Sysdig’s Threat Research Team published the first technical analysis of ENCFORGE — a compiled Go-language ransomware built specifically to target artificial intelligence infrastructure, with an encryption extension list covering approximately 180 AI-specific file formats including PyTorch model checkpoints, Hugging Face SafeTensors files, ONNX interchange format, GGUF and GGML formats used by local inference engines, FAISS vector indexes, and training datasets stored as Parquet, Apache Arrow, and NumPy files. Sysdig attributed the deployment to the JADEPUFFER threat operator, previously documented for using AI agent orchestration in its attacks. ENCFORGE represents JADEPUFFER’s transition from automated attack orchestration to purpose-built AI infrastructure ransomware.
ENCFORGE: A Go Ransomware Built for AI Model Weight Files Specifically
ENCFORGE is a statically compiled Go 1.22.12 ELF binary, packed with UPX 5.20, with no data exfiltration capability. Its defining characteristic is an encryption target list covering approximately 180 file extensions specific to AI and machine learning infrastructure — a set of formats that did not represent a meaningful attack surface before 2023 and now represents billions of dollars in computational investment at AI companies, research institutions, and enterprises deploying AI in production environments.
The encryption algorithm is AES-256-CTR operating in partial-file mode: rather than encrypting entire multi-gigabyte model files, ENCFORGE encrypts only the initial segments of each file. This technique — also used by LockBit and BlackCat/ALPHV — dramatically reduces encryption time against very large files while rendering them unrecoverable without the key. For AI model weight files, which can reach hundreds of gigabytes per checkpoint, partial encryption is the operationally effective approach. The AES-256-CTR symmetric key is wrapped with an RSA-2048 public key embedded in the binary, ensuring only the attacker can produce the decryption key.
Extortion contact is provided through a ProtonMail address embedded in the ransom note. ENCFORGE drops no data exfiltration component; the attack is a pure encryption-for-ransom model rather than the double-extortion model (encrypt and exfiltrate) used by many contemporary ransomware groups.
JADEPUFFER’s Delivery Chain Through Langflow CVE-2025-3248 and Docker Escape
ENCFORGE was delivered by the JADEPUFFER threat operator through exploitation of Langflow CVE-2025-3248 (CVSS 9.8), an unauthenticated Python code execution vulnerability in Langflow’s /api/v1/validate/code endpoint. JADEPUFFER previously documented by Sysdig as using AI agent orchestration in its attack automation, the operators used the Langflow endpoint to execute arbitrary code on containerized Langflow deployments.
After achieving code execution within the Langflow container, the operators exploited Docker socket access to escape from the container to the underlying host system. With host-level access established, ENCFORGE was deployed and began targeting AI model files accessible from the compromised host, including files on mounted volumes, network-accessible storage, and any paths reachable from the host’s filesystem.
The delivery chain illustrates a risk specific to AI infrastructure environments: Langflow and similar AI workflow platforms are frequently deployed in containerized environments with access to significant model storage — exactly the file repository ENCFORGE targets. An unauthenticated code execution vulnerability in the AI platform itself provides the initial foothold; the Docker socket escape provides the host access needed to reach the model files that represent the actual ransomware target.
JADEPUFFER’s Estimated Recovery Costs and the AI Model File Recovery Problem
Sysdig estimated recovery costs of $75,000 to $500,000 per affected AI model in GPU compute time and engineering effort for retraining or restoration from unaffected backups. The wide range reflects the variable cost of model training by scale: a smaller fine-tuned model might be retrainable within weeks at moderate GPU cost, while a large pre-trained foundation model could require months of compute time valued in the hundreds of thousands of dollars.
The recovery cost estimate does not account for the opportunity cost of unavailable AI services during the recovery period, the cost of reproducing training data pipelines, or the time required to validate that a retrained model has reached the performance characteristics of the encrypted original. For organizations where AI model availability is tied to production services or revenue-generating functions, the effective impact of ENCFORGE can exceed the ransom demand by a substantial margin.
Why AI Model Repositories With Langflow Access Are the Primary Risk Target
Organizations running Langflow or similar AI workflow automation platforms with containerized execution and access to model storage need to assess their exposure to ENCFORGE’s delivery chain. The attack path — Langflow RCE via CVE-2025-3248, Docker socket escape, host-level access to model files — is specific enough that defensive priorities are clear: patch Langflow deployments, restrict Docker socket access from containerized AI workloads, and ensure that AI model storage is not directly mounted or accessible from containers running internet-exposed AI workflow endpoints.
Offline and air-gapped backups of AI model checkpoints, training datasets, and FAISS vector indexes provide the primary recovery option if ENCFORGE’s partial-file encryption is applied before detection. Organizations whose model files are backed up to systems not reachable from the compromised host retain the ability to recover without paying the ransom; those whose backup infrastructure shares network access with the compromised host may find that backup files were also encrypted during the attack.
