Home › Threat Actors › JADEPUFFER
← All Threat Actors
Cybercrime critical Unknown

JADEPUFFER

Criminal threat actor (Sysdig designation — specific origin unconfirmed) · Financial — ransomware and extortion against AI infrastructure

Reports 1
Active Since 2026
Last Reported 22 Jul 2026
Sectors Targeted critical-infrastructure, finance

Tactics, Techniques & Procedures (TTPs)

  • Agentic AI-driven attack execution: autonomous LLM agent operates complete attack chain — initial access, lateral movement, data destruction, ransom communication — without human operator direction at each step
  • Initial access via CVE-2025-3248: unauthenticated RCE in Langflow code validation endpoint
  • Autonomous real-time error correction: agent independently diagnosed and corrected a failed authentication attempt in 31 seconds without operator intervention
  • ENCFORGE Go-compiled ransomware: purpose-built payload targeting AI/ML infrastructure across ~180 file extensions (model weights, vector database files, embedding stores, training datasets)
  • AI-specific targeting philosophy: targets model weights, vector index files, and training datasets where recovery cost (retraining time, irreproducible proprietary data) dramatically exceeds generic file server ransomware leverage
  • First-generation campaign: MySQL/Nacos server pivoting — enumerated 1,342 service configuration items, encrypted, deleted originals, and generated ransom note autonomously
  • Exploitation of internet-exposed AI pipeline management infrastructure (Langflow, agentic AI platforms) as entry point

Known Targets

Langflow-exposed AI development infrastructureMySQL/Nacos database servers reachable from compromised AI platformsOrganisations operating production AI systems with internet-facing pipeline toolingAI-dependent organisations where model weights and vector databases represent high recovery cost

Analyst Notes

JADEPUFFER is the first confirmed "Agentic Threat Actor" (ATA) — an operator who deploys a fully autonomous AI agent to execute a complete multi-stage intrusion without human direction at the operational level. Documented first by Sysdig in July 2026. The original campaign (early July 2026) used an LLM agent that demonstrated real-time adaptive reasoning: when an authentication attempt failed during lateral movement, the agent diagnosed the error and corrected its approach within 31 seconds. The July 21, 2026 follow-on attack deployed ENCFORGE — a purpose-built ransomware payload designed specifically for AI infrastructure, targeting ~180 file extensions associated with model weights, vector databases, and training datasets. This shift from opportunistic infrastructure compromise to deliberate AI asset targeting reflects an evolving threat model: AI artefacts (model weights, proprietary training data, vector embeddings) may be irreproducible and represent months of compute investment, giving ransomware operators substantially higher leverage than equivalent file server encryption. CVE-2025-3248 (Langflow RCE) remains the confirmed initial access vector.

Also Known As

JADEPUFFER (Sysdig designation)

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application (CVE-2025-3248 Langflow RCE) T1486 Data Encrypted for Impact (ENCFORGE AI-targeted ransomware) T1485 Data Destruction (original file deletion post-encryption) T1059 Command and Scripting Interpreter (autonomous agent execution) T1657 Financial Theft / Extortion

Intelligence Reports

Briefing critical-infrastructurefinance

JADEPUFFER Returns: Agentic Ransomware Deploys ENCFORGE Against AI Infrastructure

The threat actor behind the first confirmed LLM-driven ransomware campaign has returned with ENCFORGE, a Go-compiled payload built specifically to encrypt AI model weights, vector databases, and training datasets.

22 Jul 2026 · 4 min read