New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack
A new ransomware variant named ENCFORGE specifically targets AI infrastructure, including model weights, vector indexes, and training datasets. The attack leverages CVE-2025-3248, an unauthenticated Remote Code Execution vulnerability in Langflow versions prior to 1.3.0. The threat actor, identified as JADEPUFFER, demonstrates advanced evasion techniques by iteratively constructing Python scripts to escape the container and encrypt host files. ENCFORGE is a compiled Go binary that uses AES-256-C
Analysis
TL;DR
- A new ransomware variant named ENCFORGE specifically targets AI infrastructure, including model weights, vector indexes, and training datasets.
- The attack leverages CVE-2025-3248, an unauthenticated Remote Code Execution vulnerability in Langflow versions prior to 1.3.0.
- The threat actor, identified as JADEPUFFER, demonstrates advanced evasion techniques by iteratively constructing Python scripts to escape the container and encrypt host files.
- ENCFORGE is a compiled Go binary that uses AES-256-CTR encryption and deliberately targets specific AI file formats like GGUF, SafeTensors, and FAISS indexes.
Why It Matters
This incident highlights a critical shift in cyber threats where attackers are moving beyond general data theft to specifically destroying proprietary AI assets, which are often irreplaceable and expensive to recreate. It underscores the severe risks associated with exposing AI development tools like Langflow to the internet without proper authentication, serving as a stark warning for organizations deploying open-source AI frameworks.
Technical Details
- Vulnerability: The entry point is CVE-2025-3248, a CVSS 9.8 RCE flaw in Langflow <1.3.0 that exposes the
/api/v1/validate/codeendpoint without authentication. - Malware Specifications: ENCFORGE is a static Go 1.22.12 ELF binary packed with UPX 5.20, hidden as
/.lockd. It uses AES-256-CTR for data encryption and RSA-2048 for key wrapping, employing region-based encryption for performance. - Targeted File Types: The malware scans for approximately 180 extensions, focusing on AI-specific formats such as PyTorch/TensorFlow checkpoints, Hugging Face SafeTensors, ONNX, GGUF/GGML, FAISS indexes, and Parquet/Arrow datasets.
- Attack Chain: The operator utilized the Docker socket (
/var/run/docker.sock) to create privileged containers with host PID and filesystem namespaces, allowing it to break out of the container and execute the ransomware on the host system viansenter. - Evasion Techniques: The attacker bypassed signature-based detection by building Python scripts incrementally over several minutes, using base64 encoding within
exec()calls to avoid triggering shell-level command searches.
Industry Insight
- Organizations must immediately patch Langflow to version 1.3.0 or later and ensure that no AI development interfaces are exposed to the public internet without robust authentication and network segmentation.
- Security teams should monitor for anomalous Docker socket access and privileged container creation, as these are strong indicators of container breakout attempts targeting host-level resources.
- AI providers and enterprises should treat model weights and training data as high-value assets requiring specialized backup and integrity monitoring strategies, distinct from traditional IT data protection.
Disclaimer: The above content is generated by AI and is for reference only.