Agentic ransomware has arrived in production. Sysdig Threat Research published analysis this week of a threat actor tracked as JadePuffer, deploying a custom tool called EncForge to target AI infrastructure at scale. Ransom demands range from $75,000 to $500,000 per victim.
What JadePuffer targets
EncForge differs from traditional ransomware by targeting AI-specific artifacts rather than encrypting broadly. The tool searches for trained model checkpoint files, raw training datasets, vector database contents, and embedding stores. This selectivity reflects an understanding that these assets are expensive to recreate and frequently backed up with less discipline than traditional data.
The attack chain
Initial access begins with CVE-2025-3248, an authentication bypass in Langflow, an open-source tool for building LLM-based workflows. After exploiting the bypass, JadePuffer enumerates connected storage, identifies AI artifacts by file extension and directory path patterns, and deploys EncForge for encryption.
The attack often requires no lateral movement because Langflow instances in enterprise AI environments frequently run with elevated permissions adjacent to model storage. The credential footprint is small and dwell time before encryption is short.
Why recovery takes weeks, not days
Traditional ransomware recovery follows a known playbook: restore from backup, test, return to service. AI model recovery is different. A foundation model checkpoint may represent months of GPU compute. If backups exist but have never been tested for restore fidelity, incident response is the first real restore test. Retraining from scratch requires the original ETL pipeline, data contracts with external providers, and GPU capacity that cannot be provisioned on demand.
JadePuffer's operators appear to understand this. Demands of $500,000 are calibrated against realistic re-training costs, not file-recovery costs.
What to do now
- Patch Langflow for CVE-2025-3248 immediately. If you cannot patch in the next 24 hours, disable external access to the Langflow API until the patch is applied.
- Review Langflow logs for unexpected API calls to workflow execution endpoints from unfamiliar source IPs. Dwell time before encryption is short, so recent logs matter most.
- Verify that model checkpoints, training datasets, and vector database backups are included in your backup regime and that restores have been tested end to end.
- Restrict Langflow process permissions. It should not have write access to model storage directories.
Written by Gigia Tsiklauri, Security Architect and AI Security specialist at Infosec.ge.