# JADEPUFFER

Agentic ransomware operator (LLM-driven) · First documented July 1, 2026

## Overview

JADEPUFFER is the name the Sysdig Threat Research Team gave to what it assesses as the first documented ransomware operation driven end-to-end by a large language model, with no human operator at the keyboard for the intrusion or the extortion itself. [Sysdig published the initial findings on July 1, 2026](https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion), describing an agentic threat actor, or ATA: an operator whose attack capability is delivered by an AI agent rather than a human-driven toolkit or a fixed exploit script.

The operator gained initial access by exploiting CVE-2025-3248, an unauthenticated remote code execution flaw in the code-validation endpoint of Langflow, an open-source framework for building LLM applications. CISA added the flaw to its Known Exploited Vulnerabilities catalog in May 2025. From that single foothold, the LLM agent autonomously chained reconnaissance, credential harvesting, lateral pivoting to a separate production server, and a destructive database-extortion playbook against Alibaba Nacos and MySQL, encrypting more than 1,300 configuration records with a key it printed once and never stored.

On July 20, 2026, [Sysdig reported that JADEPUFFER had returned to the same Langflow instance](https://www.sysdig.com/blog/jadepuffer-evolves-the-agentic-threat-actor-deploys-ransomware-built-to-destroy-ai-models) with a materially upgraded payload. Where the first campaign used improvised Python and a database's own encryption function, this campaign staged ENCFORGE, a compiled Go ransomware binary purpose-built to destroy AI and machine learning artifacts: model checkpoints, vector indices, and training datasets across roughly 180 file extensions. The extortion contact embedded in the binary matches the contact from the first campaign, tying both operations to the same actor.

**Why this matters for defenders:** JADEPUFFER's kill chain runs almost entirely through cloud-native and container infrastructure rather than a Windows desktop. Its significance is not a new exploit or a novel encryption trick. Sysdig is explicit that none of the individual techniques were sophisticated. What is new is that an LLM agent strung ordinary techniques, a known CVE, a documented Nacos auth bypass, a Docker socket escape, into a complete, self-correcting extortion operation without a skilled human directing each step. That lowers the skill floor for running this class of attack to whatever it costs to operate an agent.

**Verify before relying on this:** Sysdig has not disclosed how many distinct victim environments have been hit, or whether other Langflow deployments have been targeted by the same operator outside the two documented sessions. Treat JADEPUFFER as a single tracked operator with two published campaigns, not a widespread ransomware-as-a-service family.

### Threat profile

| Details | Value |
|---|---|
| Type | Agentic ransomware |
| First seen | Jul 2026 |
| Payload | ENCFORGE / lockd |
| Extortion model | Single (no leak site) |
| Documented by | Sysdig Threat Research Team |
| Entry vector | CVE-2025-3248 (Langflow RCE) |
| Primary targets | Internet-facing Langflow / AI orchestration hosts |
| Downstream targets | MySQL, Alibaba Nacos, Docker hosts, model storage |
| Related tooling | encfile (project name) · keyforge (keygen) |
| Contact (both campaigns) | e78393397[@]proton[.]me |

## Operational attack chain

### Langflow-to-ENCFORGE

1. **Langflow RCE**
   - CVE-2025-3248, unauthenticated.
2. **Host fingerprint and credential sweep**
   - Agent-driven, self-narrating, runs in parallel.
3. **MinIO / cron persistence**
   - Default credentials, 30-minute beacon via crontab.
4. **Pivot to Nacos / MySQL**
   - Authentication bypass and backdoor administrator inserted.
5. **Docker socket escape**
   - Privileged container, host bind, `nsenter`.
   - MITRE ATT&CK: `T1611`
6. **ENCFORGE staged**
   - Copied across namespace via the `/proc` filesystem.
7. **AI / ML asset encryption**
   - Approximately 180 extensions, AES-256-CTR and RSA-2048.
8. **Anti-recovery and ransom note**
   - `vssadmin` / `bcdedit` calls, process kill list, self-delete.
   - MITRE ATT&CK: `T1486`, `T1490`

The first campaign stopped at database-level extortion inside MySQL and Nacos. The second campaign, three weeks later, escalated to a compiled locker and a host-level filesystem sweep on the same entry point. None of the individual techniques required defeating a hardened environment; the novelty is that an LLM agent chained them end-to-end without human direction.

