Agentic ransomware changes the recovery target. Back up the model pipeline, not just the database.
Sysdig says JADEPUFFER moved from autonomous database extortion to ransomware targeting about 180 AI/ML file types. Recovery plans must treat model weights, training data, vector stores and embeddings as one restorable system.
On 20 July, Sysdig reported that JADEPUFFER had returned to a previously compromised Langflow environment with ENCFORGE, a Go ransomware payload targeting about 180 AI and machine-learning file extensions. The list spans model checkpoints, training datasets, vector databases and embedding indices.
The obvious reading is that ransomware has found a new file type. The operational change is larger: an AI service is recoverable only if the artefacts that make the model useful can be restored together. A database backup does not recreate a fine-tuned model, its training state, its vector index and the credentials or configuration needed to serve it.
The recovery unit is the pipeline
Sysdig first documented JADEPUFFER in July as an agentic operator that entered through CVE-2025-3248 in Langflow, harvested credentials, moved laterally and ran a destructive database-extortion sequence. Its follow-up says the same operator later deployed ENCFORGE against AI infrastructure and used a Docker socket path to reach the host.
For AI infrastructure, backup completeness is a dependency-graph property, not a storage-volume property.
That distinction matters because production AI state is distributed. Model weights may sit in object storage, vector indexes in a managed database, training data elsewhere, and serving configuration in a deployment repository. Protecting each component independently can still produce a recovery set that cannot be assembled into a working service.
RTO now includes reconstruction cost
Sysdig estimates that rebuilding a production-ready fine-tuned model can require weeks or months and between $75,000 and $500,000 in compute and engineering. Those figures are vendor estimates, but they expose the planning error: a conventional recovery-time objective that measures only infrastructure restoration can declare success while the model service remains unusable.
AI owners should therefore define recovery points across the full serving dependency graph. Immutable or offline copies should cover model weights and checkpoints, training and evaluation data, vector stores, embeddings, configuration and the metadata required to associate compatible versions. Restore tests should rebuild an isolated service from those artefacts rather than merely prove that files can be downloaded.
Reduce what an agentic intruder can reach
The entry path still matters. Sysdig recommends patching Langflow, removing unnecessary Docker socket mounts, restricting privileged container creation and keeping provider or cloud credentials away from web-reachable orchestration processes. Egress controls and scoped secrets reduce the paths an adaptive operator can explore after initial access.
The Monday change is to add AI artefacts to business continuity as a coordinated recovery set. Inventory which components are required to reproduce a production inference service, set recovery objectives for that set, keep at least one immutable copy outside the workload's administrative boundary, and rehearse restoration without production credentials. Agentic ransomware makes attack execution faster; fragmented recovery is what turns that speed into prolonged outage.
Sources
Written by the Devence Lab research team.
