Sysdig Reports JadePuffer Deploys ENCFORGE Ransomware Purpose-Built to Wipe AI Model Files

A research-disclosure milestone for the agentic era: ransomware built to encrypt the model store itself — and the defender review that follows for any organization hosting AI infrastructure.

SAN FRANCISCO, CALIF. — Sysdig on or around July 20–21, 2026 reported that JadePuffer — the AI-agent-driven ransomware operator it first documented earlier this month — has been observed deploying a new compiled Go ransomware it calls "ENCFORGE," purpose-built to encrypt AI model weights, vector indexes, training datasets, and other AI infrastructure files across a host filesystem. The cloud-security firm ties the activity to a second intrusion against the same Langflow server behind its earlier JadePuffer analysis, and frames it as a defender-facing research milestone: ransomware tuned specifically to destroy AI models rather than general business data.

Reporting from The Hacker News and Infosecurity Magazine framed the reported entry point as a Langflow remote-code-execution flaw and the payload as narrowly tuned to machine-learning file formats. For organizations that host, serve, or fine-tune their own models, the practical takeaway is a recovery-tier question — whether model artifacts are protected, and restorable, to the same standard as source code and production databases. This piece covers the disclosure in defender terms and does not reconstruct the intrusion.

What Sysdig Documented

Sysdig's disclosure centers on a single characterization: that JadePuffer, the operator it links to an AI-agent-driven intrusion earlier in July, has moved from improvised, throwaway encryption tooling to a purpose-built payload. It calls that payload ENCFORGE and describes it as a compiled Go ransomware whose default configuration targets the file formats that make up an AI stack — model checkpoints and SafeTensors weights, GGUF and ONNX formats, FAISS vector indexes, and common training-dataset formats. According to the researchers' report, that coverage runs to roughly 180 extensions — a choice Sysdig reads as deliberate targeting of AI environments rather than the incidental sweep of a generic file locker.

Equally important is what the disclosure does not establish. Sysdig reported one observed session, named no victim organization, published no victim count, and said it found no evidence of a second ENCFORGE deployment, a data-leak site, or a payment portal. The strongest reported link between this operation and the earlier JadePuffer campaign is a shared extortion contact address. Those gaps bound what can responsibly be concluded from a single documented case.

Continuation Context: JadePuffer's First Analysis and the Langflow KEV Thread

ENCFORGE does not arrive cold. It is the second chapter of a story The CyberSignal covered when Sysdig published its initial JadePuffer analysis — reportedly the first documented fully agentic-AI-driven ransomware case — where an autonomous, LLM-based agent drove the intrusion lifecycle. That first case leaned on improvised scripting; this one swaps in dedicated, compiled tooling aimed at the model stores the earlier activity had already swept.

The reported entry point is a Langflow remote-code-execution flaw, which places the disclosure alongside a separate thread The CyberSignal has tracked — CISA's recent addition of actively exploited Langflow vulnerabilities to its Known Exploited Vulnerabilities catalog. Whether the RCE reported here is the same vulnerability behind those KEV entries is not established, and defenders should not assume a one-to-one match; the load-bearing point is that internet-exposed Langflow instances remain an exploited path, and patching is the reachable control regardless of which flaw is involved.

The AI-Model-Targeting Framing in Defender-Team Terms

The reason this case warrants attention is not a more powerful encryption routine but the choice of what to encrypt. Conventional ransomware treats documents, databases, and file shares as the leverage; ENCFORGE, as described, points that leverage at the model store. For a team that has invested compute and engineering time into trained weights, fine-tuned adapters, and curated training sets, those artifacts are high-value and often outside the backup regime that protects code and customer data. Sysdig estimates that rebuilding a single production model could run from $75,000 to roughly $500,000 in cloud GPU time and engineering effort — and shared storage means one run can reach several variants at once.

In defender terms, the framing is a prompt to widen the definition of "crown-jewel data" to include AI artifacts. It also extends a pattern The CyberSignal has followed as attackers reach into the AI-builder tooling layer — for example, the critical remote-code-execution flaw in Flowise, a comparable low-code LLM-orchestration platform. The AI infrastructure that makes model deployment easy is now a target surface in its own right — a theme in our coverage of how AI is used in cyberattacks.