Source: Sysdig Threat Research Team, July 1 and July 20, 2026

## Tactics, techniques, and procedures

JADEPUFFER maps across eleven of fourteen MITRE ATT&CK Enterprise tactics, spanning Initial Access through Impact, without a single sophisticated technique among them. The density comes from an agent that chained ordinary tradecraft end to end, not from a novel exploit chain.

### MITRE ATT&CK coverage

| Tactic | Observed techniques |
|---|---|
| Reconnaissance | 0 |
| Resource Development | 0 |
| Initial Access | 1 |
| Execution | 2 |
| Persistence | 1 |
| Privilege Escalation | 1 |
| Defense Evasion | 3 |
| Credential Access | 2 |
| Discovery | 3 |
| Lateral Movement | 1 |
| Collection | 1 |
| Command and Control | 1 |
| Exfiltration | 0 |
| Impact | 3 |

### Technique detail

| Tactic | Techniques | Observed behavior / defender telemetry |
|---|---|---|
| Initial Access | [Exploit Public-Facing Application T1190](https://attack.mitre.org/techniques/T1190/) | Unauthenticated Python execution via Langflow's `/api/v1/validate/code` endpoint (CVE-2025-3248). Telemetry: web access logs against that path, WAF rules for code-validation endpoints, CISA KEV alerting. |
| Execution | [Python T1059.006](https://attack.mitre.org/techniques/T1059/006/); [Container Administration Command T1609](https://attack.mitre.org/techniques/T1609/) | Base64-encoded Python delivered through the RCE sink; Docker Engine API calls issued from that same application process. Telemetry: subprocess creation under the web app's process owner, Docker API call logs. |
| Persistence | [Scheduled Task/Job: Cron T1053.003](https://attack.mitre.org/techniques/T1053/003/) | Crontab entry on the Langflow host beaconing outbound every 30 minutes. Telemetry: crontab modification events, recurring outbound connections at a fixed interval from an application host. |
| Privilege Escalation | [Escape to Host T1611](https://attack.mitre.org/techniques/T1611/) | Located the exposed Docker socket, created a privileged container with the host root filesystem bind-mounted and PID namespace shared, then used `nsenter` to cross into the host namespace. Telemetry: Docker API create/start calls with `Privileged:true` and `PidMode:host`. |
| Defense Evasion | [Obfuscated Files T1027](https://attack.mitre.org/techniques/T1027/); [Deobfuscate / Decode T1140](https://attack.mitre.org/techniques/T1140/); [Masquerading T1036](https://attack.mitre.org/techniques/T1036/) | ENCFORGE is UPX-packed and returned zero AV detections on both packed and unpacked samples at time of analysis. Later payloads switch to inline base64 decode inside an `exec()` sink rather than shell-level `base64 -d`. A staged CPython copy uses a Unicode homoglyph—a mathematical pi character prefixing "thon"—to defeat naive filename matching. |
| Credential Access | [Credentials in Files T1552.001](https://attack.mitre.org/techniques/T1552/001/); [Valid Accounts T1078](https://attack.mitre.org/techniques/T1078/) | Swept for LLM provider keys, cloud credentials, wallet seed phrases, and database configs; fetched `credentials.json` and `.env` from a default-credential MinIO instance; forged a Nacos session using its long-documented default JWT signing key and inserted a backdoor admin account directly into the Nacos database. |
| Discovery | [System Information T1082](https://attack.mitre.org/techniques/T1082/); [Network Service Discovery T1046](https://attack.mitre.org/techniques/T1046/); [Container and Resource Discovery T1613](https://attack.mitre.org/techniques/T1613/) | Immediate host fingerprinting on execution; internal address-space and service scanning from the Langflow host; Docker API queries to enumerate running containers and discover the host PID before staging the escape. |
| Lateral Movement | [Exploitation of Remote Services T1210](https://attack.mitre.org/techniques/T1210/) | Pivoted from the Langflow host to a separate internet-exposed MySQL and Alibaba Nacos server using MySQL root credentials, then exploited the Nacos authentication-bypass family (CVE-2021-29441). |
| Collection | [Data from Local System T1005](https://attack.mitre.org/techniques/T1005/) | Dumped Langflow's own backing Postgres database, staged the output to local files, reviewed it, then deleted the staging files, a cleanup step a fixed script rarely bothers with. |
| Command and Control | [Web Protocols T1071.001](https://attack.mitre.org/techniques/T1071/001/) | Cron-driven HTTP beacon to attacker infrastructure; ENCFORGE binary and a staged CPython interpreter fetched over plain HTTP from a GCP-hosted server. |
| Impact | [Data Encrypted for Impact T1486](https://attack.mitre.org/techniques/T1486/); [Inhibit System Recovery T1490](https://attack.mitre.org/techniques/T1490/); [Service Stop T1489](https://attack.mitre.org/techniques/T1489/) | Campaign one encrypted Nacos configuration rows in place. Campaign two's ENCFORGE binary encrypts approximately 180 AI/ML file types, invokes Windows `vssadmin.exe` and `bcdedit.exe` anti-recovery calls, and kills processes holding file locks before encrypting. |
| Reconnaissance / Resource Development / Exfiltration | — | No pre-attack reconnaissance or infrastructure staging was observed prior to the initial exploit. Sysdig found no exfiltration capability, no outbound data channel, and no leak site in the ENCFORGE binary itself. |

