Ransomware has a familiar script: it encrypts your files, drops a note, and demands payment for the key. A newly documented strain rewrites that script in a way worth paying attention to — not because it's about to land on your network next week, but because of what it signals about where attackers are looking now. As VentureBeat reported, this malware doesn't go after your documents. It goes after your AI model weights — and, oddly, it can barely collect a ransom for them.
The specific attack is niche. The signal is not. AI systems have quietly crossed a line: they've gone from being a tool you use to an asset an attacker will hunt. For mid-market business owners, that reframes a question most have never asked — what parts of your AI footprint would you actually lose if someone encrypted or destroyed them, and do you have a single backup of any of it?
Key Takeaways
- A new ransomware family called ENCFORGE, tied to a group tracked as JadePuffer, encrypts AI model weights, training data, and vector indexes instead of ordinary business files.
- It got in through a known, unauthenticated remote-code-execution flaw in Langflow — an open-source tool for building AI agents — not through a novel zero-day.
- Security researchers found no data-theft mechanism and no working payment infrastructure, so its leverage is purely destruction: encrypted production models that often can't be rebuilt from anything.
- The takeaway for most businesses is not panic — it's inventory. Your fine-tuned models, embeddings, vector stores, prompt libraries, and agent configs are now protected assets, and most firms have no backup or access control around them.
- Practical response: catalog your AI assets, back them up, isolate the credentials that reach them, and add them to your disaster-recovery plan.
What Is ENCFORGE, and Why Does It Target AI Model Weights?
The strain is called ENCFORGE, and it was documented by the Sysdig Threat Research Team as the payload of a group they track as JadePuffer — an actor that, per Help Net Security's reporting, has evolved from database extortion into deliberately targeting AI infrastructure. It's a compiled Go program, and its file-targeting list is the tell. According to The Hacker News, ENCFORGE targets roughly 180 file extensions chosen to sweep the modern machine-learning stack: PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors, ONNX-format models, the GGUF and GGML weight formats used by local inference engines, FAISS vector indexes, and training data in Parquet, Arrow, NumPy, and TensorFlow-record formats. There's even an operator flag to append custom file patterns, with the analysis noting examples like LoRA fine-tuning adapters and legacy weight files.
Under the hood it behaves like modern commodity ransomware. It uses AES-256 encryption with a per-run key wrapped under an embedded RSA-2048 public key, and — like LockBit and BlackCat before it — it encrypts selected regions of a file rather than the whole thing, a speed optimization that lets it corrupt large model files fast. It kills processes holding target files open, handles restarts without redoing finished work, and deletes itself when it's done. None of that is novel. What's novel is the target list: this is ransomware built, deliberately, to ruin AI assets.
How Did the Attackers Get In?
Here's the part that should reassure and worry you in equal measure: the entry point was not exotic. JadePuffer got in through CVE-2025-3248, a vulnerability in Langflow, an open-source framework for visually building AI agents and workflows. As documented by The Hacker News, the flaw exposes an /api/v1/validate/code endpoint without authentication in Langflow versions before 1.3.0, letting any remote attacker run arbitrary Python on the server. It carries a CVSS score of 9.8 — about as severe as vulnerabilities get — and CISA added it to its Known Exploited Vulnerabilities catalog back in May 2025.
In other words, this wasn't a nation-state zero-day. It was a publicly known, already-cataloged, unpatched flaw in an AI-development tool sitting on the internet. That fits a pattern we've written about before: AI security tools and infrastructure themselves becoming an attack surface. The more AI plumbing you stand up — agent builders, orchestration servers, inference endpoints — the more of it you have to patch and lock down like any other production system. And once inside, per Help Net Security, the actor behaved like a modern intruder: it harvested cloud keys, database credentials, and API tokens to reach internal services before deploying the ransomware. Notably, BleepingComputer characterized the intrusion as an “agentic” attack — the hands-on work was driven by an LLM-powered AI agent rather than a human operator at every step, a sign of where intrusion tradecraft is heading. That credential-harvesting step is exactly why zero-trust credential isolation for AI agents matters — an over-permissioned AI server is a skeleton key.
Why Can't This Ransomware Even Collect the Ransom?
This is the strangest and most instructive detail, and it's worth being precise about what's confirmed versus what's framing. VentureBeat's headline emphasizes that the malware “can't even collect the ransom.” The technical basis for that, as analyzed by Sysdig and reported by The Hacker News, is concrete: the recovered binary “has no exfiltration capability,” and researchers found no leak sites and no Tor payment portals — the ransom contact was merely an embedded email address. Its only leverage, in the analysts' words, is the encrypted data itself.
