New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack

Investigators at Sysdig linked a second attack on the same Langflow server to JADEPUFFER, an AI-driven operator first documented earlier this month.

The same operator has now been spotted using ENFORCEGo is a new hybrid ransomware designed to encrypt model weights, vector indexes, training datasets, and other AI infrastructure files throughout the host’s file system.

The entrance has not changed. Langflow versions prior to 1.3.0 expose i /api/v1/validate/code endpoint without authentication, which allows any remote attacker to execute arbitrary Python on the server. error, CVE-2025-3248has a CVSS score of 9.8 and was in CISA’s Known Exploited Vulnerabilities catalog as of May 5, 2025.

As Hacker News reported earlier this month, previous implementations used Python code to dump and MySQL AES_ENCRYPT() encryption function and data destruction in Nacos (Alibaba configuration server) and production data.

The new ENCFORGE installment replaces that advanced documentation with integrated tools aimed at model stores, vector databases, and training pipelines for the first campaign that swept for credentials.

ENCFORGE fee

The researchers returned the binary to the attacker’s command and control server, where it was encrypted as /.lockd; direct application to /lockd it returns 404, and the leading dot keeps it from being in an empty directory. The file is UPX 5.20-packed static Go 1.22.12 ELF.

The threat intelligence platforms did not return anything found in either the full or unpacked hash during Sysdig’s analysis. The name of the internal project is encfile; The binary error text refers to the named companion key tool keyforge. Both threads survive recompilation of the same codebase and act as stable anchors.

Its default extension list includes PyTorch and TensorFlow benchmarks, Hugging Face SafeTensors, the ONNX exchange format, GGUF (the current standard for locally implemented LLMs) and its predecessor GGML, FAISS vector indexes, Parquet and Arrow training datasets, NumPy arrays, and TensorFlow records.

An --include flag allows the operator to add additional file globs; The built-in help text uses LoRA programming adapters and legacy GGML weights as examples. The full list reaches about 180 extensions. Those examples point directly to areas of AI; a standard file locker would have little reason to name LoRA adapters or legacy GGML weights. Researchers have studied the choice as a deliberate targeting, not an accidental one.

ENCFORGE uses AES-256-CTR for file data, with each used symmetric key wrapped under an embedded RSA-2048 public key included in this structure. Instead of encrypting entire files, it encrypts selected regions, using the same speed as LockBit and BlackCat-class lockers.

Each processed file is renamed a .locked an extension. Binary kills processes that hold open files before encryption, re-hosts without re-encrypting completed files, drops ransom notes like README, HOW_TO_DECRYPTagain README_DECRYPTand deletes itself after startup.

The resulting ENCFORGE binary has no output capability. It has no communication code, cloud storage client, or mechanism, and the researchers found no evidence of a data leak, leaked site, or Tor payment portal during the sessions they observed. Its only advantage is encrypted data.

The fraud contact embedded in the ransom notes is e78393397@proton.methe same Proton Mail address used in the previous campaign. Sysdig describes this as the strongest link between the two functions.

The researchers disclosed one observed session, did not name the organization, and did not provide a number of victims or evidence of other ENCFORGE deployments.

From Langflow to Host

After verifying the code execution, JADEPUFFER swept the container for credentials and found a Docker socket in /var/run/docker.sock. Its first attempt to pull ENCFORGE from the GCP command and control server failed. Instead of standing still, it adapted.

Over five minutes and 24 seconds, the operator created and updated six Python scripts through the same Langflow RCE channel until it was functional on the host. The first script is built one line at a time, saving any request without a signature-based check.

Starting with the second, the operator encoded each full script in base64 and decoded it within the exec() call, to avoid shell-level searches for commands like base64 -d. The final version used the Docker API to wrap a special container with the host’s PID namespace and the root filesystem mounted, placed by the target process, copied with ENCFORGE using /proc//rootthen run it on the host with nsenter.

For all multipliers, containers are also built Privileged: true, PidMode: host, NetworkMode: hostand the root file system is read-write. That is the host root.

Before going live, the operator introduces --try-run to scan the file system, then --lock which goes beyond live encryption. The last script checked the status of the process, read the lock log, and counted the last files logged .locked.

The researchers did not publish the resulting figure; the evidence presented establishes a live encryption attempt, not how many models or dataset files have been successfully encrypted.

Sysdig checked the --task-id gcp_h1 flag as evidence that the operator has been tracking this host as a GCP target during a broad campaign; try to start at the beginning of the session using the task ID gcp_test. The report revealed no additional victims or referral sites.

Researchers wrote a previous JADEPUFFER campaign that fixed a failed Nacos login in 31 seconds. The same pattern held here against a more difficult problem: an operator created a host disconnect with an exposed Docker socket when his preferred delivery route was blocked.

Patch Langflow, Then Protect Models

The researchers estimate that reconstructing a production AI model once encrypted would cost between $75,000 and $500,000 per model in cloud computing GPU and engineering time.

A production environment often uses different special variants on shared storage, so a single run of ENCFORGE may encrypt multiple variants stored on the same accessible file system. If the training data resides on the same host, the organization must rebuild it before any retraining can begin.

Binary SHA-256: full 8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2; unpacked ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328.

Sysdig published the source and addresses of C2, the fingerprint of the RSA-2048 key, and the YARA rule in its full report.

• Upgrade Langflow to 1.9.1 or the latest supported release. Version 1.3.0 is closed CVE-2025-3248entry vector for this campaign, but CISA has since added two Langflow vulnerabilities to its KEV catalog: CVE-2026-33017unconfirmed RCE bug fixed in 1.9.0, added to KEV March 25, 2026; again CVE-2026-55255multi-user authentication bypass fixed in 1.9.1, added on 7 July 2026.
• Rotate AI provider keys, cloud credentials, database secrets, and any other tokens accessible to the Langflow process. Patching does not delete data already collected during the vulnerable period.
• Delete /var/run/docker.sock in any container we don’t need. When socket access is unavoidable, test it with a partially configured proxy; standard Langflow deployments generally do not need to create containers, and unrestricted Docker socket access should be considered a misconfiguration.
• Alert on application processes that call APIs to create Docker containers, which containers are launched Privileged: true or PidMode: hosthost root braces, and nsenter execution inside the container.
• Store model weights, vector indices, and training data sets in offline or immutable snapshots. Monitor those indicators extensively .locked file creation.

Hacker News contacted Sysdig’s Threat Research team to get more details about the scope of the campaign and the confidence of the attribute; Sysdig has not yet responded to the publication.

Model artifacts are now in the same recovery phase as the source code and production databases. An organization that can rebuild an operating system but cannot recover its weights, indicators, or training status does not have a clean path back.