### Stage 1: How the attack starts

JADEPUFFER does not rely on a lure, a phishing email, or a user clicking anything. Entry is a single unauthenticated HTTP request to Langflow's code-validation endpoint, `/api/v1/validate/code`, which Sysdig identifies as a missing-authentication flaw tracked as CVE-2025-3248. The endpoint exists so Langflow can check that a user-submitted code snippet is syntactically valid before wiring it into an agent workflow. Because it never checks who is submitting the code, an attacker gets arbitrary Python execution on the host with no credential of any kind.

Langflow is an attractive target for reasons beyond the bug itself. It is a widely deployed open-source framework for building LLM applications, and deployments remain exposed on many internet-facing servers. Because these servers exist to orchestrate connected AI services, they frequently hold LLM provider API keys, cloud credentials, and connections to vector databases and object stores directly in their runtime environment, and they are often stood up quickly without network controls. CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities catalog in May 2025, and it remained JADEPUFFER's entry vector across both documented campaigns.

Every payload in both campaigns was delivered the same way: as base64-encoded Python submitted through this single RCE channel. There is no dropped installer, no macro, no clipboard trick. The entire operation runs through one endpoint on one application.

### Stage 2: What runs on the endpoint

Immediately after gaining execution, the agent fingerprints the host: user context, kernel and OS version, hostname, network interfaces, and the running process list. It then sweeps the environment in parallel for secrets across several categories at once: LLM provider API keys across multiple vendors, cloud provider credentials with explicit coverage of Chinese cloud environment-variable prefixes alongside AWS, GCP, and Azure, cryptocurrency wallet and seed-phrase material, and database connection strings.

It then dumps Langflow's own backing Postgres database, harvesting stored credentials and user records to local files, reviews them, and deletes the staging files. From there it probes the internal address space and, on finding a responsive MinIO object-store API, authenticates with the well-known default credential pair and works through a full bucket-enumeration playbook: listing every bucket, prioritizing one named for Terraform state and an internal configuration bucket, then fetching named credential files by path.

