bleeping-computer · Crawled Jul 20, 2026
JadePuffer agentic attacks now target AI model data with ransomware
2 IoCs 1 CVEs
Read original article ↗
AI Summary
The JadePuffer agentic threat actor has evolved to target AI/ML infrastructure using custom ransomware named EncForge, which encrypts critical AI assets such as model checkpoints, training datasets, and vector databases. The attack leverages autonomous decision-making to adapt in real time, deploying Python scripts to deliver the Go-based EncForge payload after gaining root access via an exposed Docker socket. The ransomware uses AES-256 and RSA-2048 encryption, appends '.locked' to encrypted files, and leaves a ransom note, though no data exfiltration was observed.
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 2 extracted
MITRE ATT&CK TTPs 27 techniques
T1021 Remote Services · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1053.003 Cron · Execution T1055 Process Injection · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1059.004 Unix Shell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1070.001 Clear Windows Event Logs · Defense Evasion T1071.001 Web Protocols · Command And Control T1075 T1075 T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1105 Ingress Tool Transfer · Command And Control T1133 External Remote Services · Persistence T1190 Exploit Public-Facing Application · Initial Access T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1210 Exploitation of Remote Services · Lateral Movement T1485 Data Destruction · Impact T1486 Data Encrypted for Impact · Impact T1490 Inhibit System Recovery · Impact T1499 Endpoint Denial of Service · Impact T1505.003 Web Shell · Persistence T1552 Unsecured Credentials · Credential Access T1619 Cloud Storage Object Discovery · Discovery