounted storage
• Model directories
• Network services
• Ways to access the host

The attacker eventually found access to /var/run/docker.sock, commonly called the Docker socket.

Why the Docker Socket Mattered

The Docker socket allows authorised processes to communicate with the Docker service.

When unrestricted Docker socket access is available inside an application container, a compromised process may be able to create new containers with powerful permissions.

JadePuffer used this access to create a privileged container and mount the host filesystem. The attacker could then move beyond the original Langflow environment and interact with files stored on the underlying machine.

The Docker socket itself was not compromised through a new vulnerability. The problem was that too much control had been given to a container exposed to an internet-facing application.

Six Scripts in Just Over Five Minutes

The operator’s first attempt to deliver the ransomware did not work.

Instead of stopping, JadePuffer repeatedly revised its Python scripts. Sysdig documented six versions created over approximately five minutes and 24 seconds.

The scripts changed how ENCFORGE was downloaded, copied and executed.

The successful attack path reportedly involved:

1. Exploiting the Langflow vulnerability.
2. Accessing the Docker socket.
3. Creating a privileged container.
4. Mounting the host filesystem.
5. Copying ENCFORGE to the host.
6. Running it against the target directories.
7. Attempting to count files carrying the .locked extension.

Researchers observed a real encryption attempt. However, they did not publish the final number of files successfully encrypted.

The evidence therefore confirms an active attack, but not the total damage caused.

The Two JadePuffer Campaigns Are Not the Same

Some coverage has suggested that the attacker could not collect a ransom or restore encrypted files.

That conclusion mainly applies to JadePuffer’s earlier database campaign, not automatically to ENCFORGE.

In the earlier attack, the operator generated an encryption key that appeared briefly but was not stored or transmitted. The attacker therefore had no usable copy of the key required to restore the affected data.

Paying the ransom would not have solved the problem.

ENCFORGE uses a different system. It generates an encryption key and protects it with an embedded RSA public key. In theory, the corresponding private key could be used to recover the encryption key and decrypt the files.

However, no public evidence confirms that:

• The attacker possesses the correct private key.
• A victim contacted the ransom email.
• A ransom payment was made.
• The attacker restored a test file.
• Any organisation recovered data after paying.

It is therefore too strong to claim that ENCFORGE cannot collect a ransom. The accurate conclusion is that its payment and recovery process remains unverified.

Which AI Files Does ENCFORGE Target?

Researchers found approximately 180 extensions covering several important areas of AI infrastructure.

Model Weights and Checkpoints

Model weights contain the numerical parameters an AI system learns during training. They are often the most valuable part of a trained model.

ENCFORGE targets formats associated with PyTorch, TensorFlow, ONNX, SafeTensors and model checkpoints.

Losing recent weights could force a company to restore an older model or repeat expensive training and fine-tuning work.

Local Language Model Formats

The malware also targets GGUF and GGML files, which are commonly used to run language models on local hardware.

These files can contain large base models or customised models prepared for a specific business application.

Vector Indexes and Retrieval Systems

Vector indexes allow AI systems to find related information based on meaning.

They are widely used in retrieval-augmented generation, recommendation engines and semantic search. A damaged index may be rebuilt, but the organisation may need the original source data, the same embedding model and matching configuration.

Training and Analytics Data

The target list also contains Apache Parquet, Apache Arrow, TFRecord, NumPy and DuckDB formats.

These files may hold prepared datasets, analytics results or intermediate information needed to reproduce a model. Organisations using AI data analysis tools should therefore protect not only final models but also the datasets and processing outputs behind them.

Fine-Tuning Adapters

Methods such as LoRA allow teams to customise a larger model without retraining every parameter.

The resulting adapter files may be smaller than complete models, but they can still contain months of specialised work. That makes them attractive ransomware targets.

Is ENCFORGE Ransomware or a Destructive Wiper?

ENCFORGE has clear ransomware features.

It encrypts files, adds a .locked extension, creates ransom notes and provides an email address for payment instructions.

However, researchers did not find:

• A Tor payment portal
• A public leak website
• Built-in data-exfiltration functions
• A data-staging system
• Confirmed double extortion

Many modern ransomware groups steal information before encryption and threaten to publish it. ENCFORGE appears more focused on making valuable AI files unavailable.

That does not automatically make it a wiper.

A wiper is normally created to destroy information without providing a realistic recovery route. Because ENCFORGE includes key wrapping and ransom instructions, ransomware remains the more suitable classification.

The most accurate description is destructive AI-focused ransomware with an unverified recovery process.

The absence of a Tor portal does not prove that the attacker cannot collect money. ENCFORGE directs victims to communicate through email.

Can Victims Recover ENCFORGE-Encrypted Files?

No public ENCFORGE decryptor has been released.

Its encryption design suggests that recovery could be possible with the correct RSA private key. However, researchers have not confirmed whether JadePuffer possesses that key or can restore encrypted files successfully.

Victims should never assume that payment will lead to recovery.

Why Backups May Not Solve Everything

A company may have a backup of its base model but still lose recent development work.