For persistence on this first host, it writes a single crontab entry that beacons outbound to attacker infrastructure every 30 minutes using nothing more than the Python standard library. In the second campaign, once a Docker socket was located, the same agent progressed to building a working container-escape pipeline in a live session, discovered the host process ID through the Docker API, copied the ENCFORGE binary across the container boundary through the host's `/proc` filesystem, and launched it directly on the host outside the original container's isolation. Every step, including recovery from a failed step, was generated and executed by the same agent in one continuous session.

### Stage 3: How the malware evades detection

The evasion in this operation is architectural rather than file-level obfuscation. Every payload arrives through the legitimate application's own code-execution surface, so there is no external dropper, no email attachment, and no suspicious download to flag at delivery. The application itself is the delivery mechanism.

ENCFORGE is packed with UPX and returned no detections from common threat-intelligence tools on either the packed or unpacked sample at the time Sysdig analyzed it. Within the RCE session, the agent's technique matured across iterations: an early script built its logic one inert line at a time to avoid tripping any single-request signature, then switched to a single-shot inline base64 payload decoded straight into an `exec()` sink, invisible to tooling that only searches for shell-level `base64 -d` patterns.

The clearest evasion artifact is a homoglyph. Alongside two normally named CPython interpreters, the operator's staging server hosted a third binary named with a Unicode mathematical pi character in place of the letter p, engineered to slip past filename checks such as `basename in ("python","python3")` or a process-kill command matching only the literal string. The Docker-socket escape is itself an evasion technique: rather than attempting anything detectable inside the constrained container, the agent built a privileged, host-mounted, one-shot container for each command and tore it down immediately after, minimizing the footprint any single artifact would leave.

### Stage 4: What it tries to access or modify

On the Langflow host, the objective is credentials and staging access: the MinIO object store's application data, backup, and machine-learning-artifact buckets, plus any `.env` or `credentials.json` files reachable from it. None of this is the final target; it is the means to reach a separate production database server.

On that second server, the agent modifies the Nacos configuration-service database directly: it inserts a backdoor administrator account into the users and roles tables, corrects the account when the first insertion attempt fails, then uses the resulting session to encrypt the service's configuration items in place using the database's own encryption function, drop the original and history tables, and replace them with an extortion table containing a payment demand.

In the ENCFORGE campaign, the target expands to the filesystem itself: roughly 180 extensions spanning model checkpoints and weights (PyTorch, TensorFlow, HuggingFace, llama.cpp formats), vector-index files, and columnar training-dataset formats. A command-line flag lets the operator append custom extensions per campaign, and the binary's own help text names LoRA fine-tune adapters and legacy model weights as the example, evidence the targeting is deliberately built around AI infrastructure. The compiled binary also carries Windows-specific anti-recovery code, literal invocations of `vssadmin.exe` and `bcdedit.exe`, indicating a Windows build exists or is planned even though the session Sysdig observed ran on Linux.

### Execution flow

#### What the kill chain looks like in process and API telemetry

```text
gunicorn / uvicorn (langflow) [web app process]
└─ python3 -c "exec(base64.b64decode(...))"
   Anomalous child of app process · T1059.006
   ├─ id / uname / hostname
   // host fingerprint · T1082
   ├─ curl / urllib → minio.internal:9000
   Default-credential bucket enumeration · T1552.001
   └─ crontab */30 * * * * python3 -c "urlopen(...)"
   Persistence · T1053.003

mysqld (production Nacos backend) [separate host]
└─ root session, external source
   Unscoped admin exposure
   ├─ INSERT INTO users/roles
   // backdoor admin, self-corrected on failure
   └─ SELECT ... INTO OUTFILE / LOAD_FILE
   docker.sock, /proc/1/cgroup escape pre-check

Docker Engine API [unix socket]
└─ POST /containers/create
   Privileged:true, PidMode:host, Binds:["/:/host:rw"]
   T1611
└─ nsenter --target 1 ...
   cp lockd across namespace via /proc
└─ lockd --lock --task-id gcp_h1
   // ENCFORGE live run
   ├─ vssadmin.exe / bcdedit.exe
   // anti-recovery calls (Windows build path) · T1490
   └─ *.gguf / *.safetensors / *.ckpt → *.locked
   T1486
```

