ENCFORGE Ransomware Hits AI Model Files via Langflow RCE Flaw

Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, an AI-agent-driven operator first documented earlier this month. The same threat actor has now been observed deploying ENCFORGE, a new compiled Go ransomware engineered to encrypt model weights, vector indexes, training datasets, and other AI infrastructure files across the host filesystem. The entry vector remained unchanged: Langflow versions prior to 1.3.0 expose the /api/v1/validate/code endpoint without authentication, enabling any remote attacker to execute arbitrary Python on the server. The flaw, tracked as CVE-2025-3248, carries a CVSS score of 9.8 and has been listed in CISA's Known Exploited Vulnerabilities catalog since May 5, 2025. While the earlier JADEPUFFER campaign used throwaway Python scripts and MySQL's AES_ENCRYPT() function to destroy data in Nacos configuration servers and production databases, ENCFORGE replaces those improvised payloads with purpose-built compiled tooling aimed squarely at model stores, vector databases, and training pipelines.

The ENCFORGE binary was retrieved from the attacker's command-and-control infrastructure, where it was concealed as /.lockd; a direct HTTP request to /lockd returns 404, and the leading dot keeps it hidden from plain directory listings. The file is a UPX 5.20-packed static Go 1.22.12 ELF, and at the time of Sysdig's analysis, no threat intelligence platforms produced detections for either the packed or unpacked hash. Internal project strings reveal the name encfile, while error text references a companion keygen tool named keyforge — both strings survive recompilation and serve as stable detection anchors. ENCFORGE's default extension list explicitly targets PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors, ONNX interchange files, GGUF and legacy GGML weight formats, FAISS vector indexes, Parquet and Arrow training datasets, NumPy arrays, and TensorFlow records. An --include flag lets the operator append custom globs, with built-in help text citing LoRA fine-tuning adapters and legacy GGML weights as examples — a deliberate selection that points unmistakably at AI environments rather than generic enterprise file locking.

Technically, ENCFORGE uses AES-256-CTR to encrypt file data, wrapping each per-run symmetric key under an embedded RSA-2048 public key compiled into the binary. Rather than encrypting entire files, it selectively targets specific regions — the same speed optimization employed by LockBit and BlackCat-class lockers. Each processed file is renamed with a .locked extension, and the binary terminates any processes holding target files open before encryption, while also handling restarts without re-encrypting files already processed. Operators deploying Langflow instances should immediately verify their version and apply the 1.3.0 patch if exposed, audit any outbound connections to unknown C2 endpoints, and run a port scanner to identify unanticipated listeners on AI infrastructure hosts. Security teams should also validate outbound TLS configurations with an SSL/TLS checker to detect potential C2 channel anomalies, and review domain ownership of any newly observed infrastructure through a WHOIS lookup to enrich threat intelligence workflows.