New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack
Summary: Sysdig linked a second attack on the same Langflow server to the operator it calls JADEPUFFER, which deployed ENCFORGE, a compiled Go ransomware that encrypts model weights, vector indexes, and training datasets and targets roughly 180 file extensions including PyTorch and TensorFlow checkpoints, SafeTensors, ONNX, GGUF, GGML, FAISS indexes, and Parquet and Arrow datasets. The entry point was Langflow versions before 1.3.0, which expose the /api/v1/validate/code endpoint without authentication (CVE-2025-3248, CVSS 9.8, in CISA's Known Exploited Vulnerabilities catalog since May 5, 2025), and the operator used the exposed Docker socket at /var/run/docker.sock to build a host breakout across six Python scripts over five minutes and 24 seconds.
Bottom line: Sysdig estimates rebuilding one encrypted production AI model could cost $75,000 to $500,000 in cloud GPU compute and engineering time, and a single run can hit multiple model variants on shared storage along with the training data needed to retrain them. The recovered binary has no exfiltration code and no leak site, so the only leverage is the encrypted files, and the ransom contact e78393397@proton.me is the same Proton Mail address used in the prior campaign.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Mentions
- CVE-2025-3248
- Related
- CVE-2025-3248: Langflow Missing Authentication Vulnerability Known Exploited Vulnerabilities · May 05, 2025