## Where Malware Protection Plus fits

JADEPUFFER begins in compromised Linux and cloud infrastructure, but its ransomware activity can reach Windows endpoints through shared and mapped storage. [Malware Protection Plus](https://www.manageengine.com/malware-protection/) focuses on the Windows-side behaviors that become visible within this blast radius.

The key indicators include `vssadmin.exe` and `bcdedit.exe` used to disable recovery, malicious process termination, and mass file renaming to `.locked`. Malware Protection Plus can detect these behaviors, isolate affected endpoints, and provide process-lineage visibility for investigation and response.

The upstream Langflow compromise, Docker socket exploitation, and container-to-host activity require cloud workload, container runtime, and network security controls. Malware Protection Plus complements these layers by protecting the Windows endpoints where the attack becomes visible.

## Indicators of compromise

Durable indicators describe behavior that should persist across rebuilt infrastructure. Volatile indicators (IPs, hashes, contact addresses) are specific to the two documented campaigns and should be expected to rotate if the operator runs again.

### Process and API patterns

Behavioral chains that should recur regardless of infrastructure rebuild.

- `python3 -c "exec(base64.b64decode(...))" under a Langflow / uvicorn / gunicorn process owner`
  - RCE-channel execution pattern — entry vector indicator.
- `Docker API POST /containers/create with Privileged:true + PidMode:host`
  - Host-escape signature, high confidence.
- `nsenter --target 1 invoked from inside a container`
  - Namespace-crossing — not legitimate for application containers.
- `MinIO ListBuckets → GetObject(credentials.json / .env) using minioadmin:minioadmin`
  - Default-credential object-store enumeration.
- `crontab beacon: */30 * * * * python3 -c "urlopen(...)"`
  - Fixed-interval beacon persistence.
- `Mass *.locked creation in .gguf / .safetensors / .ckpt / .faiss / .parquet paths`
  - AI/ML-targeted encryption impact.

### Filesystem and ransom artifacts

Names and structures the operator has reused across builds and campaigns.

- `Ransom notes: README, HOW_TO_DECRYPT, README_DECRYPT`
  - ENCFORGE campaign — filesystem drop.
- `README_RANSOM extortion table inserted into targeted database`
  - First campaign — database-native extortion.
- `Internal project names: encfile (locker), keyforge (keygen companion)`
  - Toolchain identifiers — survive recompilation.
- `Deployed binary filename: lockd (staged under /tmp/.sk/)`
  - Observed session staging path.
- `Staged CPython copy with U+1D70B homoglyph in filename`
  - String-evasion tell — staged but not deployed in observed session.

### Network infrastructure

Useful now, not evergreen. Source live from Sysdig's published IOC lists for the most current values.

- `45.131.66[.]106 (AS49453, NL)`
  - First campaign source / cron beacon target (port 4444).
- `34.153.223[.]102:9191 (GCP)`
  - ENCFORGE and CPython delivery — second campaign C2.
- `e78393397[@]proton[.]me`
  - Extortion contact — same in both campaigns; strongest attribution link.

### Build-specific hashes

Tied to this exact compiled sample. Use as confirmation aids, not primary detection rules.

- `8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2`
  - SHA-256 — lockd (UPX-packed).
- `ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328`
  - SHA-256 — lockd (unpacked, Go 1.22.12).
- `2378bf45bb54fb2defc460063c9b43e09870741b62692b7f6acbc3cd7898bb3`
  - SHA-256 — embedded RSA-2048 public key DER; changes if the operator regenerates the keypair.

