JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI models

JADEPUFFER returned to a Langflow instance using CVE-2025-3248 and deployed ENCFORGE, a Go-based ransomware built to destroy AI and machine learning assets such as model checkpoints, vector databases, and training datasets. The campaign shows a shift from improvised scripts to purpose-built tooling, with the same extortion contact and new host-escape techniques used to encrypt files and cripple AI recovery. #JADEPUFFER #Langflow #CVE-2025-3248 #ENCFORGE

Keypoints

JADEPUFFER used the Langflow vulnerability CVE-2025-3248 as its persistent entry point.
After initial access, the actor performed credential harvesting, service probing, and lateral movement against internal systems.
The new payload, ENCFORGE, is a compiled Go ransomware binary packed with UPX and tailored for AI/ML environments.
ENCFORGE targets about 180 file extensions, including model checkpoints, vector indexes, training datasets, and embedding files.
The campaign used Docker socket abuse, privileged escape containers, and nsenter-based host escape techniques to move the payload onto the host.
The extortion contact [email protected] matches the prior JADEPUFFER campaign, strengthening attribution continuity.
The operation is destruction-first and single-extortion, with no evidence of data exfiltration or a leak site.

MITRE Techniques

[T1190] Exploit Public-Facing Application – JADEPUFFER gained access by exploiting Langflow’s unauthenticated code execution flaw in /api/v1/validate/code (‘exploited Langflow through CVE-2025-3248’).
[T1059.006] Command and Scripting Interpreter: Python – The actor executed and iterated Python payloads through the Langflow RCE channel (‘built and iterated six Python scripts’).
[T1082] System Information Discovery – The operator confirmed execution by collecting host details (‘id, uname -m, hostname’).
[T1003] OS Credential Dumping – JADEPUFFER swept for secrets including cloud keys, database strings, and API tokens (‘swept the environment for credentials’).
[T1049] System Network Connections Discovery – The actor probed internal services for reachability (‘probed internal services via /dev/tcp for reachability’).
[T1021.004] Remote Services: Docker – The campaign abused the Docker socket and Docker API to create containers and escape namespaces (‘located /var/run/docker.sock’, ‘/containers/create’, ‘/containers/{id}/start’).
[T1611] Escape to Host – JADEPUFFER used a privileged container and nsenter to cross from container to host (‘build an escape mechanism to carry it across a namespace boundary’, ‘nsenter –target 1’).
[T1105] Ingress Tool Transfer – The ransomware binary was fetched from attacker infrastructure (‘attempted to fetch the ransomware binary from their command and control (C2)’).
[T1027] Obfuscated Files or Information – The payload used UPX packing and base64-encoded script delivery to reduce visibility (‘UPX-packed Go ransomware’, ‘single-shot inline base64 decode’).
[T1485] Data Destruction – The operator deployed ransomware to destroy AI model artifacts and other files (‘designed to destroy what that infrastructure runs on’).
[T1486] Data Encrypted for Impact – ENCFORGE encrypted files and renamed them with .locked extensions (‘use –lock to encrypt’, ‘renames each encrypted file with .locked extensions’).
[T1562.001] Impair Defenses: Disable or Modify Tools – The Windows build includes anti-recovery actions such as deleting shadow copies and disabling recovery (‘vssadmin.exe’, ‘bcdedit.exe’).
[T1106] Native API – The operator used low-level socket and Docker API behavior for direct host interaction (‘Raw AF_UNIX socket HTTP client’).

Indicators of Compromise

[IP address] C2 and binary hosting infrastructure – 34.153.223[.]102, 45.131.66[.]106
[Port] Command-and-control service – 9191
[URL] Ransomware binary download path – hxxp://34.153.223[.]102:9191/.lockd, hxxp://34.153.223[.]102:9191/pv/bin/python3
[Email address] Extortion contact used in ENCFORGE and prior JADEPUFFER activity – [email protected]
[File names] Ransom note and staged payload names – lockd, README, HOW_TO_DECRYPT, README_DECRYPT
[File hash (SHA-256)] Packed and unpacked ENCFORGE samples – 8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2, ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328
[File hash (SHA-256)] Staged CPython 3.14 binary – ab9824b61587c77a8d8649545cdbdc63ed2c384e45c9aba534e3f457f96efa7a
[Public key] Embedded RSA-2048 public key used by ENCFORGE – SHA-256 2378bf45bb54fb2defc460063c9b43e09870741b62692b7f6acbc3cd7898bb3
[Encrypted file extension] File suffix created by the locker – .locked

SHARE THIS STORY

WhatsApp X (Twitter)Telegram Bluesky Facebook LinkedIn Threads Email Print