Loading story…
Researchers said the JADEPUFFER threat actor deployed a new ransomware strain, ENCFORGE (also reported as EncForge), against a previously compromised Langflow server by exploiting CVE-2025-3248, a critical unauthenticated remote code execution flaw affecting versions before 1.3.0. After gaining code execution, the attacker used an exposed Docker socket to escape the container, obtain root-level control on the host, and launch ransomware designed specifically for AI and machine learning environments. Sysdig linked the activity to earlier JADEPUFFER operations, including a second attack on the same vulnerable server and reuse of the Proton Mail address e78393397@proton.me.
ENCFORGE is described as a purpose-built ransomware family that targets roughly 180 file types tied to AI workflows, including model weights and checkpoints, vector databases and indexes, embeddings, and training datasets. The malware uses hybrid encryption based on AES-256 and RSA-2048, appends a .locked extension to encrypted files, drops ransom notes, and in one recovered sample deletes itself after execution; researchers also observed the operator iteratively generating multiple Python scripts within minutes when an initial payload failed, indicating real-time adaptation during the intrusion. Investigators found no evidence of data exfiltration, but warned that encrypting AI artifacts could force costly retraining and prolonged recovery, and urged organizations to patch Langflow, rotate exposed credentials, restrict Docker socket access, harden filesystem controls, and maintain offline or immutable backups of AI assets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Sysdig connected the ENCFORGE ransomware activity to the earlier JADEPUFFER operation, citing indicators including reuse of the Proton Mail address e78393397@proton.me. The attribution tied the new ransomware deployment to the same threat actor behind the prior Langflow compromise.
During the ransomware intrusion, the operator reportedly adjusted in real time after an initial payload delivery failure, generating six Python scripts in about five minutes before successfully executing encryption. This behavior was highlighted as evidence of autonomous or agentic adaptation during the attack.
In a second observed attack on the same vulnerable Langflow server, Sysdig linked JADEPUFFER to deployment of ENCFORGE, a custom ransomware designed to encrypt AI and machine learning assets including model files, vector indexes, and training datasets. Researchers found no evidence of data exfiltration in the recovered sample.
Sysdig reported that the JADEPUFFER operator compromised a Langflow instance vulnerable to CVE-2025-3248, a critical unauthenticated remote code execution flaw affecting versions before 1.3.0. The intrusion also leveraged an exposed Docker socket to escape the container and gain host-level control.
Sysdig published research detailing JADEPUFFER's exploitation of a vulnerable Langflow server, use of an exposed Docker socket for host escape, deployment of ENCFORGE ransomware targeting AI assets, and attribution of the activity to the same operator. The report highlighted the actor's rapid adaptation during payload delivery as evidence of agentic behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecuritymagazine.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourcesysdig.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and sector defenders reported that **JADEPUFFER** carried out what is being described as the first documented **agentic ransomware** attack, using an autonomous AI agent to execute an intrusion chain with little or no step-by-step human control. The attack began with exploitation of **`CVE-2025-3248`** in an internet-facing **Langflow** instance, followed by credential harvesting, pivoting through a storage server that reportedly used default administrator credentials, persistence, and lateral movement toward a production database environment. Sysdig said the malware showed signs of autonomous decision-making, including adapting after failed authentication attempts and embedding natural-language behavior descriptions in code. The operation ultimately encrypted more than **1,300 configuration entries**, deleted additional data, and displayed a **Bitcoin** ransom note. Researchers said the ransomware did **not** retain or transmit the decryption key, meaning victims could be unable to recover data even if a ransom were paid. WaterISAC warned that the case demonstrates how AI agents could automate familiar attack techniques at speed and lower the barrier to ransomware operations, and urged organizations to patch Langflow, limit internet exposure of AI-related systems, and review credential storage, database administration access, and other externally reachable services.
Jul 12, 2026
Attackers are actively exploiting **CVE-2025-3248**, a remote code execution flaw in Langflow’s code validation API, to compromise internet-exposed AI development servers and deploy a customized **Gafgyt/BASHLITE** malware variant on **x86_64 Linux** systems. Akamai reported that the intrusion chain uses untrusted Python execution to fetch a Linux binary from a staging server, launch it from a temporary directory, and turn the host into a bot focused on distributed denial-of-service activity rather than cryptomining, persistence, or lateral movement. The malware reportedly supports multiple flood modes, including **UDP**, **TCP**, **HOLD**, and **junk/STD**, and uses a modified **RC4-based** cipher to obscure command-and-control traffic and hinder standard decoding. **CISA** added `CVE-2025-3248` to its Known Exploited Vulnerabilities catalog, while **GreyNoise** observed hundreds of exploit source IPs targeting the flaw. Defenders are being urged to patch Langflow, isolate AI development environments, place exposed instances behind a **WAF**, enforce outbound filtering including blocking unauthorized traffic such as port `1337`, and deploy **YARA** detections keyed to the malware’s distinctive cipher seed bytes.
Jul 22, 2026
Sysdig reported an autonomous intrusion it tracks as **JADEPUFFER** that exploited `CVE-2025-3248`, a missing-authentication remote code execution flaw in an internet-facing Langflow instance, then pivoted into a production environment running **MySQL** and **Alibaba Nacos**. On the initial host, the attacker harvested secrets, dumped Langflow’s Postgres database, scanned internal services, enumerated a MinIO object store using default credentials, and established persistence with a cron-based beacon to `45.131.66[.]106:4444`. Researchers said the operation then used MySQL root access of unknown origin and abused `CVE-2021-29441` plus Nacos’s long-standing default JWT signing key to forge access and create a backdoor administrator account, with payloads showing rapid self-correction and plain-English reasoning consistent with AI-driven automation. The attack escalated into destructive extortion on the production server, including container-escape checks through MySQL file primitives, probes for `docker.sock`, cgroup and mount data, and possible UDF-based privilege-escalation paths before cleanup. JADEPUFFER then encrypted all **1,342** Nacos configuration items with MySQL `AES_ENCRYPT()`, dropped the original configuration and history tables, disabled foreign key checks to delete additional schemas, and created a ransom-note table demanding Bitcoin payment via Proton Mail. Sysdig said it found no evidence that the encryption key was saved or that a claimed backup to `64.20.53.230` actually occurred, indicating victims likely could not recover the destroyed data even if a ransom were paid.
Jul 22, 2026