In a recent cybersecurity incident, researchers from Sysdig have identified a second attack on Langflow servers associated with the JADEPUFFER operator. This new attack involves the deployment of ENCFORGE, a newly developed ransomware written in Go, which specifically targets files related to artificial intelligence, such as model weights and training datasets.
Vulnerability Exploitation in Langflow
The vulnerability exploited in these attacks is found in Langflow versions prior to 1.3.0. This flaw, identified as CVE-2025-3248, allows unauthenticated remote code execution via the /api/v1/validate/code endpoint. The Common Vulnerability Scoring System (CVSS) rates this flaw at 9.8, indicating its severity, and it has been listed in CISA’s Known Exploited Vulnerabilities since May 2025.
ENCFORGE replaces rudimentary scripts with advanced compiled tools that focus on AI environments. Unlike previous attacks that used simple Python scripts, this campaign employs sophisticated methods to encrypt AI model files and related data.
Technical Aspects of ENCFORGE
Sysdig’s analysis reveals that the ENCFORGE ransomware is stored on a command-and-control server, disguised to evade detection. The binary, packed with UPX, is designed to encrypt specific file types prevalent in AI workflows, such as PyTorch checkpoints, TensorFlow records, and vector indexes.
ENCFORGE employs AES-256-CTR encryption, with a symmetric key wrapped under an RSA-2048 public key. This approach encrypts only parts of files to optimize speed, akin to strategies used by LockBit and BlackCat ransomware families. The absence of data exfiltration capabilities suggests that the primary leverage is the encrypted data itself.
Mitigation and Protection Strategies
Sysdig advises organizations to upgrade Langflow to the latest version and rotate credentials to prevent similar attacks. Reducing Docker socket exposure and monitoring application processes for suspicious activity are also recommended.
The financial implications of an attack can be severe, with rebuilding an encrypted AI model potentially costing between $75,000 and $500,000. Thus, safeguarding AI models and data through offline snapshots and regular monitoring is crucial.
Sysdig’s report underscores the need for robust security measures to protect AI infrastructure from such targeted ransomware attacks. The focus on AI-specific files indicates a deliberate strategy by attackers to maximize disruption and potential ransom payments.
