Loading malware…
ENCFORGE is a Go-based ransomware family associated with the JADEPUFFER threat actor and designed to encrypt artificial intelligence and machine learning assets rather than only conventional enterprise data. It has been observed targeting roughly 180 file extensions spanning model checkpoints and weights, vector indexes, training datasets, embeddings, and related ML pipeline artifacts, indicating deliberate focus on AI infrastructure. Reported targets include formats used by PyTorch, TensorFlow, SafeTensors, GGUF, GGML, FAISS, Parquet, TFRecord, NumPy, Arrow, Feather, ONNX, and DuckDB.
The malware is distributed as a compiled binary packed with UPX and supports operator customization of additional target extensions through command-line options. It uses hybrid cryptography, encrypting file data with AES-256-CTR and protecting the per-run symmetric key with an embedded RSA-2048 public key. ENCFORGE performs partial or region-based encryption for speed, renames encrypted files with a new extension, drops ransom notes, terminates processes that keep files open, supports resumed execution without re-encrypting completed files, and can delete itself after execution.
Observed deployment occurred after JADEPUFFER exploited CVE-2025-3248 in Langflow to obtain unauthenticated remote Python code execution on exposed systems. In documented intrusions, the operator conducted reconnaissance, harvested credentials, probed internal services, and abused exposed Docker socket access to escape from a containerized environment and execute ENCFORGE on the host. Researchers reported no evidence that ENCFORGE itself included data-exfiltration functionality, a leak site, or a payment portal, suggesting a destruction-first or single-extortion model centered on rendering AI assets unusable. The operational impact can be unusually severe because encrypted model artifacts and colocated training data may require costly retraining and reconstruction rather than straightforward restoration.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
This attack exploited the critical vulnerability CVE-2025-3248 that allows remote Python code execution due to a critical missing authentication vulnerability in Langflow's code-validation endpoint. Although Langflow fixed the vulnerability in version 1.3.0, the targeted server remained vulnerable even after it was publicly reported. | An ENCFORGE binary was deployed in the second campaign that searched for 180 different file extensions using a compiled Go-based ransomware binary.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
An ENCFORGE binary was deployed in the second campaign that searched for 180 different file extensions using a compiled Go-based ransomware binary.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
the AI agent exploited the same Langflow vulnerability that was used in the earlier attack and located an exposed Docker socket that it leveraged to create a privileged escape container and deploy the ENCFORGE payload.
The researchers observed the attacker (i.e., the AI agent) extracting cloud provider keys, database connection strings, and API tokens and reusing/replaying them to access internal database and cache services.
Container create requests with Privileged: true combined with PidMode: host or a bind mount of / are a high-confidence escape indicator.
By launching a privileged container over the mounted Docker socket, the ransomware was moved across the container boundary through the host's proc file system and executed against the host file system outside the original container's isolation using the mounted Docker socket.
Following encrypting the targeted files, ENCFORGE terminated processes holding file locks and deleted itself once the encryption was complete.
The researchers observed the attacker (i.e., the AI agent) extracting cloud provider keys, database connection strings, and API tokens and reusing/replaying them to access internal database and cache services.
By launching a privileged container over the mounted Docker socket, the ransomware was moved across the container boundary through the host's proc file system and executed against the host file system outside the original container's isolation using the mounted Docker socket.
An ENCFORGE binary was deployed in the second campaign that searched for 180 different file extensions... ENCFORGE is specifically designed to identify AI-related assets.
The attacker generated multiple Python scripts using the compromised Langflow environment... the scripts were able to develop a method for exiting the container environment through the exposed Docker socket and executing the ransomware on the host machine.
Unlike conventional ransomware targets, however, encrypted AI model artifacts cannot be restored after they are wiped.
Researchers have discovered a ransomware strain that encrypts AI model weights, vector indexes, and training data... ENCFORGE encrypts portions of files with AES-256-CTR encryption keys protected by embedded RSA-2048 keys.
Following encrypting the targeted files, ENCFORGE terminated processes holding file locks and deleted itself once the encryption was complete.
Anti-recovery and ransom note: ENCFORGE kills processes holding file locks before encrypting data... The binary carries live Windows anti-recovery code in this Linux build: vssadmin.exe (Volume Shadow Copy deletion) and bcdedit.exe (boot recovery disable) are literal invocations in the WipeShadowCopies and DisableRecoveryActions functions.
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Go-based ransomware tailored for AI environments that encrypts AI model weights, vector indexes, and training data. It targets formats such as PyTorch and TensorFlow checkpoints, SafeTensors, GGUF, FAISS indexes, Parquet, TFRecord, and NumPy arrays; uses AES-256-CTR with embedded RSA-2048-protected keys; lacks observed exfiltration or payment infrastructure; terminates locking processes and deletes itself after encryption.
A Go-based ransomware payload that targets AI-related assets and encrypts files using AES-256-CTR with the per-run symmetric key encrypted by RSA-2048. It focuses on AI model, dataset, checkpoint, and index file types and appends the .locked extension.
Purpose-built ransomware designed to target modern AI infrastructure and destroy or encrypt AI model artifacts, impacting deployed and fine-tuned models, datasets, vector stores, and related AI assets.
A Go-based ransomware strain used by JADEPUFFER to encrypt AI models, training data, vector databases, and other machine-learning assets. It appends the .locked extension, drops ransom notes, and appears focused on encryption rather than data theft or leak-site extortion.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.