JADEPUFFER Ransomware Targets AI Models. Can You Rebuild Yours?
JADEPUFFER ransomware targets AI models, datasets, and vector stores. Learn how to patch Langflow and build a recoverable AI service.
Your AI model may be backed up.
Your AI service may still be unrecoverable.
Security researchers have observed ransomware designed specifically to encrypt AI and machine-learning assets.
Sysdig reported that the operator it calls JADEPUFFER deployed ENCFORGE, a ransomware payload targeting approximately 180 file extensions associated with model checkpoints, vector databases, training datasets, embeddings, and other AI infrastructure.
The immediate security issue is a known Langflow vulnerability.
The larger business question is more difficult:
If your AI environment disappeared today, could your organization reconstruct a functioning and trustworthy service—not merely restore one model file?
What is JADEPUFFER ransomware?
JADEPUFFER is the name Sysdig assigned to an operator it first documented in July 2026.
The observed attack entered through an exposed Langflow system using CVE-2025-3248. The operator conducted reconnaissance, harvested credentials, moved laterally, and later deployed a specialized ransomware payload called ENCFORGE.
According to Sysdig’s threat research, ENCFORGE is a compiled Go binary that targets AI and machine-learning formats across:
- Model checkpoints and weights
- Training and validation datasets
- Serialized models
- Vector databases and indexes
- Embeddings
- Development and deployment artifacts
The analyzed binary focused on encryption. Sysdig found no data-exfiltration capability in the sample and no evidence of exfiltration during the observed session.
The number of affected organizations is unknown. This is a credible, observed attack path—not proof that ENCFORGE is already widespread.
Which Langflow systems are vulnerable?
JADEPUFFER used CVE-2025-3248, a critical Langflow vulnerability affecting versions before 1.3.0.
The vulnerability allows an unauthenticated attacker to send crafted requests to the /api/v1/validate/code endpoint and execute arbitrary code.
The National Vulnerability Database records a 9.8 CVSS score and confirms that CISA added it to the Known Exploited Vulnerabilities Catalog in May 2025.
Organizations should:
- Identify every Langflow deployment.
- Determine its exact version and internet exposure.
- Upgrade to the latest supported release.
- Review all subsequent Langflow advisories.
- Investigate systems that previously ran vulnerable versions.
- Rotate credentials accessible to exposed deployments.
Installing a patch removes the known vulnerability. It does not remove credentials, persistence, or malicious changes established before the update.
Why isn’t backing up the model enough?
An AI application normally depends on much more than its primary model.
The model
- Base and fine-tuned weights
- Checkpoints
- Model-registry versions
- Hyperparameters
The knowledge
- Training and validation datasets
- Source documents
- Vector-store inputs
- Embeddings and indexes
- Data lineage
The logic
- Preprocessing code
- Prompts and policies
- Application configurations
- Business rules
- Evaluation criteria
The operating environment
- Containers and dependencies
- Deployment code
- Cloud services
- Credentials and integrations
- Required computing capacity
Restoring one checkpoint without those dependencies may produce a model that cannot be validated, trusted, or returned to production.
A vector index can be rebuilt—but only if the source data and embedding process still exist.
A fine-tuned model can be recreated—but only if the training data, base model, code, parameters, evaluation records, and sufficient computing resources were preserved.
The Infonaligy perspective: recovery means reproducibility
AI resilience is not primarily a storage problem.
It is a business-continuity discipline.
The objective should not be:
"We have a copy of the model."
It should be:
"We can reconstruct, validate, secure, and return the complete AI service to operation within an acceptable timeframe."
That requires vulnerability management, protected credentials, isolated backups, infrastructure documentation, recovery procedures, and evidence that the rebuilt service behaves as expected.
What should organizations do now?
Verify exposure
Scan cloud environments, containers, development systems, and external services for Langflow deployments. Do not rely exclusively on a manually maintained software list.
Protect credentials
Review model-provider keys, cloud tokens, database passwords, Kubernetes identities, instance metadata, and other secrets accessible to AI workloads.
Rotate credentials when prior exposure cannot be ruled out.
Constrain the environment
Do not give AI workflow containers unnecessary root access, unrestricted outbound connectivity, broad host mounts, or access to the Docker socket.
Build an AI recovery inventory
Document every artifact required to reproduce each business-critical AI service and the dependencies between them.
Test the complete restoration
Restore the service into an isolated environment. Validate its identity, provenance, integrity, accuracy, security, integrations, and output before reconnecting it to production data.
Frequently asked questions
ENCFORGE is a Go-based ransomware payload analyzed by Sysdig. It targets file formats associated with AI models, training data, vector stores, and machine-learning workflows.
Yes. CISA added it to the Known Exploited Vulnerabilities Catalog in May 2025. Langflow versions before 1.3.0 are affected.
Version 1.3.0 addresses CVE-2025-3248, but organizations should upgrade to the latest supported version and evaluate every subsequent advisory.
Yes, if clean backups and the required dependencies were protected. Recovery may require model weights, datasets, code, configurations, indexes, lineage, evaluation records, and computing capacity.
Include models, source data, vector-store inputs, code, prompts, configurations, deployment artifacts, registry history, evaluation records, dependencies, credentials, and documented recovery procedures.
Infonaligy can help connect vulnerability assessment, infrastructure security, and backup and disaster recovery into a practical AI recovery plan.
Serving Businesses Across Texas & Oklahoma