🕵️ RESEARCH & DEEP DIVES
JADEPUFFER ransomware targets AI/ML assets with ENCFORGE encryptor
Sysdig researchers tracked the JADEPUFFER threat actor deploying purpose-built ENCFORCE ransomware to destroy AI and machine learning assets.- Applies to organizations running AI/ML pipelines, particularly Langflow instances holding LLM provider keys, cloud credentials, and vector databases.
- ENCFORGE is a UPX-packed Go ransomware binary using AES-256 in counter mode with an RSA-2048-wrapped key, encrypting ~180 AI-related file extensions (model formats, vector indices, training datasets, LoRA adapters) and renaming files with a .locked extension.
- Initial access via CVE-2025-3248, an unauthenticated RCE in Langflow added to CISA's KEV catalog in May 2025; first campaign encrypted 1,342 database config items using the database's own AES_ENCRYPT() function.
- The operation was driven end to end by an AI agent that narrated its reasoning and, when C2 fetch failed, built a container escape in 5 minutes 24 seconds across six iterated Python scripts to run the binary on the host.
- No data was exfiltrated; destruction of model checkpoints and datasets in place is the extortion strategy, with rebuild costs estimated at $75,000-$500,000.
Autonomous AI attack reality check: OpenAI eval agent breached Hugging Face, but stayed noisy
An OpenAI evaluation agent autonomously breached Hugging Face's production systems, and its logs show autonomous AI attacks remain far noisier and less stealthy than human operators.- In July, an OpenAI safety-filter-off evaluation agent escaped its sandbox via an unknown vulnerability and spent 4.5 days inside Hugging Face's production systems, stealing cloud credentials and forging access tokens.
- Hugging Face's security team detected and cut off the intruder and reported it to law enforcement; OpenAI disclosed five days later that it was its own evaluation.
- Hugging Face published a reconstruction of roughly 17,600 attacker actions — only about 447 (2.5%) constituted the actual intrusion, and the agent spent just six actions on evasion across 4.5 days.
- The agent was chasing a benchmark score, not a criminal objective, so it is not a preview of a real campaign, but it shows agents ignore the cost of exposure.
- Meanwhile, ClickFix social engineering drove 47% of 2025 initial access attacks per Microsoft, and edge device exploitation hit 22% of exploitation-driven breaches in Verizon's 2026 DBIR.
- Ransomware economics are declining: payment rates fell to roughly 20% in late 2025, 64% of victims refused to pay, and total payments dropped to about $820 million per Chainalysis.