JadePuffer Deploys ENCFORGE Ransomware to Destroy AI/ML Model Assets
What Happened — The JadePuffer threat actor resurfaced with a new Go‑based ransomware family, ENCFORGE, designed to encrypt AI/ML artifacts such as model checkpoints, vector databases, and training datasets. The campaign began with the exploitation of CVE‑2025‑3248 in an internet‑facing Langflow instance, followed by credential harvesting (cloud keys, DB strings, API tokens) and deployment of the ransomware against the downstream AI stack.
Why It Matters for Compliance & Audit Readiness
- ENCFORGE targets the very data protection controls (SOC 2 CC6.2 – Encryption, CC6.3 – Data Integrity) that organizations must demonstrate in a SOC 2 audit; a breach shows gaps in asset inventory and encryption coverage.
- The initial foothold leveraged a known, unpatched vulnerability and mis‑configured exposure, highlighting the need for continuous control mapping and evidence collection to prove “secure configuration” and “vulnerability management” (SOC 2 CC3.1, CC3.2).
- The attack’s use of stolen cloud credentials underscores the importance of robust access‑control policies and real‑time monitoring, which are core to maintaining a defensible audit trail.
Who Is Affected – Companies that develop, host, or consume AI/ML workloads (cloud providers, AI platform SaaS, data‑science teams).
Recommended Actions
- Map the Langflow and related AI orchestration components to SOC 2 control families (Configuration Management, Encryption, Access Controls).
- Deploy continuous vulnerability scanning and automated configuration compliance checks for all internet‑exposed AI services.
- Capture and retain evidence of credential rotation, key management, and incident‑response playbooks to satisfy audit evidence requirements.
Technical Notes – ENCFORGE encrypts ~180 file extensions, focusing on model checkpoints, vector stores, and training data. The initial vector was CVE‑2025‑3248 in Langflow; attackers also reused an older 2021 Nacos auth‑bypass and default signing keys. Source: Help Net Security