From JADEPUFFER to Multi-Agent Intrusions: The Next Wave of Autonomous Attacks

The report outlines two related high-impact incidents: ENCFORGE, a compiled Go ransomware campaign that escalated via an exposed Docker socket to gain root access and specifically targets AI/ML artifacts (model checkpoints, vector DBs, training data, embedding indices), and a separate Unit 42 investigation where a human operator used parallelized AI agents to map services, harvest credentials, compromise CI/CD and cloud access, and route orchestration through victim AI endpoints. Both incidents show advanced tactics against AI infrastructure with high recovery costs for rebuilding models and data, and evidence of agentic/automated attack frameworks.