## Detection guidance

JADEPUFFER's own techniques were unremarkable individually. Detection here is about catching an unusual sequence, not a single novel signature: an application process spawning script interpreters, an application talking to the Docker socket, and a namespace boundary being crossed from inside a container. These are behavioral patterns that do not depend on knowing the operator is using an LLM.

1. ### Script interpreter execution under a web application process owner

   **What to monitor:** `python3`, `sh`, or similar interpreters spawned as a child of a Langflow, uvicorn, or gunicorn worker process, particularly with base64 or `exec()` patterns in the command line.

   **Why it works:** A legitimate code-validation call should never itself spawn a shell or a subprocess that reads secrets or writes to disk. This catches the entry vector regardless of the payload that follows.

2. ### Anomalous Docker socket access

   **What to monitor:** Any application process other than an orchestration system issuing calls against `/var/run/docker.sock`, especially `/containers/create` or `/containers/{id}/start`.

   **Why it works:** Langflow, like most application servers, has no legitimate reason to create containers. This is a near-zero-false-positive signal when scoped correctly to non-orchestration processes.

3. ### Privileged, host-bound container creation

   **What to monitor:** Container create requests combining `Privileged: true` with `PidMode: host` or a bind mount of the root filesystem (`/:/host`).

   **Why it works:** This combination has essentially no legitimate use case outside specialized system agents and is the direct signature of a container-escape attempt.

4. ### `nsenter` from inside a container

   **What to monitor:** `nsenter --target 1` or equivalent namespace-crossing calls issued from within a container process.

   **Why it works:** This deliberately crosses the isolation boundary the container exists to enforce. It is not an operation an application container should ever legitimately perform.

5. ### Default-credential object-store enumeration

   **What to monitor:** Sequential ListBuckets calls followed by targeted GetObject requests against files named `credentials.json` or `.env`, authenticated with a well-known default credential pair such as `minioadmin:minioadmin`.

   **Why it works:** This pattern of broad enumeration narrowing immediately to credential-named files is distinct from normal application read patterns and consistent across known JADEPUFFER behavior.

6. ### Mass encryption on AI / ML asset paths

   **What to monitor:** Rapid, bulk creation of `.locked`-suffixed files concentrated in directories holding model weights, vector indices, or training datasets. Alert separately on any process renaming more than a threshold of files within a short window.

   **Why it works:** The concentration on AI/ML-specific extensions, rather than a broad indiscriminate sweep, is itself a signal that the operator understands and is deliberately targeting AI infrastructure, not just running a generic locker.

7. ### Windows anti-recovery command execution

   **What to monitor:** `vssadmin.exe` shadow-copy deletion or `bcdedit.exe` boot-recovery changes executed by an unfamiliar or recently dropped binary, particularly on systems adjacent to model storage or backup targets.

   **Why it works:** Legitimate administrative use of these tools is infrequent and typically scripted through known change-management processes. Unscheduled invocation from a new process, particularly one originating outside normal deployment paths, is a strong ransomware indicator regardless of the initial compromise vector.

8. ### Fixed-interval beacon cadence

   **What to monitor:** Outbound connections recurring at a precise fixed interval, observed here at 30 minutes, from a cron-spawned process on an application server.

   **Why it works:** Human-driven or legitimate application traffic rarely produces this exact a cadence. Scheduled-task-driven beacons are a durable persistence tell even after the payload rotates, because the cron mechanism itself does not change.

## Hardening recommendations

Every JADEPUFFER campaign documented so far has depended on internet exposure and default configuration, not on defeating a hardened environment. **Quick win** means a single configuration change deployable in days. **Standard** means a rollout or architectural change deployable in weeks.

