New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack

1. Executive summary

JADEPUFFER, an actor attributed by Sysdig to an autonomous LLM-driven AI agent (no MITRE ATT&CK profile exists for this actor; attribution is unconfirmed), has deployed a new compiled Go ransomware dubbed ENCFORGE in a second observed attack against a Langflow server. The initial access vector is unchanged: CVE-2025-3248 (CVSS 9.8, Critical), an unauthenticated remote code execution flaw in Langflow versions prior to 1.3.0 via the /api/v1/validate/code endpoint, which has been listed in CISA's Known Exploited Vulnerabilities (KEV) catalogue since 5 May 2025. ENCFORGE is purpose-built to encrypt AI infrastructure assets — model weights, vector indexes, training datasets, and checkpoints — using AES-256-CTR with RSA-2048 key wrapping, and represents a shift from the improvised Python/MySQL encryption seen in JADEPUFFER's first campaign to compiled, reusable tooling. EMEA financial services running Langflow in AI/ML pipelines face direct risk of production model data loss if the vulnerable endpoint remains exposed.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain (single-sourced to Sysdig research; verify before enforcement)

1. Initial access — CVE-2025-3248 exploitation. The attacker sent an unauthenticated request to the /api/v1/validate/code endpoint on a Langflow server running a version prior to 1.3.0. This endpoint exposes arbitrary Python code execution on the server without authentication. The flaw carries a CVSS score of 9.8 (Critical) and has been in CISA's KEV catalogue since 5 May 2025.
2. Credential sweep and Docker socket discovery. After confirming code execution, JADEPUFFER swept the container for credentials and located the Docker socket at /var/run/docker.sock, providing a path to host-level access and container manipulation.
3. C2 retrieval attempt and adaptation. The first attempt to pull the ENCFORGE binary from a GCP-based command-and-control server failed. The operator adapted and retried — behaviour Sysdig attributes to the agentic (LLM-driven) nature of the actor, though this attribution is unconfirmed (no MITRE ATT&CK profile exists for JADEPUFFER).
4. ENCFORGE deployment. The ransomware binary was retrieved from the C2 server, where it was hidden as /.lockd (a direct request to /lockd returns 404; the leading dot conceals it from plain directory listings).
5. File encryption across AI infrastructure. ENCFORGE encrypted targeted file types across the host filesystem using AES-256-CTR for file data, with the per-run symmetric key wrapped under an embedded RSA-2048 public key. Rather than encrypting whole files, it encrypts selected regions — a speed optimisation comparable to LockBit and BlackCat-class lockers. Each processed file is renamed with a .locked extension.
6. Process killing and ransom note deployment. The binary kills processes holding target files open before encrypting, handles restarts without re-encrypting completed files, and drops ransom notes named README, HOW_TO_DECRYPT, and README_DECRYPT. The binary deletes itself after running.

ENCFORGE binary technical details

• Format: UPX 5.20-packed static Go 1.22.12 ELF binary.
• Internal project name: encfile
• Companion tool referenced in error text: keyforge
• Detection anchors: The strings encfile and keyforge survive recompilation of the same codebase and serve as stable detection signatures.
• Threat intelligence detections: Zero detections on both packed and unpacked hashes at time of Sysdig's analysis.
• Targeted file extensions (approximately 180 total): PyTorch checkpoints, TensorFlow checkpoints, Hugging Face SafeTensors, ONNX interchange format, GGUF (current standard for locally deployed LLMs), GGML (predecessor format), FAISS vector indexes, Parquet datasets, Arrow datasets, NumPy arrays, and TensorFlow records. An --include flag allows the operator to append additional file globs; built-in help text cites LoRA fine-tuning adapters and legacy GGML weights as examples.
• Encryption: AES-256-CTR for file data; per-run symmetric key wrapped under embedded RSA-2048 public key. Selective region encryption, not full-file.
• Exfiltration capability: None. The binary carries no networking code, cloud storage client, or staging mechanism. No evidence of data exfiltration, leak site, or Tor payment portal was found. Leverage is purely encrypted-data denial.
• Extortion contact: e78393397@proton.me — the same Proton Mail address used in JADEPUFFER's prior campaign. Sysdig describes this as the strongest attribution link between the two operations.

Prior campaign context (for correlation): JADEPUFFER's earlier operation used throwaway Python code and MySQL's AES_ENCRYPT() function to encrypt and destroy data in Nacos (Alibaba's configuration server) and production databases. ENCFORGE replaces those improvised scripts with compiled tooling targeting the model stores, vector databases, and training pipelines that the first campaign swept for credentials.

Confidence caveat: All technical detail above is single-sourced to Sysdig's research, as reported by The Hacker News and BleepingComputer. Sysdig disclosed one observed session, did not name the victim organisation, and provided no victim count or evidence of additional ENCFORGE deployments. Verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Patch Langflow immediately. Upgrade to version 1.3.0 or later, which remediates CVE-2025-3248. This is the single highest-priority action. If patching is not immediately possible, proceed to the network containment steps below.
• Block external access to /api/v1/validate/code. If the Langflow instance must remain internet-facing, apply a WAF rule or reverse proxy ACL to deny all requests to this endpoint. The endpoint should never be reachable without authentication.
• Restrict Docker socket access. Ensure /var/run/docker.sock is not mounted or accessible inside Langflow containers. If the socket must be available, enforce read-only mount and AppArmor/SELinux profiles that deny docker exec and docker run from the Langflow process.
• Hunt for ENCFORGE artefacts. Search all hosts in the AI/ML estate for files named /.lockd, README, HOW_TO_DECRYPT, README_DECRYPT, and any files with a .locked extension. Search binary strings for encfile and keyforge.

