Researchers said a second attack on the same Langflow server used by the JADEPUFFER operator delivered ENCFORGE, a new Go ransomware that targets AI model weights, vector indexes and training data after exploiting CVE-2025-3248.
KEY FACTS
- Target AI infrastructure files on the host filesystem
- Entry point Unauthenticated Langflow code execution in versions before 1.3.0
- Payload Compiled Go ransomware named ENCFORGE
- Impact Encrypts selected file regions and renames files with .locked
- Attribution Ransom note contact matched the earlier campaign
A technical analysis from Sysdig said the binary was recovered from the attacker’s command and control server and was hidden as a dotfile. The file was a UPX-packed static Go ELF, and the report said threat intel tools showed no detections on the packed or unpacked hash at the time of analysis.
The payload’s built-in file list covered PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors, ONNX files, GGUF and GGML model weights, FAISS indexes, Parquet and Arrow datasets, NumPy arrays and TensorFlow records. The report said the operator could add more patterns with an include flag, and that the selection pointed to AI environments rather than generic file encryption.
ENCFORGE used AES-256-CTR with a per-run key wrapped under an embedded RSA-2048 public key. It renamed files with a .locked extension, killed processes holding files open, avoided re-encrypting completed files after restarts, dropped ransom notes and deleted itself after running. The recovered binary had no exfiltration code, cloud client or payment portal, and researchers found no evidence of data theft in the session they observed.
Sysdig said the operator first swept the container for credentials, found the Docker socket at /var/run/docker.sock and then built a host breakout through privileged containers. Over just over five minutes, it revised six Python scripts, used base64 encoding to hide later versions and eventually copied ENCFORGE through /proc and ran it on the host with nsenter. The disclosure did not name the victim or give a file count.
Researchers also said the ransom note used the same Proton Mail address seen in the earlier operation, which was the strongest link between the two cases. The report said rebuilding a production AI model after encryption could cost between $75,000 and $500,000 per model.
WHY IT MATTERS
The case shows how a single exposed application can lead from code execution to host-level access and ransomware aimed at AI assets. It also shows that model weights, vector stores and training data may need the same recovery planning as source code and databases.