JADEPUFFER, per Sysdig's naming. No attribution to a country or known group; the link to the earlier campaign rests on the same extortion contact addresshigh
The ransomware that goes after the models: inside ENCFORGE
On 20 July 2026 Sysdig's threat research team published its analysis of ENCFORGE, an encryption payload delivered under the name «lockd» and attributed to the actor the researchers call JADEPUFFER. What makes this case different is the target list: the binary goes after roughly 180 file extensions, including those typical of trained models and vector stores. There is no exfiltration, no leak site, no double extortion: encryption only. The leverage is not the threat of publication, it is that a model tuned over months of work often cannot be restored from a code backup.
The way in is more than a year old
The starting point is nothing new: CVE-2025-3248, the Langflow flaw affecting the /api/v1/validate/code endpoint, which allows unauthenticated code execution. It has been in CISA's catalogue of actively exploited vulnerabilities since May 2025.
We have covered the family of flaws affecting Langflow before. This story is not about the flaw: it is about what passes through it today, fourteen months later, and how the trade of getting in has changed.
What exactly it encrypts
The payload analysed by Sysdig is called ENCFORGE and is delivered under the name lockd. It is a statically compiled Go binary, packed with UPX. Encryption combines AES-256-CTR with RSA-2048 key encapsulation, operates on regions of the file rather than the whole content — a choice made for speed on very large files — and renames results with the .locked extension.
The number that matters, though, is another one: per the report, «the binary targets approximately 180 file extensions». In the earlier campaign, at the start of July, the estimate was around 140. The list grew, and the direction it grew in is the news.
Among the extensions the researchers name explicitly are .ckpt, .h5, .onnx, .pb, .pkl, .pt, .pth, .safetensors, .ggml, .gguf, .faiss, .arrow, .parquet, .tfrecord, .npy, .npz, .vec, .duckdb. These are the formats of model weights, of the vector indices that power semantic search, of datasets in columnar formats. The detail that removes any doubt about intent: the binary's --include option uses '*.lora,*.ggjt' as its documented example — two formats nobody would add by accident.
Why the absence of double extortion is the point
For years the dominant model has been double extortion: steal the data, encrypt the systems, threaten to publish. The leverage lies in the shame and the regulatory fine, more than in the restore.
ENCFORGE does the opposite. Sysdig notes that the binary has «no network capability, outbound dial, net/http, cloud storage client, or staging logic of any kind». No leak site, no Tor portal, no evidence of exfiltration. It is single extortion, the model everyone considered obsolete.
It only makes sense if whoever built it reasoned carefully about what actually has value to the victim in an AI development environment. Source code is almost always in version control, so encrypting it is an annoyance. Raw data can often be re-downloaded. But a tuned model — weeks of compute, a dataset cleaned by hand, hyperparameters found by trial and error — frequently lives in one place, and that place is the disk of the machine serving it. The report is explicit: encrypted models «often cannot» be restored from backup.
The part the researchers call «agentic»
The name Sysdig uses for the actor, JADEPUFFER, refers to how the attack is conducted. In the early-July campaign the researchers watched the operation go «from a failed login to a working fix in 31 seconds»: an error, a correction, a new attempt, without the pauses that mark a human at work.
In the July campaign the behaviour repeats on a harder problem. To escape the container and reach the host, the operation produced six Python scripts in succession, «converging on a working host-escape in five minutes and 24 seconds» — from 12:07:01 to 12:12:28. The container was permissively configured (Privileged: true, PidMode: host, NetworkMode: host, with the filesystem root mounted writable), which makes escape possible; the speed at which it was found is what the researchers judge anomalous.
- May 2025The flaw enters KEV
CVE-2025-3248 is recognised as actively exploited.
- 1 July 2026First campaign
1,342 service configuration items encrypted in a database, an extortion table created at the end.
- 20 July 2026ENCFORGE
Sysdig publishes its analysis of the new payload and of the extension list.
There is a limit that must be stated, and the researchers state it themselves: automated does not mean autonomous. As other analysts have also observed, the infrastructure and initial credentials were set up by a person. What is seen automated is the middle phase — adapting to the environment found — not the whole operation.
What to do, in order of usefulness
Ask yourself where the only copy of your models lives. That is the question this case puts at the centre. If the answer is «on the volume mounted by the service that serves them», you have a single point of failure that no code backup policy covers. Weights should be treated as production data: a separate copy, on a system the workload cannot write to.
Put Langflow — and prototyping tools generally — behind authentication. CVE-2025-3248 has been in KEV for over a year and keeps being a way in, because these tools are born to sit on a laptop and end up on a reachable machine. No development interface should answer directly from the internet.
Review the privileges of the containers running AI workloads. The configuration observed — privileged, host process namespace, host network, root mounted writable — is not rare in data science environments, where it accumulates for convenience: a driver is needed, a device is needed, a path must be reachable. Every single permission had a reason. Together, they are the container escape.
On encryption, the signal is not CPU usage. Region-based encryption on large files produces a different write profile from a full rewrite. The useful monitoring is the kind that watches which files are being rewritten and by which process, not how hard the machine is working.
What we do not know
There is no attribution to a country or known group: the link between the two campaigns rests largely on the same email address used for extortion contact. Which language model was used is not stated. The number of real victims beyond the instances Sysdig observed is unknown, and the existence of a macOS build is described as unconfirmed. The estimate of $75,000-500,000 to rebuild a model is also a researcher assessment rather than a figure measured on real cases: we quote it as a stated order of magnitude, not as a measurement.
