Ransomware attacks have traditionally relied on human operators This article explores encforge ransomware designed. . However, automated ransomware scripts were still written ahead of time.
An affiliate known as TOXMAN allegedly ran PENTEST LAB, a 14-agent framework used for vulnerability research, CVE validation, credential creation, and attack playbook generation. Researchers at Sysdig documented an operation called JADEPUFFER in July 2026, describing it as the first confirmed case of an AI agent executing a complete extortion campaign without direct human intervention. Researchers discovered that the agent corrected a failed login attempt in about 31 seconds, created a backdoor account, encrypted over 1,300 Nacos configuration records, deleted original data, and left a ransom note.
Later activity linked to the campaign reportedly introduced ENCFORGE, a ransomware designed to destroy AI and machine-learning assets such as model checkpoints, vector databases, and training data. Autonomous agents can test options continuously, correct errors swiftly, and execute multiple intrusion stages faster than a human-operated ransomware affiliate, Socradar stated. Indicators of Compromise IOC Type Indicator Context / Detection Use Threat actor / campaign JADEPUFFER AI-driven extortion campaign targeting Langflow, database services, and AI/ML infrastructure Initial-access vulnerability CVE-2025-3248 Langflow unauthenticated remote code execution flaw affecting the /api/v1/validate/code endpoint Join 16,000+ SOC teams using ANY.RUN to enhance threat investigation efficiency and minimize manual workload.
