New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack

Security researchers at Sysdig have documented a second attack against the same Langflow server previously compromised by JADEPUFFER, the AI agent driven threat actor first identified earlier this month, and this time the operator has deployed something considerably more damaging than credential theft. The new payload, ENCFORGE, is purpose built ransomware designed specifically to destroy the model weights, vector indexes, and training data that make up an organisation's AI infrastructure.

The entry point has not changed from the earlier campaign. Langflow versions prior to 1.3.0 expose an API endpoint used for code validation without requiring any authentication, letting a remote attacker execute arbitrary Python directly on the server. That flaw, CVE-2025-3248, carries a CVSS score of 9.8 and has sat on CISA's Known Exploited Vulnerabilities catalogue since May 2025, which makes its continued exploitation more than a year later a genuine indictment of how slowly some organisations move on patching AI infrastructure tooling specifically, compared to how urgently they typically treat exposure in more conventional enterprise software.

What sets this second campaign apart is the deliberateness of the payload itself. Where JADEPUFFER's earlier operation relied on improvised, throwaway Python scripts to corrupt data inside configuration servers and production databases, ENCFORGE is a compiled Go binary with roughly 180 built-in file extension targets, covering PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors files, ONNX interchange format, GGUF and GGML weights used by locally deployed language models, FAISS vector indexes, and Parquet and Arrow training datasets.

The tool's own built-in help text uses LoRA fine-tuning adapters as an example of an additional target an operator might append, which researchers read as clear evidence the targeting is intentional rather than a generic file locker that happened to sweep up AI related files along the way. Encryption uses AES-256-CTR applied to selected regions of each file rather than full file contents, the same speed optimisation used by established ransomware families such as LockBit and BlackCat, allowing the tool to encrypt large model files considerably faster than a naive full-file approach would allow.

The operator's behaviour during the intrusion is arguably as notable as the payload itself. After gaining initial code execution, the attacker discovered the container's Docker socket and, when its first attempt to pull the ENCFORGE binary from its command and control server failed, spent just over five minutes iteratively rewriting and testing six separate Python scripts through the same vulnerable Langflow endpoint until it found a working path to break out of the container entirely and reach the underlying host.

The final working script used the Docker API to spin up a fully privileged container with host process namespace access and the host's root filesystem mounted read-write, then used that access to copy and execute ENCFORGE directly on the host itself. Sysdig's researchers noted this mirrors a pattern from the earlier JADEPUFFER campaign, where the same operator corrected a failed login attempt against a different target in just 31 seconds. Whatever is driving this operation, whether an unusually persistent human operator or a genuinely autonomous agentic loop, it does not appear to give up when a first approach fails, and it iterates toward a working exploit path considerably faster than most manual attackers would.

The financial exposure here is not abstract. Sysdig estimates that rebuilding a single production AI model once its weights have been encrypted can cost between 75,000 and 500,000 dollars in cloud GPU compute and engineering time, and many organisations run multiple specialised model variants on shared storage, meaning a single successful ENCFORGE run could realistically encrypt several production models in one pass.

If training data sits on the same accessible filesystem, an organisation may need to reconstruct that data before retraining can even begin, extending both the cost and the timeline of recovery considerably beyond what a typical ransomware incident involving conventional business files would involve.

The practical guidance out of this disclosure is straightforward even if the underlying threat is not. Organisations running Langflow need to move to version 1.9.1 or later immediately, since CISA has since added two further Langflow vulnerabilities to its exploited catalogue beyond the original flaw this campaign relies on. Patching alone does not revoke credentials or API keys already harvested through a vulnerable instance, so any AI provider keys, cloud credentials, or database secrets accessible to the Langflow process should be rotated regardless of patch status.

Docker socket access should be removed from any container that does not genuinely need it, and where it cannot be removed entirely, it should sit behind a narrowly scoped proxy rather than being exposed directly, since a standard Langflow deployment has no legitimate reason to be creating its own containers. Catching this kind of intrusion in progress, rather than discovering it only after the encryption has run, is exactly the gap continuous, around the clock monitoring is designed to close for organisations that cannot sustain that level of detection capability entirely in-house.

Perhaps most importantly, model weights, vector indexes, and training datasets now belong in the same backup and recovery tier organisations already apply to source code and production databases, precisely the kind of non-human identity and agentic AI governance gap that KPMG's Cybersecurity Considerations 2026 report has flagged as one of the defining enterprise security priorities this year. An organisation that can rebuild its application layer but has no clean, offline copy of the models and data underneath it has no real route back from an incident like this one.