The threat actor JADEPUFFER, first identified by Sysdig as the operator of the earliest confirmed fully autonomous LLM-driven ransomware campaign, has returned with a second attack and a new purpose-built payload. On July 21, Sysdig linked a fresh intrusion against a Langflow server to JADEPUFFER, this time deploying ENCFORGE: a Go-compiled ransomware variant designed specifically to target AI and machine learning infrastructure, encrypting across approximately 180 file extensions used by model weights, vector indexes, embedding databases, and training datasets.
The development marks a tactical evolution from opportunistic infrastructure compromise toward deliberate targeting of AI-specific assets — a shift with significant implications for any organisation operating production AI systems.
The JADEPUFFER Campaign
Sysdig documented the original JADEPUFFER operation in early July 2026, classifying it as the first instance of an “Agentic Threat Actor” (ATA): an autonomous AI agent executing the complete attack chain without human direction at the operational level. Initial access was via CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow’s code validation endpoint. From that foothold, the agent pivoted to a production MySQL/Nacos server, enumerated and encrypted 1,342 service configuration items, deleted originals, and generated a ransom note — adapting in real time to failures, correcting a failed authentication attempt in 31 seconds without operator intervention.
The July 21 follow-on attack used the same Langflow entry point but deployed ENCFORGE rather than a generic encryption routine. ENCFORGE specifically prioritises file extensions associated with the modern AI/ML stack, indicating JADEPUFFER has refined its targeting to maximise leverage against AI-dependent organisations where the encrypted data has high recovery value: model weights take days or weeks to retrain, and vector database contents may not be reproducible if source documents are unavailable.
Threat Assessment
The JADEPUFFER development accelerates two trends that security teams need to address in parallel.
Autonomous attack execution is now operational, not theoretical. The original campaign demonstrated that an LLM can manage a multi-stage intrusion — initial access, lateral movement, data destruction, ransom communication — without a human operator directing each step. The agent’s real-time error correction behaviour suggests the LLM was operating with a structured task context and recovery logic rather than a linear script. This lowers the operational cost of conducting complex intrusions.
AI infrastructure is now a primary target class. ENCFORGE’s AI-specific extension targeting indicates JADEPUFFER has identified that the recovery cost for encrypted AI assets significantly exceeds that of conventional file server data. Organisations that have invested heavily in proprietary model fine-tunes, custom embedding databases, or training datasets built from proprietary sources face disproportionate leverage in a ransomware scenario.
The initial access vector — CVE-2025-3248 in Langflow — highlights the consistent pattern of AI platform vulnerabilities being weaponised rapidly after disclosure. CISA’s KEV catalog added multiple Langflow vulnerabilities in 2026, reflecting persistent active exploitation of this platform category.
Recommended Actions
Immediate:
- Audit Langflow and other exposed AI pipeline management interfaces. Remove internet exposure from Langflow instances entirely — these systems should not be reachable from the public internet. Access should be via VPN or private network only.
- Patch all Langflow instances to 1.9.0 or later. CVE-2025-3248 is patched in earlier releases; full KEV remediation requires current builds.
- Ensure CVE-2025-3248 and related Langflow CVEs (CVE-2026-0770, CVE-2026-33017, CVE-2026-55255) are remediated. All four appeared on CISA’s KEV list in 2026.
Protective measures for AI asset continuity:
- Treat model weights, vector database snapshots, and training datasets as critical business assets requiring offline or air-gapped backup. The same backup discipline applied to core databases should apply to AI artifact stores.
- Evaluate whether AI pipeline processes (model serving, embedding generation, fine-tuning jobs) run with unnecessary file system permissions. ENCFORGE’s broad extension targeting is most effective against processes with wide write/read access to AI data directories.
- Review environment variable exposure in AI service containers. LLM API keys, cloud credentials, and database connection strings accessible from compromised AI infrastructure represent a secondary threat vector beyond ransomware.
Detection:
Monitor for unexpected outbound connections from AI infrastructure hosts, unusual file renaming patterns in model storage directories, and process spawning from AI service processes. ENCFORGE’s Go-compiled binary will have a distinct execution profile from legitimate AI tooling.