ENCFORGE Ransomware: Targeting AI Models Through Langflow Vulnerability
New ENCFORGE Ransomware Targets AI Model Files Through Critical Langflow Vulnerability
A newly discovered ransomware strain called ENCFORGE is actively encrypting AI model files by exploiting a critical remote code execution flaw in Langflow — and researchers warn that rebuilding a single compromised model could cost up to half a million dollars.
Cybersecurity researchers at Sysdig disclosed on July 21, 2026 that a threat actor tracked as JADEPUFFER has deployed ENCFORGE against at least one Langflow server, targeting AI infrastructure files including model weights, vector indexes, and training datasets. The attack exploits CVE-2025-3248, — a vulnerability carrying a CVSS score of 9.8 that has been in CISA's Known Exploited Vulnerabilities catalog since May 5, 2025.
This incident underscores a broader pattern: as organizations accelerate AI adoption, the security risks and operational challenges of deploying AI in business environments are expanding faster than many security teams anticipated.
What Makes ENCFORGE Different From Ordinary Ransomware
ENCFORGE is not a generic file locker repurposed for AI environments. It is purpose-built to hunt the file types that power modern AI systems — and that distinction matters enormously for organizations running production AI infrastructure.
The ransomware targets:
- PyTorch and TensorFlow checkpoints
- Hugging Face SafeTensors
- ONNX interchange files
- GGUF and GGML model formats used for locally deployed large language models
- FAISS vector indexes
- Parquet and Arrow training datasets
- NumPy arrays and TensorFlow records
Its default extension list covers approximately 180 file types in total. Researchers noted that the binary's built-in help text specifically references LoRA fine-tuning adapters and legacy GGML weights as examples of files the operator can append via an --include flag. As Sysdig researchers assessed, a generic file locker would have little reason to name those formats — the targeting is deliberate.
Technical Construction
Technically, ENCFORGE is a UPX 5.20-packed static Go 1.22.12 ELF binary. It uses AES-256-CTR encryption for file data, with the per-run symmetric key wrapped under an embedded RSA-2048 public key. Rather than encrypting entire files, it encrypts selected regions — the same speed optimization used by high-profile ransomware families like LockBit and BlackCat. Each processed file is renamed with a .locked extension.
The binary kills processes holding files open before encrypting them, handles restarts without re-encrypting completed files, and drops ransom notes under the filenames README, HOW_TO_DECRYPT, and README_DECRYPT. It then deletes itself after running.
No Exfiltration — Encryption Is the Only Lever
Notably, researchers found no exfiltration capability in the recovered binary. ENCFORGE carries no networking code, cloud storage client, or data staging mechanism. Its only leverage is the encrypted data itself. The extortion contact embedded in the ransom notes — e78393397@proton.me — matches the address used in JADEPUFFER's prior campaign documented earlier in July 2026. Sysdig describes this as the strongest attribution link between the two operations.
Understanding how ransomware works and why it remains one of the most damaging cyber threats is essential context here. ENCFORGE follows the established playbook of selective encryption for speed, while extending it into territory most ransomware operators have never targeted.
How the Attacker Broke Out of the Container to Reach the Host
The entry point remained unchanged from the prior JADEPUFFER operation. Langflow versions before 1.3.0 expose the /api/v1/validate/code endpoint without authentication, allowing any remote attacker to execute arbitrary Python on the server. CISA added CVE-2025-3248 to its KEV catalog in May 2025.
Credential Discovery and Adaptation Under Pressure
After confirming code execution, the operator swept the container for credentials and discovered the Docker socket at /var/run/docker.sock. When the initial attempt to pull ENCFORGE from the attacker's GCP command-and-control server failed, JADEPUFFER adapted rather than stopped.
Over five minutes and 24 seconds, the operator created and revised six Python scripts through the same Langflow RCE channel. The first script was built one line at a time to evade signature-based detection. Starting with the second script, the operator encoded each version in base64 and decoded it inside an exec() call — specifically to avoid shell-level detection of commands like base64 -d.
