The First AI-Native Ransomware Is Here. It Doesn't Lock Your Files — It Encrypts the Models Themselves, and We've Been Blocking Its C2 Since Friday.
- Patrick Duggan
- 42 minutes ago
- 5 min read
Ransomware has always gone after the same two things: your files and your uptime. Lock the documents, halt the servers, wait for the wire transfer. A new strain called ENCFORGE goes after something a company can't rebuild from a backup drive and can't buy back at any price — the trained AI models themselves. And the group behind it is one we've been tracking since it first appeared: JADEPUFFER, the first genuinely agentic threat actor.
Sysdig documented the evolution this week. We had already harvested this campaign's infrastructure on Friday, three days before this writeup, and it's been in our blocklist since. More on that below — first, why this one is different in kind, not degree.
Ransomware that targets the model, not the machine
ENCFORGE is a compiled Go binary, UPX-packed, deployed to the victim as a file called lockd. What makes it novel is its target list. It doesn't sweep for the usual office documents. It hunts roughly 180 file extensions belonging almost entirely to the modern AI and machine-learning stack: PyTorch and TensorFlow checkpoints, HuggingFace SafeTensors weights, llama.cpp GGUF quantized models, ONNX graphs, FAISS vector indices, Parquet and TFRecord training datasets, raw NumPy arrays, pickled objects. It encrypts them with AES-256-CTR under an RSA-2048 key, appends .locked, kills any process holding a file open so nothing escapes the sweep, and deletes itself when it's done.
Think about what that inventory actually is. A fine-tuned model checkpoint is the crystallized output of a training run that may have cost six or seven figures in compute and weeks of wall-clock time. A vector database is the searchable memory of every document a company fed its retrieval system. A curated training set is often the single most expensive and least reproducible asset an AI team owns. Encrypt those and you have not inconvenienced an operation — you have deleted the work, because unlike a file server, there is frequently no clean backup of a half-trained model or a live embedding index. The transom note writes itself: the compute to make these again is the ransom, whether or not you ever pay the attacker.
And notably, ENCFORGE is single-extortion — encryption only, no data theft observed. That is a deliberate design choice that tells you who the target is. Against a hospital you steal and threaten to leak. Against an AI lab you don't need to leak anything; the models being gone is the entire leverage.
The door is the one we already wrote about
The entry point is not new, and that is the uncomfortable part. JADEPUFFER gets in through CVE-2025-3248, a missing-authentication flaw in Langflow's /api/v1/validate/code endpoint that lets an unauthenticated attacker run Python on the host. It has been in CISA's Known Exploited Vulnerabilities catalog since May 2025. It is the same Langflow door we wrote about when we covered this actor getting into an AI agent builder in twenty hours, and it remains JADEPUFFER's persistent way in across every campaign it has run.
What's genuinely striking is the deployment. Over five minutes and twenty-four seconds, the actor iterated six Python scripts through the Langflow RCE channel, converging on a working pipeline: it used a mounted Docker socket to spawn a privileged escape container, copied the locker across the namespace boundary through the host's procfs, and ran the encryption pass on the host filesystem, outside the isolation of the container it started in. That is a container escape and a full host compromise, assembled on the fly. This is what "agentic threat actor" means in practice — not a human typing exploits, but an automated system iterating toward a goal in real time, and getting there in under six minutes.
What we did, and when
Here is the receipt, and it is a clean one. When JADEPUFFER's earlier database-extortion campaign was documented, we harvested its command-and-control infrastructure into our feed. The attack-source address, 45.131.66[.]106, went into our indicator index on July 18 at confidence 88 — which means it has been flowing into our public blocklist and our customers' edge shields since Friday. When this week's ENCFORGE writeup landed, its infrastructure lined up with what we already had, and we've now added the campaign's second-stage pieces: the GCP-hosted delivery C2 at 34.153.223[.]102 on port 9191, the .lockd binary URL it serves, and the SHA-256 hashes of the packed and unpacked ENCFORGE binary. All of it is in the feed now, verified landed, free to pull.
That is the whole point of running a feed instead of just a blog. The narrative is the shop window; the indicators are the product. A defender who reads this post and wants protection doesn't have to copy anything by hand — the addresses and hashes are already in ips.csv and hashes.csv, confidence-gated and enforceable at the edge tonight.
What to actually do
If you run Langflow anywhere near your model infrastructure, patch CVE-2025-3248 immediately and get the instance off any network an unauthenticated request can reach — this is a KEV-listed bug over a year old and it is still this actor's front door. Do not mount the Docker socket into containers that don't absolutely require it; that socket is what turned an app-level RCE into a full host takeover here, and it is the single most abused misconfiguration in container escapes.
Then think about the asset this strain exists to destroy. Your model checkpoints, your vector stores, and your training datasets need the same backup discipline you already apply to databases — versioned, off-host, and tested for restore — because the whole premise of ENCFORGE is that most AI teams have not done that yet. And block the indicators: 45.131.66[.]106, 34.153.223[.]102, and the ENCFORGE binary hashes are all in our feed, which is free.
We hold this at 95 percent as always — the malware analysis, the deployment reconstruction, and the attribution are Sysdig's research, corroborated by the trade press, not our own capture. What is ours is the coverage record and the receipt: we have tracked JADEPUFFER as the first agentic threat actor since it emerged, we wrote about this exact Langflow door before this ransomware existed, and we were blocking this campaign's C2 three days before the writeup that named it. The frontier where attacks are run by machines and aimed at models is the one we said to watch. It just shipped its first purpose-built ransomware.
Sources: Sysdig, "JADEPUFFER evolves: the agentic threat actor deploys ransomware built to destroy AI models" (July 2026), via Sysdig, BleepingComputer, and Infosecurity Magazine. CVE-2025-3248 is in our CISA KEV mirror. Campaign indicators (45.131.66[.]106 since 2026-07-18; 34.153.223[.]102, the .lockd URL, and ENCFORGE SHA-256 hashes added 2026-07-21) are live in our feed at analytics.dugganusa.com/api/v1/stix-feed.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.