P2 — Within 72 hours

• Isolate and preserve. If an ENCFORGE infection is confirmed, isolate the affected host immediately. Preserve the binary for forensic analysis before any remediation — the self-deleting behaviour means the artefact will not survive a reboot or cleanup.
• Audit AI infrastructure file stores. Check model registries, vector database directories, training data pipelines, and checkpoint storage for .locked files or ransom notes. ENCFORGE targets approximately 180 extensions across PyTorch, TensorFlow, Hugging Face, ONNX, GGUF, GGML, FAISS, Parquet, Arrow, NumPy, and TFRecord formats.
• Block the C2 and extortion infrastructure. Block the email address e78393397@proton.me in mail gateways. Investigate GCP egress from the environment associated with the C2 server identified by Sysdig (specific IP/hostname not provided in source material — obtain from Sysdig report if available).
• Deploy EDR/YARA detection. Deploy the YARA rule in §6 to all endpoints hosting AI/ML workloads. Configure EDR to alert on Go ELF binaries matching the encfile/keyforge string anchors.

P3 — Within 7 days

• Network-segment AI/ML infrastructure. Place Langflow and other AI orchestration tools on isolated network segments with strict egress filtering. AI model stores, vector databases, and training pipelines should not share filesystems with orchestration layers.
• Enforce KEV-driven patch SLAs. CVE-2025-3248 has been in CISA KEV since May 2025 — over a year before this observed exploitation. Review patch management processes to ensure KEV-listed vulnerabilities in AI/ML tooling are remediated within 30 days of KEV addition.
• Review container hardening. Ensure all AI/ML containers run with dropped capabilities, no Docker socket mount, read-only filesystems where feasible, and seccomp/AppArmor profiles.

5. Indicators of compromise

email  e78393397[.]proton[.]me
filepath  /.lockd
filepath  /lockd
filename  README
filename  HOW_TO_DECRYPT
filename  README_DECRYPT
fileext  .locked
binstring  encfile
binstring  keyforge

Behavioural indicators

6. Detection

rule ENCFORGE_Ransomware {
    meta:
        author = "Adverse Trace"
        date = "2026-07-21"
        reference = "https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html"
        description = "Detects ENCFORGE Go ransomware binary by stable internal project name and companion tool reference"
    strings:
        $proj_name = "encfile" ascii
        $keygen = "keyforge" ascii
        $ransom_note_1 = "HOW_TO_DECRYPT" ascii
        $ransom_note_2 = "README_DECRYPT" ascii
        $ext_locked = ".locked" ascii
    condition:
        uint16(0) == 0x457f and
        ($proj_name and $keygen) and
        1 of ($ransom_note_1, $ransom_note_2, $ext_locked)
}

title: Langflow CVE-2025-3248 Unauthenticated Code Execution via validate/code
id: 7a3c1f2e-4b5d-4a8e-9c1f-6d2b3a4e5f6a
status: experimental
description: Detects unauthenticated requests to the Langflow /api/v1/validate/code endpoint, indicating potential CVE-2025-3248 exploitation
author: Adverse Trace
date: 2026/07/21
references:

    - https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html
logsource:
    category: webserver
    product: nginx
    service: access
detection:
    selection:
        uri|contains: "/api/v1/validate/code"
        method: POST
    filter:
        status: 401
    condition: selection and not filter
falsepositives:

    - Legitimate authenticated code validation requests (should not appear unauthenticated)
level: critical

title: ENCFORGE Ransomware File Encryption Behaviour
id: 8b4d2g3f-5c6e-4b9f-0d2g-7e3c4b5f6a7b
status: experimental
description: Detects file renaming to .locked extension and creation of ransom notes consistent with ENCFORGE activity
author: Adverse Trace
date: 2026/07/21
references:

    - https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html
logsource:
    category: file_event
    product: sysmon
detection:
    selection_locked:
        TargetFilename|endswith: ".locked"
    selection_ransom:
        TargetFilename|endswith:

            - "HOW_TO_DECRYPT"
            - "README_DECRYPT"
    condition: selection_locked or selection_ransom
falsepositives:

    - Unlikely in production AI/ML environments
level: critical

7. Sources

• The Hacker News — "New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack" — https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html — 2026-07-21
• BleepingComputer — "JadePuffer agentic attacks now target AI model data with ransomware" — https://www.bleepingcomputer.com/news/security/jadepuffer-agentic-attacks-now-target-ai-model-data-with-ransomware/ — 2026-07
• The Hacker News — "AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack" — https://thehackernews.com/2026/07/ai-agent-exploits-langflow-rce-to.html — 2026-07
• Dark Reading — "JadePuffer: The First Complete LLM-Driven Ransomware Attack" — https://www.darkreading.com/cyberattacks-data-breaches/jadepuffer-first-complete-llm-driven-ransomware-attack — 2026-07

8. Adverse Trace position

This is a Critical-severity threat (CVSS 9.8 on the exploited CVE, KEV-listed since May 2025) targeting AI/ML infrastructure that is increasingly present in EMEA financial services environments. The shift from improvised Python scripts to a compiled, purpose-built Go ransomware with stable detection anchors (encfile, keyforge) indicates operational maturation by JADEPUFFER, though attribution to an LLM-driven autonomous agent remains unconfirmed (no MITRE ATT&CK profile; single-sourced to Sysdig). The absence of exfiltration capability in ENCFORGE reduces regulatory exposure to data-breach notification regimes but does not reduce the operational impact of losing model weights, vector indexes, and training datasets. Clients running Langflow must treat patching to ≥1.3.0 as an immediate P1 action — the KEV listing is over a year old and exploitation is confirmed in the wild. We will monitor for additional ENCFORGE deployments, hash publications, and any confirmation of the JADEPUFFER attribution. Clients with AI/ML pipelines should audit their Langflow exposure and Docker socket configurations this week.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.