New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack
09:34 · July 21, 2026 · Hacker News AI Section
Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator it first documented earlier this month. The same operator has now been spotted deploying ENCFORGE, a new compiled Go ransomware designed to encrypt model weights, vector indexes, training datasets, and other AI infrastructure files across the host filesystem. The entry
Summary
Researchers at Sysdig have tied a second observed compromise of a Langflow server to the operator JADEPUFFER, who previously used improvised Python scripts against Nacos and database instances. In this campaign the same actor deployed ENCFORGE, a statically linked Go 1.22 binary packed with UPX 5.20, that enumerates and selectively encrypts AI-specific file types across the host filesystem.
The initial foothold remains the unauthenticated remote-code-execution flaw CVE-2025-3248, present in Langflow releases before 1.3.0. Attackers reach the /api/v1/validate/code endpoint and obtain arbitrary Python execution on the container. Once inside, JADEPUFFER locates the Docker socket, spins up a privileged container with the host PID and root namespaces mounted, and copies the ransomware binary into the host via /proc. The operator iterates through six successive Python payloads, each base64-encoded inside an exec call, until a working breakout is achieved.
ENCFORGE walks the filesystem for roughly 180 extensions that cover PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors, ONNX, GGUF and GGML LLM weights, FAISS indexes, Parquet and Arrow datasets, and NumPy arrays. It applies AES-256-CTR to selected file regions rather than entire contents, renames each file with a .locked suffix, and drops three ransom notes containing the Proton Mail address e78393397@proton.me. The binary contains no networking or exfiltration code; its only pressure point is the loss of the encrypted model artifacts and training data.
The same contact address, together with stable strings such as “encfile” and “keyforge,” links the two operations. Sysdig recovered the packed and unpacked SHA-256 hashes, the embedded RSA-2048 public key, and a YARA rule that can be used for detection. Because production AI workloads commonly store multiple model variants and their associated indexes on shared storage, a single successful run can render an entire training or inference environment inoperable until the weights and datasets are rebuilt or restored from offline copies.
Why it matters
Directly actionable for Dutch AI teams running Langflow or similar tools: patch to 1.3.0+, restrict Docker socket access, and monitor for the listed indicators. Highlights real-world AI infrastructure ransomware risk with cost estimates relevant under EU data-protection and AI Act expectations.
