Ransomware Built to Destroy AI Models Just Hit the One File You Never Backed Up

Ransomware has always bet that you skipped your backups. This one targets the file you never backed up.

On July 20, 2026, the security firm Sysdig described a ransomware attack with an unusual target. The victim was not a database or a folder of invoices. It was a trained artificial-intelligence model, the kind of file that can cost between $75,000 and $500,000 to rebuild because there is no clean copy sitting in a drawer. You cannot re-download a model you fine-tuned over months. You have to train it again from scratch.

The attacker, which Sysdig calls JADEPUFFER, is what researchers now label an agentic threat actor: a person who points an AI agent at a target and lets the software carry out the break-in on its own, one step at a time. What that agent deployed this time is the detail worth understanding, because it was not off-the-shelf ransomware pressed into new service. It was built, from the file formats up, to destroy the assets that AI companies run on.

How the attack worked

The way in was an old, unglamorous flaw. Langflow is a popular open-source tool for building applications on top of large language models (LLMs, the AI systems behind chatbots and coding assistants). A vulnerability tracked as CVE-2025-3248 lets anyone reach one of its programming endpoints without logging in and run their own code on the server. It scores 9.8 out of 10 for severity and has sat on the US Cybersecurity and Infrastructure Security Agency's list of actively exploited bugs since May 2025. Langflow servers make a rich prize because they often hold the cloud keys and API credentials that wire an organisation's AI tools together.

Once inside, the agent behaved less like a fixed script and more like a live operator. It swept the machine for credentials, located the Docker socket (the control channel for the software containers a server runs), and tried to download its ransomware from a remote machine. The download failed. Rather than give up, the agent spent five minutes and twenty-four seconds writing and rewriting six versions of an escape program until one worked, each version correcting the error in the one before it. The finished script used the Docker control channel to spin up a container with full access to the host, copied the ransomware across, and launched it. That improvised problem-solving, at machine speed, is what separates an agentic attacker from a piece of malware that only knows one trick.

• The ransomware, named ENCFORGE, targets roughly 180 file types, with deliberate coverage of AI model checkpoints, Hugging Face SafeTensors weights, GGUF files used to run LLMs locally, and the FAISS databases that power AI search.
• Its command line includes an option to add more AI formats on the fly, with LoRA fine-tuning adapters offered as the built-in example. A generic file locker would have no reason to name them.
• No antivirus engine flagged the program at the time of analysis, and it carries no data-theft feature at all. It encrypts, drops a ransom note, and deletes itself.

Why it changes the calculation

Sysdig observed a single session and did not name a victim or publish how many files were encrypted, so read this as a demonstrated capability rather than a tallied loss. The weight of it sits in the target. For years the standard answer to ransomware has been simple: keep good backups and you can refuse to pay. That answer quietly assumes the encrypted thing can be recreated from a snapshot. A production model often cannot. Restoring last month's backup means forfeiting every training run since, and if the training data lived on the same server it is now encrypted too, so you rebuild the dataset before you can even begin retraining. If your organisation runs its own models, this is the moment those weight files stop being an engineering footnote and become the most valuable, least recoverable thing on your network. Notice too what ENCFORGE leaves out. Most ransomware crews now steal a copy of the data and threaten to leak it, because plain encryption lost its bite once companies learned to restore from backup. ENCFORGE skips the theft entirely. It is wagering that against an irreplaceable model, destruction on its own is leverage enough, and that wager is the real shift to watch.

What to do about it

1. Update Langflow to a current supported release. Version 1.3.0 closed the entry flaw, but two further Langflow bugs have joined the same government exploited-vulnerability list since, so move to 1.9.1 or later to shut the door the agent walked through.
2. Back up model weights, vector indexes, and training data to offline or immutable storage. Put model artifacts in the same recovery tier as your databases, because a backup the attacker cannot reach or overwrite is the one thing that turns an unrecoverable model into a bad afternoon.
3. Lock down and monitor the Docker socket. Remove it from any container that does not need it, and alert on privileged container creation or on nsenter running inside a container, because the whole host takeover depended on that single channel being reachable.

Bottom line

ENCFORGE is a reminder that a defence is only as strong as its assumptions, and the assumption under every backup policy is that you can rebuild what you lost. Trained models break that assumption. They cost six figures and months to produce, and until now almost nobody treated them as something a criminal might simply erase. Bring one question to your next security review. If every model file your company depends on were encrypted tomorrow morning, do you hold a copy an attacker could not touch, and how long would it take to claw back to where you stand today?