1. ### Patch Langflow and never expose code-validation endpoints to the internet

   **Critical**

   Update to a Langflow release that addresses CVE-2025-3248. The endpoint has been in CISA's Known Exploited Vulnerabilities catalog with a passed remediation deadline since May 2025. Patch status alone is insufficient: place Langflow and similar AI orchestration servers behind authentication and network access controls regardless of version.

   **Do:** Treat internet exposure of a code-execution endpoint as unacceptable regardless of patch status. Confirm that CVE-2025-3248 appears in your patch-management system and is closed on all managed Langflow instances.

2. ### Never expose a database admin account to the internet

   **Quick win**

   The downstream MySQL and Nacos server was reachable and accessible using root credentials from an external host. Enforce strong, unique credentials and source-IP restrictions on every database management port.

   **Do:** Confirm no production database accepts administrative logins from outside a defined management network. Audit this for MySQL, Nacos, Postgres, and any service that accepts remote admin connections.

3. ### Restrict Docker socket access

   **Standard**

   If `/var/run/docker.sock` must be reachable from an application container, scope it through a socket proxy that allows only the specific API calls the application actually needs. Langflow requires none.

   **Do:** Run application containers as non-root, and alert on any Docker Engine API call originating from a non-orchestration process. Remove the socket mount from application containers that do not require it.

4. ### Harden Nacos and similarly default-configured service-discovery platforms

   **Standard**

   Replace the default `token.secret.key` rather than shipping the documented value, upgrade to a release that forces a custom key, and never connect Nacos to its backing database as root.

   **Do:** Audit any Nacos, MinIO, or similar service still running with vendor-default credentials. Default-credential MinIO was directly exploited in both campaigns without any additional vulnerability.

5. ### Do not store provider API keys or cloud credentials in an AI orchestration runtime

   **Quick win**

   JADEPUFFER's first campaign confirmed these are harvested immediately upon gaining execution. Scope secrets to a dedicated secrets manager and away from web-reachable processes.

   **Do:** Audit and rotate any credential accessible to a Langflow process on any host that has run a vulnerable version. Treat LLM API keys and cloud credentials in application environments as compromised if CVE-2025-3248 has not been patched.

6. ### Maintain offline or immutable snapshots of production model artifacts

   **Standard**

   Encrypted business data can usually be restored from a backup. Encrypted model checkpoints, vector indices, and training datasets often cannot be reproduced without weeks of retraining. Sysdig estimates recovery costs between $75,000 and $500,000 per model.

   **Do:** Apply filesystem-level access controls to model weight directories so they are not world-readable from the web application process. Include model artifacts in backup and recovery planning alongside databases, with at least one copy that is offline or immutable.

None of the individual JADEPUFFER techniques required defeating a hardened environment. Controls 1 through 5 close the specific exposures the operator relied on across both documented campaigns. Control 6 limits the damage if a similar operator gains access through a different vector.

## Primary references

Source material this page is built on. Last reviewed against Sysdig Threat Research Team reporting through July 20, 2026.

- [Sysdig Threat Research Team — JADEPUFFER: Agentic ransomware for automated database extortion](https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion) — Jul 1, 2026
- [Sysdig Threat Research Team — JADEPUFFER evolves: the agentic threat actor deploys ransomware built to destroy AI models](https://www.sysdig.com/blog/jadepuffer-evolves-the-agentic-threat-actor-deploys-ransomware-built-to-destroy-ai-models) — Jul 20, 2026
- [Infosecurity Magazine — Researchers claim first fully agentic ransomware: JadePuffer](https://www.infosecurity-magazine.com/news/researchers-first-agentic/) — Jul 6, 2026
- [Infosecurity Magazine — JadePuffer returns with ransomware designed to wipe AI models](https://www.infosecurity-magazine.com/news/jadepuffer-ai-model-ransomware/) — Jul 20, 2026
- [MITRE ATT&CK — Enterprise framework reference](https://attack.mitre.org/) — Current