New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack

Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator first documented earlier this month. The same operator has now been spotted deploying ENCFORGE, a new compiled Go ransomware designed to encrypt model weights, vector indexes, training datasets, and other AI infrastructure files across the host filesystem.

The entry point did not change. Langflow versions before 1.3.0 expose the /api/v1/validate/code endpoint without authentication, allowing any remote attacker to execute arbitrary Python on the server. The flaw, CVE-2025-3248, carries a CVSS score of 9.8 and has been in CISA’s Known Exploited Vulnerabilities catalog since May 5, 2025.

The ENCFORGE payload replaces improvised scripts with compiled tooling aimed at model stores, vector databases, and training pipelines. It uses AES-256-CTR for file data, with the per-run symmetric key wrapped under an embedded RSA-2048 public key. Rather than encrypting whole files, it encrypts selected regions, the same speed optimization LockBit and BlackCat-class lockers use. Each processed file is renamed with a .locked extension.

The binary kills processes holding files open before encrypting, handles restarts without re-encrypting completed files, drops ransom notes as README, HOW_TO_DECRYPT, and README_DECRYPT, and deletes itself after running. The recovered ENCFORGE binary has no exfiltration capability. Its only leverage is the encrypted data.

After confirming code execution, JADEPUFFER swept the container for credentials and found the Docker socket at /var/run/docker.sock. Over five minutes and 24 seconds, the operator created and revised six Python scripts through the same Langflow RCE channel until it had a working path to the host. The final version used the Docker API to spin up a privileged container with the host PID namespace and root filesystem mounted, located the target process, copied ENCFORGE through /proc//root, then ran it on the host via nsenter.

Researchers estimate that rebuilding a production AI model once it has been encrypted could cost between $75,000 and $500,000 per model in cloud GPU compute and engineering time. Production environments often run multiple specialized variants on shared storage, so a single ENCFORGE run could encrypt multiple variants stored on the same accessible filesystem.

Upgrade Langflow to 1.9.1 or a current supported release. Version 1.3.0 closed CVE-2025-3248, but CISA has since added two more Langflow vulnerabilities to its KEV catalog: CVE-2026-33017 and CVE-2026-55255. Rotate AI provider keys, cloud credentials, database secrets, and any other tokens accessible to the Langflow process. Remove /var/run/docker.sock from any container that does not require it. Keep model weights, vector indexes, and training datasets in offline or immutable snapshots.