Exhibitors increasingly choose not only documents and databases, but also the most expensive digital assets of companies. The JADEPUFFER group has developed a malware that targets artificial intelligence models, data sets for learning and related storage facilities – it will have to be restored for hundreds of thousands of dollars.
Specialists of the team Sysdig Threat Research Team found a new activity of JADEPFER after the attack through the vulnerability CVE-25-3248 (10.0 Critical) in the Langflow platform. The error allows an attacker without authentication to perform arbitrary code on the server. Experts previously associated this group with autonomous attacks, where the malicious agent independently conducted reconnaissance, searched for accounting data and moved inside the infrastructure.
In the new campaign, JADEPUFFER significantly changed the tools. Instead of temporary Python scripts, the band used a full-fledged ransomware program ENCFORGE, created in the Go language. The malware received the name lockd and is specially set to work against the infrastructure of artificial intelligence and machine learning.
ENCFORGE is looking for about 180 types of files, including model checkpoints, neural networks, vector databases, and datasets for learning. Among the goals were the popular formats .ckt, .h5, .onnx, .pt, .phth, .safetensors, .gguf, .faiss and .parquet. Such a set of extensions shows that the program was created not as a regular encryption, but for specific tasks of the AI infrastructure.
The attack begins with a vulnerable Langflow. The platform often stores access keys to cloud services, accounting data, and storage connections that are used in applications based on large language models. By accessing the server, JADEPUFFER collects the secrets found, checks internal services and tries to gain control of additional components.
During one of the attacks, the group found the available Docker socket and tried to run a privileged container with access to the host file system. When the ransomware program was not loaded, JADEPFER changed the approach and created its own exit mechanism. Experts have recorded how the malicious agent rewrote the scripts several times, until it received a working version of the launch of the program on the main server.
By penetrating the system, ENCFORGE encrypts files using the AES-256-CTR algorithm and protects the key through the RSA-2048. Encrypted files receive an .locked extension, and the program leaves a requirement to pay a ransom with e-mail [email protected]. At the same time, experts found no signs that the data was stolen or published on resources with leaks. JADEPUFFER is betting precisely to deprive the company of access to data.
Losing AI models can cost much more than recovering regular files. According to Sysdig, to re-create a production model taking into account computing resources and the work of specialists, you may need from 75 thousand to 500 thousand dollars. If the training data is encrypted together with the models, it becomes even more difficult to recover, since first you will have to reassemble the original data sets.
Experts believe that JADEPUFFER in a short time has gone from a set of scripts to a full-fledged tool that tracks campaigns, has a separate key generator and supports different platforms. At the same time, the entry point remained the same - vulnerable Langflow.
To protect the infrastructure, experts recommend updating Langflow at least to version 1.3.0, limiting applications access to the Docker socket, prohibit containers from running with advanced rights and separately protecting catalogs with models and training data. Also, companies should store backup copies of AI-artefacts separately from the main infrastructure, since conventional backups will not always help to quickly return the working model.
Specialists of the team Sysdig Threat Research Team found a new activity of JADEPFER after the attack through the vulnerability CVE-25-3248 (10.0 Critical) in the Langflow platform. The error allows an attacker without authentication to perform arbitrary code on the server. Experts previously associated this group with autonomous attacks, where the malicious agent independently conducted reconnaissance, searched for accounting data and moved inside the infrastructure.
In the new campaign, JADEPUFFER significantly changed the tools. Instead of temporary Python scripts, the band used a full-fledged ransomware program ENCFORGE, created in the Go language. The malware received the name lockd and is specially set to work against the infrastructure of artificial intelligence and machine learning.
ENCFORGE is looking for about 180 types of files, including model checkpoints, neural networks, vector databases, and datasets for learning. Among the goals were the popular formats .ckt, .h5, .onnx, .pt, .phth, .safetensors, .gguf, .faiss and .parquet. Such a set of extensions shows that the program was created not as a regular encryption, but for specific tasks of the AI infrastructure.
The attack begins with a vulnerable Langflow. The platform often stores access keys to cloud services, accounting data, and storage connections that are used in applications based on large language models. By accessing the server, JADEPUFFER collects the secrets found, checks internal services and tries to gain control of additional components.
During one of the attacks, the group found the available Docker socket and tried to run a privileged container with access to the host file system. When the ransomware program was not loaded, JADEPFER changed the approach and created its own exit mechanism. Experts have recorded how the malicious agent rewrote the scripts several times, until it received a working version of the launch of the program on the main server.
By penetrating the system, ENCFORGE encrypts files using the AES-256-CTR algorithm and protects the key through the RSA-2048. Encrypted files receive an .locked extension, and the program leaves a requirement to pay a ransom with e-mail [email protected]. At the same time, experts found no signs that the data was stolen or published on resources with leaks. JADEPUFFER is betting precisely to deprive the company of access to data.
Losing AI models can cost much more than recovering regular files. According to Sysdig, to re-create a production model taking into account computing resources and the work of specialists, you may need from 75 thousand to 500 thousand dollars. If the training data is encrypted together with the models, it becomes even more difficult to recover, since first you will have to reassemble the original data sets.
Experts believe that JADEPUFFER in a short time has gone from a set of scripts to a full-fledged tool that tracks campaigns, has a separate key generator and supports different platforms. At the same time, the entry point remained the same - vulnerable Langflow.
To protect the infrastructure, experts recommend updating Langflow at least to version 1.3.0, limiting applications access to the Docker socket, prohibit containers from running with advanced rights and separately protecting catalogs with models and training data. Also, companies should store backup copies of AI-artefacts separately from the main infrastructure, since conventional backups will not always help to quickly return the working model.
