Sysdig: JADEPUFFER now ships EncForge, targets model weights
Sysdig's Threat Research Team says the agentic operator it named JADEPUFFER has upgraded from generic database encryption to a custom Go ransomware, EncForge, that specifically targets AI model checkpoints, vector databases, and training data.
airgap Confirmed reporting by Sysdig via BleepingComputer, 2026-07-20. Sysdig’s Threat Research Team says the agentic operator it named JADEPUFFER — first documented on July 2 as the vendor’s earliest end-to-end LLM-run ransomware chain — has swapped out its generic destruction step for a purpose-built Go ransomware called EncForge. Sysdig says EncForge is written to encrypt AI/ML assets: model checkpoints, vector databases, training sets, LoRA adapters. Not the file server. The models.
What Sysdig reported
- New payload. EncForge is a Go binary, UPX-packed, dropped as
lockd. AES-256 in counter mode, RSA-2048 for key wrapping, partial-file encryption for speed. Confidence: high as Sysdig describes it. - Extension list is the tell. Sysdig puts the target list at roughly 180 extensions, but the ones that matter are the AI-native ones: PyTorch and TensorFlow checkpoints, GGUF/GGML weight files, Hugging Face
.safetensors, FAISS index files, Parquet, Arrow, TFRecord, NumPy.npy/.npz, DuckDB stores, and LoRA adapter directories..lockedgets appended. - Initial access unchanged. Same entry as the July 2 chain: a previously breached Langflow instance. Sysdig re-references the Langflow code-execution flaw (CVE-2025-3248, fixed in Langflow 1.3.0) as the front door.
- Economics. Sysdig, via BleepingComputer, estimates $75,000 to $500,000 per encrypted model in retraining cost — the number the extortion negotiation is presumably calibrated against. Ransom demand or payment: not disclosed.
- Victim. Not named. Sysdig describes the case as a previously compromised Langflow deployment, i.e. an environment that never got cleaned up after the July disclosure. Unconfirmed identity — treat accordingly.
Why the payload change matters
The original JADEPUFFER writeup was novel because of the operator, not the crypto. A file-server-encrypting Go binary is not interesting on its own — 200 crews ship one. EncForge is interesting because the target list narrows the blast radius to exactly the assets a machine-learning shop cannot easily rebuild from backup.
Model checkpoints are large, expensive, and often stored outside the tiered-backup rotation that covers a regular file server. Vector databases are frequently rebuilt from source corpora on a cadence that doesn’t match production continuity. Training runs that already burned six-figure GPU budgets don’t get re-executed on a Tuesday morning because someone wiped s3://prod-checkpoints/. Sysdig’s $75k-to-$500k range is a defensible floor; the ceiling is higher for anyone running frontier-scale training.
Analysis — labeled: the specialization implies the operator is reading the market. A generic ransomware crew that hit an ML shop in 2024 encrypted the shared drive by accident. EncForge encrypts the shared drive on purpose, and the shared drive it’s after is the one nobody has a same-day restore for. That’s a pricing decision, not just a targeting one.
What actually changes for defenders
Same fundamentals as the July advisory, but the target list forces a specific inventory question.
- Langflow still. If your Langflow is public-facing and not on 1.3.0 or later, treat it as compromised — Sysdig has now published two JADEPUFFER-linked incidents against unpatched Langflow. Not “watch for exploitation.” Presume it happened.
- Know where your checkpoints live. Not “we back up S3.” Specifically: which buckets hold model weights, who can write to them, what identity is doing the writing, and what a restore actually looks like. If the answer to any of those is fuzzy, EncForge’s economics are aimed at you.
- Same for the vector store. FAISS indexes, Milvus, Pinecone-mirrored data, DuckDB feature stores — inventory the ones that would take a week to rebuild and treat them as production data with a production RPO, not scratch.
- Watch for
.lockedon ML paths. Trivial detection, but the extension is public now. A file-audit rule that alerts on any.safetensors,.gguf,.ckpt, or.ptfile being replaced by a.lockedsibling is a five-minute build. - Follow the July advice. Restrict the Docker socket on any Langflow host, run containers as non-root, tighten filesystem permissions on model directories. Sysdig’s current writeup restates that guidance because it wasn’t followed the first time.
What we still don’t know
- Which LLM the agent runs on. Same gap as July. Public inference API or self-hosted: not stated.
- Whether JADEPUFFER is one operator or a shared toolset. The consistent naming across two Sysdig writeups suggests one operator, but Sysdig has not attributed to a known crew, nation, or affiliate program. Unconfirmed.
- Whether EncForge is exclusive. If the binary shows up in an incident that does not involve Langflow initial access or an agentic operator, the “agent-only” framing gets weaker fast. Watch for it.
- Payment. No public ransom demand, no public payment, no public negotiation transcript in either writeup so far.
Sourcing
- BleepingComputer: JadePuffer agentic attacks now target AI model data with ransomware — 2026-07-20
- Prior 0dayNews coverage: Sysdig: JADEPUFFER ran a full ransomware chain from one LLM — 2026-07-03
- NVD entry for Langflow initial-access flaw: CVE-2025-3248
- Related: Hugging Face autonomous-AI-agent breach, Anubis ransomware / Citrix Bleed 2
Found this useful? Share it.