An older snapshot may not include:

• Recent fine-tuning
• Updated safety controls
• New training examples
• Current evaluation results
• LoRA adapters
• The latest vector index
• Production configurations
• Model-registry records

A complete AI recovery plan should therefore protect the model, training data, checkpoints, indexes, tokenisers, configurations, container images and dependencies.

The organisation must also test whether these parts can be restored together as a working AI service.

How Much Could an AI Model Attack Cost?

Sysdig estimated that rebuilding a production AI model could require between $75,000 and $500,000 in engineering and computing resources. This should be treated as a vendor estimate rather than a fixed cost for every organisation.

The actual impact depends on:

• Model size
• GPU requirements
• Training time
• Engineering labour
• Data preparation
• Evaluation requirements
• Regulatory checks
• Business downtime
• Delayed releases

A bank might need to return to an older fraud model. A retailer could lose a recommendation system before a major sales campaign. A regulated company may also need to repeat testing and approval work.

Who Is Most at Risk?

Higher-risk environments include:

• Internet-facing Langflow deployments
• Unpatched Langflow versions
• Containers with Docker socket access
• Models stored on writable application volumes
• Credentials stored inside AI workflows
• Public tools connected directly to model repositories
• Online backups that attackers can modify
• Teams without tested model recovery

As businesses adopt more connected and autonomous systems from lists of the best AI tools available in 2026, security teams must understand what each platform can access and modify.

What Organisations Should Do Now

1. Update Langflow

Install a currently supported Langflow version and review all relevant advisories.

2. Investigate Earlier Exposure

Search historical logs for suspicious endpoint requests, Python execution, Docker activity, privileged containers and unfamiliar binaries.

3. Rotate Credentials

Replace API keys, cloud tokens, database passwords, service-account secrets and repository credentials exposed to the environment.

4. Restrict Docker Access

Remove unnecessary Docker socket mounts. Where access is essential, use narrow permissions, monitoring and stronger isolation.

5. Separate Model Assets

Do not allow a public-facing workflow platform to rewrite an entire model repository.

6. Create Immutable Backups

Keep offline or immutable copies of models, datasets, indexes and configurations.

7. Test Complete Restoration

Test whether the organisation can restore a working AI service, not simply an individual weight file.

8. Monitor Attack Behaviour

Watch for privileged container creation, unusual Docker API calls, nsenter use and mass creation of .locked files.

What Is Confirmed and What Remains Unknown?

Researchers confirmed a functioning binary, deliberate AI targeting, Langflow exploitation, Docker-based host access and a live encryption attempt.

However, public reporting has not confirmed:

• The number of affected organisations
• The number of encrypted files
• A successful ransom payment
• Successful decryption
• Active Windows or macOS campaigns
• The level of human supervision
• Broader attacks against other AI platforms

The story is significant, but it should not be presented as a global outbreak without supporting evidence.

What ENCFORGE Means for the AI Industry

AI development systems are becoming part of critical business infrastructure.

Platforms may connect to cloud accounts, models, databases, customer information and source-code systems. Enterprise platforms such as ServiceNow AI also show how AI agents can coordinate work across many business systems, making access controls and governance increasingly important.

Security teams should protect MLOps platforms with controls similar to those used for production databases and software-delivery pipelines.

The attack also shows that automated operators can revise failed techniques quickly. Defenders cannot assume that a failed command will create a long pause.

Conclusion

ENCFORGE ransomware is one of the clearest documented attempts to build encryption malware specifically around AI and machine-learning assets.

The attacker exploited Langflow, used Docker access to reach the host and adapted its deployment scripts within minutes. The malware then searched for model weights, checkpoints, vector indexes and training files.

However, only one ENCFORGE session has been publicly described. No successful ransom payment or decryption has been confirmed.

Organisations should update exposed platforms, restrict container privileges and test whether their complete AI environment can be restored from protected backups.

Follow Aitoza’s latest AI news and technology updates for further developments involving AI security, autonomous agents and enterprise infrastructure.

Frequently Asked Questions

What is ENCFORGE ransomware?

ENCFORGE is a Go-based ransomware program designed to target AI model weights, training data, checkpoints and vector indexes.

How did ENCFORGE enter the system?

The attacker exploited CVE-2025-3248 in an internet-facing Langflow deployment and used Docker socket access to reach the host.

Which Langflow versions are vulnerable?

Versions earlier than 1.3.0 are affected by CVE-2025-3248. Organisations should install a currently supported release.

Can ENCFORGE files be decrypted?

No public decryptor or successful recovery test has been reported. Recovery may be technically possible with the correct private key, but this remains unverified.

Does ENCFORGE steal information?

Researchers found no built-in exfiltration feature in the analysed binary. Separate tools or future variants could still add data theft.

Is ENCFORGE ransomware or a wiper?

It is best described as destructive ransomware because it encrypts files and demands payment, although its recovery process has not been proven.

What files does ENCFORGE target?

It targets approximately 180 extensions associated with AI models, checkpoints, datasets, vector indexes and machine-learning databases.

How can companies protect their AI models?

Companies should isolate model storage, limit Docker access, rotate exposed credentials, maintain immutable backups and test complete AI-service restoration.