Defender Posture for AI-Model-Hosting Organizations

Because the disclosure is research rather than a specific-victim advisory, its most productive use is as a posture review against the general shape of this risk. The first control is patching: Sysdig and the reporting press for organizations to move exposed Langflow instances to a current supported release, the same discipline that underpins ordinary patch management. The second is recovery. If model weights, vector indexes, and training datasets are not held in offline or immutable snapshots, an organization that can rebuild its application may still have no clean route back to its models — which is why Sysdig frames model artifacts as belonging in the same recovery tier as source code and production databases.

The behavioral fundamentals that bound any ransomware event still apply, whether a human or an agent is driving: least privilege on accounts and services that can reach data stores, monitoring for anomalous access, segmentation that limits blast radius, and tested, isolated backups. This mirrors the behavior-first posture The CyberSignal emphasized in coverage of INC ransomware activity across 830-plus victims, and through other Go-based ransomware disclosures: detecting the behaviors of an intrusion outlasts detecting any single operator or indicator.

Detection-Engineering Review Per the Published Indicators

For detection teams, the useful output is a set of durable anchors Sysdig published, not any need to reverse the malware. Sysdig noted that threat-intelligence platforms returned no detections on the sample at the time of its analysis, which makes the vendor-supplied artifacts the practical starting point: the report includes file hashes, an embedded key fingerprint, command-and-control addresses, and a YARA rule, alongside stable internal-name strings the researchers say survive a recompilation. Those strings are a resilient anchor engineers prefer over volatile indicators, because they survive a rebuild of the binary.

The most accessible behavioral signal Sysdig highlights is watching the directories that hold model weights, vector indexes, and training data for a burst of files renamed with a locked-file extension — the observable outcome of an encryption run, independent of how the payload arrived. Pairing that with the published hashes and YARA rule gives content- and behavior-based detection without reconstructing the operator's delivery path, which The CyberSignal does not detail here.

Open Questions

Several material specifics were not confirmed at publication. Sysdig named no victim organization, published no total dollar value for any ransom demand, and the disclosure does not indicate that the JadePuffer operator has been sanctioned or indicted. It is also not established whether the Langflow RCE reported as the entry vector is the same vulnerability behind the recent Langflow additions to CISA's KEV catalog. Each unknown counsels against treating a single documented session as a broad campaign; what is confirmed registers the direction of travel, and what remains open is why this is a posture review rather than a five-alarm event.

The CyberSignal Analysis

The reported facts above are Sysdig's and those of the outlets covering the disclosure; what follows is The CyberSignal's editorial reading of what defenders should take from them. None of the judgments below are new reported facts, and none reconstruct the activity operationally.

Signal 01 — Treat Model Artifacts as Crown-Jewel Data

The most durable lesson here is a data-classification one. Many organizations protect source code and production databases with immutable backups and strict recovery objectives, then leave trained weights, adapters, and curated datasets on shared storage with no equivalent guarantee. ENCFORGE makes the cost of that gap concrete: a model that cannot be restored must be rebuilt at real expense. Our reading: the takeaway is not to hunt this payload but to fold AI artifacts into the same recovery tier, backup cadence, and restore-testing discipline as the assets teams already consider critical.

Signal 02 — The AI-Builder Layer Is a Production Attack Surface

The reported entry through an internet-exposed Langflow instance is the part defenders can act on today. Low-code LLM-orchestration platforms are often stood up quickly for experimentation, then quietly promoted to production where they can reach credentials, data stores, and model files. Our assessment is that any organization running Langflow, Flowise, or comparable tooling should treat those instances as production systems — patched on a current release, network-restricted, and inventoried. The specific ransomware is the headline; the exposed AI-builder instance is the recurring root cause.

Signal 03 — File This Under the AI-Agent Security Thread

The most useful place to file ENCFORGE is the continuing arc of agentic-AI abuse. It extends JadePuffer's earlier agentic case from improvised scripting to purpose-built tooling, and lands against the same dual-use backdrop as defensive efforts like OpenAI's Daybreak program routing cyber-capable AI through controlled channels. The watch item is convergence: teams that treat AI risk, ransomware risk, and supply-chain risk as one continuous problem will adapt faster than those that silo them.

Sources