That combination is telling. Traditional ransomware crews build double-extortion machinery — steal the data, threaten to publish it, run a payment portal — because that's how they get paid. ENCFORGE has none of that scaffolding. Independent coverage from Infosecurity Magazine and GBHackers framed the tool as effectively designed to wipe AI models and training data, and Help Net Security noted earlier JadePuffer activity that destroyed a MySQL database and a configuration service outright. Whether ENCFORGE is a clumsy first attempt at monetizing AI-asset extortion or something closer to a destructive wiper wearing a ransomware costume, the practical outcome for a victim is the same: your models may be gone, and there may be nobody functional to pay even if you wanted to.
Spot-Check Note
The lesson buried in that weirdness is the important one. If an attacker can't even be bothered to build a way to collect on AI assets, and still targets them, it's because destroying them is valuable — or will be. That's a preview of a threat class, not the finished product.
What's the Real Signal Here?
Strip away the specifics and the story says one thing: your AI footprint is now part of your attack surface and your protected-asset inventory at the same time. For years, the security conversation around AI was about inputs and outputs — prompt injection, data leakage, hallucinated advice. This is different. This is about the AI system itself as a thing of value that can be locked up or wrecked.
Sysdig's threat researchers captured the stakes in a line that every operations leader should internalize: “For organizations building or operating AI infrastructure, the threat model has expanded. Encrypted business files can be restored from backups, but encrypted production models often cannot.” That's the whole game. A spreadsheet has a hundred copies; a model you spent months fine-tuning on your proprietary data may exist in exactly one place. We've watched this arc bend for a while now — from an AI model that went rogue and had to be actively contained to attackers who now treat the model files themselves as the prize. The common thread is that AI stopped being a feature bolted onto your business and became core infrastructure, with all the risk that implies.
What Counts as an AI Asset You Need to Inventory?
Most mid-market firms, if you asked them “what AI assets do you own?”, would shrug. That's the gap. Here's what actually belongs on the list — and what an attacker (or a bad drive failure) could take from you tomorrow:
| AI Asset | What It Is | Why Losing It Hurts |
|---|---|---|
| Fine-tuned models | Base models trained further on your data | Encodes months of work and proprietary data; often irreproducible |
| Embeddings & vector stores | Your documents turned into searchable AI memory | Powers RAG and search; rebuilding means re-ingesting everything |
| Training & reference datasets | Curated, cleaned data you feed the models | The expensive part of any AI project is the clean data |
| Prompt libraries & system prompts | The tuned instructions that make agents work | Represents real trial-and-error; leaks reveal how your AI thinks |
| Agent configurations | Tool access, workflows, and permissions | Defines what your AI can do and reach; a config is a set of keys |
The reason this matters isn't hypothetical ransomware — it's that almost none of these are backed up or access-controlled the way your accounting files are. They live on a developer's machine, in a SaaS tool's default storage, or on a single server nobody's imaged. This is the same maturity gap we keep flagging: the AI agent identity and IAM problem most IT teams have, where AI systems accumulate access and value without anyone assigning ownership, backup duties, or recovery plans. A formal AI security and governance framework is what turns that shrug into an inventory.
What Should a Fort Wayne Business Actually Do?
Let's be plain: no Northeast Indiana business is getting hit by AI-model-weight ransomware tomorrow. The specific threat is builder-facing and rare. So the honest advice isn't “buy panic insurance” — it's “do the boring inventory work now, because the signal is real even if the strain isn't at your door.”
For a mid-market firm in Fort Wayne, Auburn, or across DeKalb and Allen counties, that means four concrete moves. First, treat AI configs, weights, and data stores as tier-1 assets — the same category as your financial system and customer database, not an afterthought on someone's laptop. Second, back them up on the same schedule and to the same protected, offline-capable storage as everything else you'd cry over losing. Third, isolate the credentials that reach your AI infrastructure so a single compromised server doesn't hand over your cloud keys — a Secure AI Gateway that brokers and logs that access is the practical control. Fourth, add AI assets to your disaster-recovery plan so “restore the fine-tuned model” is a documented step, not a discovery you make mid-crisis. That's it. Inventory and isolation, not fear. The firms that quietly do this in 2026 will simply never have to find out the hard way what a single, un-backed-up production model was worth.
One caution on that second move: “backed up” has to mean more than a copy sitting on the same network the ransomware would reach. For model artifacts, that means versioned snapshots on immutable or offline-capable storage — the classic 3-2-1 approach (three copies, two media types, one kept off-site and unreachable from production) applied to weights, embeddings, and datasets, not just to documents. Encrypt-in-place ransomware like ENCFORGE is built to reach anything a compromised server's credentials can touch, so a backup that lives behind the same keys is a backup you may not actually have. And a backup you've never restored from is a hypothesis, not a plan — test a model-and-vector-store recovery on a schedule, so “restore the fine-tuned model” is a step you've walked before you ever need it.
