ENCFORGE AI ransomware targets model weights through Langflow flaw

ENCFORGE AI ransomware was deployed in July by the threat actor Sysdig tracks as JADEPUFFER after the group returned to the same exposed Langflow server it had breached weeks earlier. Sysdig’s Threat Research Team said the second intrusion used the same missing-authentication flaw, CVE-2025-3248, but swapped an earlier database-extortion payload for a compiled Go locker designed to damage AI assets.

The vulnerability sits in Langflow’s code-validation endpoint and allows remote Python execution when the server is reachable from the internet. Sysdig documented the first campaign on July 1 and the second on July 20. The attacker did not change the way in; it changed what it did after gaining execution.

What is ENCFORGE AI ransomware?

ENCFORGE is a ransomware binary that Sysdig says scans roughly 180 file extensions and explicitly includes AI model and data formats. Those include PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors, GGUF files used in local LLM deployments, FAISS vector indexes, Parquet and NumPy training data, plus LoRA adapters and older GGML weights.

That file list matters because generic ransomware can hit model weights incidentally when it encrypts a disk. ENCFORGE identifies them by name, which suggests the operator expected to land on machines used for AI development or deployment.

Sysdig said the binary uses AES-256-CTR with a per-run key wrapped in an embedded RSA-2048 key, encrypting parts of large files rather than full files so it can corrupt them faster. The company also said it found no outbound network capability, no leak site and no payment portal. Both ransom notes used the same Proton Mail contact, linking the campaigns to JADEPUFFER, but the locker itself could not exfiltrate data.

The first campaign also undermined its own ransom demand. Sysdig said that payload generated an encryption key at random, printed it to the console once and did not save it, making recovery through payment impossible on the evidence described.

Why do model weights change the recovery math?

A database snapshot can restore rows to a known point in time. A fine-tuned model may embody training work, evaluation cycles and parameter changes that are not replayable from a transaction log.

Sysdig estimated direct recovery for a production-ready fine-tuned model at $75,000 to $500,000, based on cloud GPU usage across training runs and the engineering work needed to reproduce a usable result. That estimate is per model, and Sysdig noted that organizations often keep multiple variants on shared storage. If the dataset is stored on the same host as the weights, rebuilding can be blocked as well.

Kayne McGladrey, an IEEE Senior Member focused on identity security, told VentureBeat that the issue should be framed as business risk because a destroyed model has a replacement cost a CFO can budget against. His point is practical: treating model artifacts as ordinary files can leave them outside tested backup and recovery plans.

How did the attacker get from Langflow to the host?

After gaining execution, the agent searched for cloud keys, API tokens and connection strings, then tested them against internal services, according to Sysdig. It also found the Docker socket at /var/run/docker.sock, a level of access that can amount to host control.

When a download from command-and-control infrastructure failed, the attacker did not stop. Sysdig said the agent produced six Python scripts through Langflow and reached a working host escape in five minutes and 24 seconds. The final script used the Docker API to find the host process ID, copied the ransomware across the namespace boundary, ran encryption and counted files to confirm execution.

Sysdig did not claim the whole operation was autonomous. TechCrunch previously reported that the earlier attack still required a person to select the target and set up infrastructure. The July campaign, as described, was human-directed with automated execution after compromise.

Why was this Langflow server still exposed?

CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities catalog on May 5, 2025, with a federal remediation deadline of May 26. Langflow fixed the issue in version 1.3.0. By the time JADEPUFFER returned in July 2026, the server was more than 14 months past the KEV listing and had already been publicly documented as compromised.

Sysdig said the first campaign also relied on older, routine weaknesses: a Nacos default signing key public since 2020, CVE-2021-29441, and MinIO credentials set to minioadmin:minioadmin. Across more than 600 payloads, Sysdig said the activity depended on known misconfigurations or patched bugs left reachable.

The Langflow exposure is broader than one host. VentureBeat previously reported that about 7,000 Langflow instances were internet-facing, many in North America, with access to provider API keys, cloud credentials and vector stores. CISA has listed five Langflow flaws in KEV, including CVE-2026-55255 on July 7 and CVE-2026-0770 on July 21.

For AI operators, the near-term work is basic and unglamorous: patch exposed Langflow servers to supported releases, remove Docker socket mounts from application containers, rotate credentials available to compromised hosts, and add model weights, vector indexes and training data to immutable, restore-tested backups. Sysdig also published a YARA rule and hashes for ENCFORGE, though it said the samples had no antivirus coverage at the time of analysis.

This story draws on original reporting from VentureBeat.