ENCFORGE Ransomware Targets AI Model Files

Originally published on CyberNetSec.

Executive Summary

Security researchers at Sysdig have discovered a new, highly targeted ransomware strain named ENCFORGE. Written in the Go programming language, ENCFORGE is specifically designed to encrypt files critical to Artificial Intelligence (AI) and Machine Learning (ML) development, such as model weights, vector indexes, and training data. The attack campaign is attributed to the threat actor JADEPUFFER, previously noted for its use of AI agents to automate offensive operations. The initial access vector was the exploitation of CVE-2025-3248, a critical unauthenticated remote code execution (RCE) vulnerability in the Langflow framework. This incident marks a dangerous evolution in threats, where ransomware is now being custom-built to cripple high-value AI development environments, representing a significant risk to organizations investing heavily in AI.

---

Threat Overview

JADEPUFFER, an actor distinguished by its use of AI for attack automation, has escalated its capabilities from reconnaissance and initial access to data destruction and extortion. The deployment of ENCFORGE ransomware demonstrates a clear intent to monetize access to compromised AI/ML environments. By targeting the core components of AI models, the attackers can cause severe disruption to development pipelines and potentially hold unique, irreplaceable intellectual property hostage.

The attack chain observed was:

1. Initial Access: The actor exploited CVE-2025-3248 in a public-facing, unpatched Langflow server. This vulnerability allows an unauthenticated attacker to execute arbitrary Python code via the /api/v1/validate/code endpoint.
2. Execution: Once code execution was achieved, the attacker deployed the ENCFORGE ransomware payload onto the compromised server.
3. Impact: The ransomware systematically searched for and encrypted files with extensions related to AI/ML models and data (e.g., .pt, .bin, .index), effectively destroying the victim's AI assets and demanding a ransom for their recovery.

Technical Analysis

The Vulnerability: CVE-2025-3248

The entry point was CVE-2025-3248, a critical (CVSS 9.8) RCE flaw in Langflow versions prior to 1.3.0. The vulnerability exists because the /api/v1/validate/code endpoint fails to properly sanitize user-supplied input before executing it in a Python environment. This allows an attacker to inject and run malicious Python code on the server.

It is critical to note that CISA has added other Langflow RCEs, CVE-2026-33017 and CVE-2026-55255, to its Known Exploited Vulnerabilities (KEV) catalog, indicating that this framework is a persistent and high-priority target for threat actors.

The Malware: ENCFORGE

ENCFORGE is a ransomware written in Go, a language chosen for its cross-compilation capabilities and networking features. Its targeting logic is specific, focusing on file types that are integral to AI/ML workflows. This specificity suggests the malware was custom-developed by or for JADEPUFFER for this type of operation. By encrypting model weights and training data, the attackers inflict maximum damage on an organization's AI capabilities, as these assets are often the result of significant computational and financial investment.

MITRE ATT&CK Techniques:

• T1190 - Exploit Public-Facing Application: Exploitation of CVE-2025-3248 in Langflow.
• T1059.006 - Python: The RCE vulnerability allows for arbitrary Python code execution.
• T1486 - Data Encrypted for Impact: The core function of the ENCFORGE ransomware.
• T1562.001 - Disable or Modify Tools: Ransomware often attempts to disable security software before encryption.

Impact Assessment

The impact of an ENCFORGE attack is severe and highly targeted. The primary impact is the loss of valuable intellectual property and the complete disruption of AI/ML development and operations. Re-training large models can be prohibitively expensive and time-consuming, if not impossible, without the original datasets. This can lead to:

• Significant financial losses due to ransom payments and recovery costs.
• Loss of competitive advantage.
• Delays in product development and deployment.
• Potential exposure of sensitive data used in training models if the attack evolves to include data exfiltration.

A critical takeaway is that patching the vulnerability is not sufficient. If credentials or API keys were accessible to the Langflow process, they must be considered compromised and should be rotated immediately.

IOCs — Directly from Articles

No specific file hashes, IP addresses, or domains were provided in the source articles.

Detection & Response

(D3FEND: File Analysis, Network Traffic Analysis)

1. Network Monitoring: Monitor web server logs for requests to the vulnerable endpoint /api/v1/validate/code on Langflow servers. Any access from untrusted sources should be investigated.
2. Endpoint Detection (EDR): On servers running Langflow, monitor for suspicious child processes spawned by the Langflow application. Look for processes related to network connections, file system enumeration, or the execution of unexpected binaries.
3. File Integrity Monitoring (FIM): Implement FIM on directories containing AI model weights and datasets. Configure alerts for rapid, widespread file modification or renaming, which is characteristic of ransomware activity.
4. Container Security: If Langflow is run in a container, monitor for anomalous container execution, such as a container attempting to mount sensitive host paths (e.g., the Docker socket) or creating new, unexpected containers.

Mitigation

(D3FEND: Software Update, Application Configuration Hardening)

1. Patch Immediately: Upgrade all Langflow instances to version 1.3.0 or later to remediate CVE-2025-3248. Given the KEV status of other Langflow flaws, organizations must maintain a strict patching cadence for this software. (M1051 - Update Software)
2. Rotate Credentials: Immediately rotate all secrets, API keys, and credentials that were accessible to the Langflow process. Assume they have been compromised. (M1027 - Password Policies)
3. Restrict Access: Do not expose Langflow instances directly to the public internet. Place them behind a firewall and VPN, and restrict access to authorized personnel only. (M1035 - Limit Access to Resource Over Network)
4. Principle of Least Privilege: Run the Langflow process with the minimum permissions necessary. If running in a container, do not grant it access to the underlying host's Docker socket or sensitive file systems. (M1048 - Application Isolation and Sandboxing)
5. Data Backups: Maintain offline, immutable backups of critical AI model files and datasets. This is the most effective defense against extortion.