Take Stock of Your AI Assets Before Someone Else Does
Cloud Radix helps Fort Wayne and Northeast Indiana businesses put real controls around their AI footprint — inventorying the models, data stores, and agent configs that quietly run your operation, and routing access to them through a Secure AI Gateway where credentials are isolated and every touch is logged. If you're standing up AI tools and no one has asked “what would we lose, and is it backed up?”, that's the conversation to have now, while it's a planning exercise instead of an incident. Reach out and let's build the inventory and close the gaps before they matter.
Frequently Asked Questions
Q1.Is ENCFORGE ransomware something my business needs to worry about today?
For most mid-market firms, not directly — the strain targets AI-development infrastructure like Langflow servers, which is builder-facing and relatively rare. The reason it's worth your attention is the trend it represents: attackers now treat AI models and data as targets. The right response is to inventory and back up your AI assets, not to panic about this specific malware.
Q2.How did the attackers break in?
Through CVE-2025-3248, a known, unauthenticated remote-code-execution flaw in Langflow versions before 1.3.0, which CISA had already flagged as actively exploited. It wasn't a novel zero-day. The lesson is that AI infrastructure needs the same patching discipline as any other internet-facing production system.
Q3.What exactly are "AI model weights," and why can't you just restore them?
Model weights are the trained parameters that make an AI model work — effectively the output of the training process. If you fine-tuned a model on your own proprietary data, those weights may exist in only one place. Unlike ordinary business files that have many copies, a production model that isn't backed up often can't be rebuilt without repeating the entire, expensive training process.
Q4.Why does the article say the ransomware can't collect the ransom?
That characterization comes from VentureBeat's reporting. The verifiable basis, from Sysdig's analysis, is that the malware has no data-theft capability, no leak site, and no payment portal — just an embedded email address. Whether it's a failed extortion attempt or effectively a destructive wiper, the practical result is the same: victims may have no working way to pay and no way to recover encrypted models.
Q5.What AI assets should we be backing up and protecting?
At minimum: fine-tuned models, embeddings and vector stores, curated training and reference datasets, prompt and system-prompt libraries, and agent configurations. These encode real work and real access, yet they're often stored on a single machine or in a tool's default storage with no backup or access control. Treat them as tier-1 assets alongside your financial and customer systems.
Q6.How does a Secure AI Gateway help against this kind of threat?
A gateway isolates and brokers the credentials that reach your AI systems, so a single compromised server can't hand an attacker the cloud keys and tokens needed to move deeper — the exact credential-harvesting step seen in this campaign. It also logs access, which turns 'who touched our models and when' into a question you can answer during an incident instead of guessing.
Q7.Should a Fort Wayne business self-host AI tools like Langflow?
It can make sense — self-hosting keeps data local and cuts per-token costs — but it also means you own the patching. This incident started with an unauthenticated flaw in an internet-exposed Langflow server that had a fix available for months. If your Northeast Indiana team runs its own AI agent builders or inference servers, treat them like any other production system: keep them patched, kept off the open internet where possible, and behind access controls.
Sources & Further Reading
- VentureBeat: venturebeat.com/security/new-ransomware-targets-ai-model-weights — New ransomware targets AI model weights and can't even collect the ransom.
- The Hacker News: thehackernews.com/2026/07/new-encforge-ransomware-targets-ai — New ENCFORGE ransomware targets AI model files in a Langflow RCE attack.
- Help Net Security: helpnetsecurity.com/2026/07/21/jadepuffer-encforge-ransomware — JadePuffer returns with ransomware built to target AI models and infrastructure.
- Infosecurity Magazine: infosecurity-magazine.com/news/jadepuffer-ai-model-ransomware — JadePuffer returns with ransomware designed to wipe AI models.
- BleepingComputer: bleepingcomputer.com/news/security/jadepuffer-agentic-attacks — JadePuffer agentic attacks now target AI model data with ransomware.
- GBHackers: gbhackers.com/jadepuffer-deploys-encforge-ransomware — JADEPUFFER deploys ENCFORGE ransomware built to destroy AI models and training data.
Inventory Your AI Assets Before an Attacker Does
Cloud Radix catalogs the models, data stores, and agent configs quietly running your operation, backs them up, and routes access through a governed, logged gateway — so “restore the fine-tuned model” is a step you've already walked.
