AI Model Files Under Fire: New Ransomware Targets Langflow Vulnerability

A fresh wave of attacks is hitting AI infrastructure, and this time the malware has a specific target: your model weights and training data. Researchers at Sysdig have linked a second assault on the same vulnerable Langflow server to JADEPUFFER, the AI-agent-driven operator they first documented earlier this month. The operator has now deployed ENCFORGE, a compiled ransomware written in Go, designed to encrypt model weights, vector indexes, training datasets, and other AI-critical files across the host filesystem.

The entry point remains unchanged. Langflow versions before 1.3.0 expose the /api/v1/validate/code endpoint without authentication, allowing any remote attacker to execute arbitrary Python on the server. This flaw, CVE-2025-3248, carries a CVSS score of 9.8 and has been in CISA's Known Exploited Vulnerabilities catalog since May. The new ENCFORGE payload replaces the improvised scripts used in the first campaign with polished, compiled tooling. It targets model stores, vector databases, and training pipelines - areas the earlier attack only swept for credentials. Researchers retrieved the binary from the attacker's command-and-control server, where it was hidden as /.lockd. The file is a UPX-packed static Go ELF binary. Its default extension list covers PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors, ONNX, GGUF, FAISS indexes, and more - roughly 180 extensions in total. An --include flag lets the operator add custom file globs, and the built-in help text even cites LoRA fine-tuning adapters and legacy GGML weights as examples. That specificity points to deliberate targeting, not incidental coverage.

ENCFORGE uses AES-256-CTR for file data, with the symmetric key wrapped under an embedded RSA-2048 public key. Rather than encrypting whole files, it encrypts selected regions - a speed optimization used by LockBit and BlackCat. Each processed file gets a .locked extension. The binary kills processes holding files open, handles restarts without re-encrypting, drops ransom notes, and deletes itself after running. The extortion contact embedded in the notes is e78393397@proton.me, the same Proton Mail address used in the prior campaign - Sysdig calls this the strongest attribution link between the two operations. After confirming code execution, JADEPUFFER swept the container for credentials and found the Docker socket. Over five minutes, the operator created and revised six Python scripts through the same Langflow RCE channel until it had a working path to the host. The final version used the Docker API to spin up a privileged container with the host PID namespace and root filesystem mounted, copied ENCFORGE through /proc//root, then ran it on the host via nsenter. Researchers estimate that rebuilding a production AI model once encrypted could cost between $75,000 and $500,000 per model in cloud GPU compute and engineering time. Sysdig has published the source and C2 addresses, the embedded RSA-2048 key fingerprint, and a YARA rule in its full report. Upgrade Langflow to 1.9.1 or a current supported release. Rotate AI provider keys, cloud credentials, and database secrets. Remove /var/run/docker.sock from any container that does not require it. Model artifacts now belong in the same recovery tier as source code and production databases.

Source: The Hackers News