JadePuffer's EncForge Ransomware Targets AI Training Data and Model Checkpoints

A New Ransomware Class Aims at Your AI Infrastructure

The JadePuffer threat group has deployed a custom ransomware strain called EncForge, specifically engineered to encrypt AI assets rather than traditional business data. According to BleepingComputer's reporting, EncForge targets training datasets, vector databases, and model checkpoints — the three artifacts that are most expensive and time-consuming to recreate in any ML operation.

What makes this escalation notable is the delivery mechanism: JadePuffer operates as an autonomous AI agent, meaning it can navigate infrastructure, identify AI-relevant file paths and database endpoints, and execute the encryption campaign with minimal human direction. This is not script-kiddie ransomware dropped via phishing. It is an agentic attacker that probes, reasons, and adapts.

Why This Is a Bigger Problem Than Ordinary Ransomware

Most ransomware contingency plans were designed around encrypting file servers and business applications. AI infrastructure breaks those assumptions in two ways.

First, recovery cost is asymmetric. Restoring a file server from backup takes hours. Reconstructing a training dataset that was assembled from scraped, licensed, or proprietary sources — and then retraining a model from scratch — can take weeks and cost six figures or more. If backups of training data are not explicitly scoped in your DR plan, you probably don't have them at the granularity you need.

Second, vector databases sit in a blind spot. Most organizations have mature backup cadences for relational databases but treat vector stores (Pinecone, Weaviate, Qdrant, pgvector instances, Chroma) as ephemeral infrastructure that can be re-indexed. EncForge targets exactly this assumption. If your vector store is encrypted and the source documents are also compromised, re-indexing is not an option.

Model checkpoints stored in blob storage (S3, GCS, Azure Blob) are equally exposed if storage credentials live on the same training host or are accessible to the same service account.

What to Do Right Now

Audit your backup coverage today. Confirm that training datasets, model checkpoints, and vector database snapshots are included in scheduled backups, that those backups are tested, and that at least one backup copy is stored in an account or location the training host cannot write to directly (immutable object storage or a separate cloud account).

Isolate training infrastructure. AI training hosts should not have outbound internet access beyond what your pipeline explicitly requires. Agentic attackers depend on lateral movement and outbound C2; network segmentation significantly raises the cost of the attack.

Apply least privilege to storage. The service account your training pipeline uses to write checkpoints to blob storage should not have the ability to delete or overwrite existing objects. Enable object versioning and MFA-delete on S3-compatible buckets that hold model artifacts.

Monitor vector database access. Unusual bulk-read or bulk-delete operations against your vector store are a signal. If your vector database does not have audit logging enabled, turn it on now.

Treat model registry access as privileged. Credentials that can overwrite or delete production model checkpoints should be managed the same way you manage production database credentials — rotated regularly, stored in a secrets manager, not embedded in CI configs.

JadePuffer is an early signal of a threat category that will grow. Organizations that have invested heavily in AI infrastructure without updating their security posture to match are the obvious targets.