ENCFORGE, a newly observed Go-based ransomware family, is engineered to encrypt AI and machine-learning infrastructure files, placing model-centric environments directly in the crosshairs of extortion campaigns. The ransomware has been linked to the agentic threat actor known as JADEPUFFER, which previously abused Langflow environments for database-wiping attacks and now returns to the same infrastructure with model-focused tooling. Naming derives from code labels such as “encfile” for encryption logic and “keyforge” for key generation embedded in the binary, underscoring a deliberate emphasis on cryptographic control over high-value AI assets.
ENCFORGE departs from generic lockers by concentrating on AI model weights, vector indexes, training datasets, and surrounding machine-learning stack files. Its file-extension list spans roughly 180 AI-related formats, including Hugging Face SafeTensors checkpoints, PyTorch and TensorFlow models, GGUF and GGML weights, and FAISS vector indices commonly used in retrieval-augmented generation systems. By locking these specialized assets, ENCFORGE can drive recovery expenses into the $75,000 and $500,000 range for organizations forced to rebuild compromised AI deployments. This targeting reflects an alarming trend where over-scoped permissions can lead to significant security vulnerabilities.
Purpose-built to lock AI model weights, vector indexes, and curated training datasets across nearly 180 ML file formats
Training data stored in Parquet, Arrow, TFRecord, NumPy, and DuckDB formats is explicitly targeted, recognizing that curated datasets often represent the most irreplaceable component of AI deployments. Once processed, affected artifacts are renamed with a “.locked” extension, signaling completed encryption and helping operators track the scope of damage for ransom negotiations.
The campaigns rely on a critical Langflow vulnerability, CVE-2025-3248, a missing-authentication flaw that allows unauthenticated remote attackers to execute arbitrary Python code on exposed workflow servers. Rated 9.8 on the CVSS scale and added to the CISA Known Exploited Vulnerabilities catalog, the bug provides JADEPUFFER’s autonomous agents with direct control over AI orchestration infrastructure without requiring prior credentials.
Observations indicate that ENCFORGE is often deployed on Langflow instances already breached in earlier operations, suggesting that persistent access and tooling reuse are core to the actor’s strategy. Recommended mitigation is to upgrade Langflow to at least version 1.3.0 or current 1.9.x releases, closing the vulnerable endpoint and reducing the risk of further automated exploitation.
JADEPUFFER is characterized as an AI-agent-driven ransomware operator, using autonomous LLM-based agents to handle intrusion, credential theft, lateral movement, and encryption end-to-end. Earlier Langflow incidents saw agents harvest credentials and destroy database configuration data; ENCFORGE represents a shift toward reusable, compiled ransomware focused on AI ecosystems, including model registries and experiment infrastructure.
Infrastructure reuse, such as the extortion contact address e78393397@proton.me and consistent tooling across incidents, strengthens attribution of ENCFORGE to the same operator. Technically, the malware employs AES-256 in counter mode for file encryption and wraps the per-run symmetric key under an embedded RSA-2048 public key, forming a hybrid scheme that blocks straightforward decryption without the attacker-held private key.
