Over five minutes and 24 seconds, the attacker iterated six Python scripts through a Langflow remote-code-execution channel, converging on a privileged container escape that copied a ransomware locker across the namespace boundary and ran it on the host filesystem.
How JadePuffer gained and expanded access via CVE-2025-3248
According to research published July 20 by the Sysdig Threat Research Team (TRT), JadePuffer re-entered the same Langflow instance it had compromised previously by exploiting CVE-2025-3248, a missing-authentication flaw in Langflow’s code validation endpoint. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added that vulnerability to its Known Exploited Vulnerabilities catalog in May 2025. Once inside, the operator performed reconnaissance and credential harvesting, discovered a mounted Docker socket and used that discovery to fetch or construct a delivery mechanism that would cross container boundaries.
From failed fetch to on-the-fly container escape
When an attempt to fetch the ransomware binary from JadePuffer’s command-and-control server failed inside the container, the operator rebuilt the delivery mechanism in real time. Over the course of those five minutes and 24 seconds, the actor iterated six Python scripts through the Langflow RCE channel until a working pipeline emerged: the pipeline used the mounted Docker socket to spawn a privileged escape container, copied the locker across the namespace boundary via the host’s procfs, and then executed the encryption pass on the host filesystem outside the original container’s isolation.
ENCFORGE: a locker built to destroy AI models
Sysdig’s analysis labels the payload ENCFORGE: a UPX-packed Go ransomware binary that deliberately targets machine-learning artifacts. The binary enumerates roughly 180 file extensions across the modern ML stack and names formats including PyTorch and TensorFlow checkpoints, HuggingFace SafeTensors weights, llama.cpp GGUF quantized models, FAISS vector indices, Apache Parquet and TFRecord training datasets, and NumPy arrays. The binary’s help text lists LoRA fine-tune adapters and legacy GGML weights as examples, and a command-line --include flag lets operators append custom extensions per campaign.
ENCFORGE uses AES-256-CTR with an RSA-2048 key exchange, kills processes holding file locks before encrypting, and self-deletes after running. Sysdig found no data-exfiltration capability in the binary and no leak site associated with the operation, a pattern that places JadePuffer outside the double-extortion ransomware-as-a-service model: the primary threat here is destruction of model artifacts, not disclosure.
Why ordinary backups may not restore production models
Sysdig highlights a practical gap between restoring business data and restoring production models. While backups can recover encrypted files, model development typically involves long training runs, fine-tuning iterations and curated datasets. Reproducing the work between the last clean snapshot and the time of compromise, Sysdig said, can require re-running training at a cloud-GPU and engineering cost of $75,000 to $500,000 per model. If training data resided on the same host that was attacked, recovery is blocked entirely until that data is reconstructed, because the observed ENCFORGE binary swept every model variant on shared storage in a single pass.
What this means for cloud security teams, model owners, and procurement leaders
- Cloud security teams and technologists: The attack chain underscores the risk of exposed container controls and mounted Docker sockets; defenders will watch privileged socket exposure and remote-code-execution channels used to iterate scripts that produce escape payloads.
- Model owners and affected enterprises: Backups alone may not suffice — the cited $75,000–$500,000 cost range for retraining a model focuses attention on isolating model artifacts and storing immutable, off-host copies of training data and checkpoints.
- Procurement leaders and platform operators: The use of a missing-authentication flaw in Langflow (CVE-2025-3248) and its appearance on CISA’s KEV catalog in May 2025 signal an immediate upgrade-and-patch imperative for services that expose validation or code-execution endpoints.
Sysdig attributes the operation to JadePuffer on the strength of an extortion contact embedded in the binary that matches the address disclosed in its earlier report, tying this destructive, model-focused campaign to the same agentic operator documented previously. The record here is precise, narrow and unsettling: an operator willing to forgo data-leak pressure in favor of outright destruction, a bespoke locker named ENCFORGE aimed at the machine-learning toolchain, and an improvised container escape developed in minutes through a remote-code-execution channel.
The immediate, concrete questions this episode leaves are operational rather than theoretical: will model artifact protection and container hardening keep pace with adversaries who design lockers for AI stacks, and how quickly will platforms shipping code-validation endpoints remediate CVE-2025-3248 and similar flaws? The Sysdig findings show the damage vector and cost equation; the next moves will be technical and procedural.