The Breakout Sequence
The final script used the Docker API to spin up a privileged container with the host PID namespace and root filesystem mounted. It located the target process, copied ENCFORGE through /proc/<pid>/root, then executed it on the host via nsenter. All containers during the breakout sequence were launched with:
Privileged: truePidMode: hostNetworkMode: host- Root filesystem bind-mounted read-write
Before the live encryption run, the operator launched ENCFORGE with a --try-run flag to scan the filesystem. The --lock flag triggered the live encryption pass. A --task-id gcp_h1 flag suggests the operator was tracking this host as one GCP target within a broader campaign; an earlier try-run used the task ID gcp_test.
Sysdig disclosed one observed session and did not name the affected organization. No victim count or evidence of additional ENCFORGE deployments was published.
What Organizations Running AI Infrastructure Must Do Now
Researchers estimate that rebuilding a production AI model after encryption could cost between $75,000 and $500,000 per model in cloud GPU compute and engineering time. Production environments frequently run multiple specialized model variants on shared storage — meaning a single ENCFORGE run can encrypt several simultaneously.
Patch Langflow Completely — Not Partially
Sysdig's remediation guidance is direct: upgrade Langflow to version 1.9.1 or a current supported release. Version 1.3.0 closed CVE-2025-3248, but CISA has since added two additional Langflow vulnerabilities to the KEV catalog:
- CVE-2026-33017 — an unauthenticated RCE flaw fixed in 1.9.0, added to KEV on March 25, 2026
- CVE-2026-55255 — a cross-user authorization bypass fixed in 1.9.1, added July 7, 2026
Running any version below 1.9.1 leaves at least one documented, actively catalogued attack vector open.
Rotate All Credentials Accessible to the Langflow Process
Organizations should rotate all AI provider keys, cloud credentials, database secrets, and any tokens accessible to the Langflow process. Patching alone does not revoke credentials already harvested through a vulnerable instance. This step is non-negotiable for any organization that cannot confirm its Langflow deployment was never exposed.
Remove the Docker Socket From Containers That Don't Need It
Removing /var/run/docker.sock from containers that do not require it is equally critical. A standard Langflow deployment has no legitimate need to create containers — unrestricted Docker socket access should be treated as a misconfiguration, not a default.
Security teams should configure alerts for:
- Application processes calling Docker container-creation APIs
- Containers launched with
Privileged: trueorPidMode: host - Host-root bind mounts
nsenterexecution originating from inside a container
Treat AI Model Files as Tier-One Assets
Model weights, vector indexes, and training datasets should be stored in offline or immutable snapshots with active monitoring for mass .locked file creation. As Sysdig concluded, model artifacts now belong in the same recovery tier as source code and production databases. An organization that can restore its application but not its weights or training data has no clean path back.
If an encryption event does occur, having a tested recovery plan in place before an incident is the difference between a contained disruption and a catastrophic loss. Reviewing the correct steps to take when responding to a ransomware attack should be part of every AI infrastructure team's incident preparedness planning — not something explored for the first time under pressure.
For further technical detail on the CVE-2025-3248 vulnerability and its exploitation history, CISA's Known Exploited Vulnerabilities catalog provides the authoritative public record of affected versions and required remediation actions.
Three Immediate Actions That Can Protect Your Organization
- Patch immediately and completely: Running Langflow 1.9.1 closes all three CVEs currently in CISA's KEV catalog for this platform — treating any one patch as sufficient leaves documented attack vectors open.
- Audit container configurations today: Searching your environment for containers running with
Privileged: trueor an exposed Docker socket costs nothing and removes the primary host breakout path JADEPUFFER used in this attack. - Treat AI model files as tier-one assets: Applying the same backup and immutability standards used for source code and production databases to model weights and training datasets provides the only reliable recovery option if ENCFORGE reaches your infrastructure.
