New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack
Researchers have identified ENCFORGE, a new Go ransomware deployed by the JADEPUFFER operator, specifically targeting AI model files and training datasets after exploiting a critical remote code execution vulnerability in Langflow servers.
Intelligence analysis by Gemini 2.5 Flash
The JADEPUFFER threat actor, previously observed using improvised scripts, has upgraded its toolkit to ENCFORGE ransomware, designed to encrypt critical AI infrastructure files. This new campaign leverages the same unauthenticated Langflow RCE vulnerability (CVE-2025-3248) to gain initial access, then exploits the Docker socket to achieve host breakout and deploy the ransomware.
Imagine a special computer program (Langflow) that helps smart robots (AI models) learn new things. A sneaky bad guy (JADEPUFFER) found a secret back door in this program that let him send his own instructions. Instead of just messing up the robot's classroom, he used a clever trick with the classroom's security guard (Docker) to sneak into the main school building (the host computer). Once inside, he used a new digital lock (ENCFORGE ransomware) to lock up all the robots' important textbooks and drawings (AI model files), demanding a key to unlock them, making it impossible for the robots to learn or work.
Analysis
ENCFORGE's AI-Specific Targeting
ENCFORGE represents a significant evolution in ransomware, moving beyond generic file encryption to specifically target the critical assets of AI and machine learning environments. Developed in Go and packed with UPX, this ransomware is designed to encrypt a comprehensive list of AI-related file types, including PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors, ONNX, GGUF, GGML, FAISS vector indexes, Parquet and Arrow training datasets, and NumPy arrays. The inclusion of specific examples like LoRA fine-tuning adapters in its help text underscores a deliberate focus on AI infrastructure, rather than incidental coverage. The ransomware employs AES-256-CTR for data encryption, wrapping the symmetric key with an embedded RSA-2048 public key, and optimizes speed by encrypting selected file regions, a technique seen in advanced lockers like LockBit. Crucially, ENCFORGE lacks exfiltration capabilities, relying solely on data encryption for leverage, and uses the same Proton Mail address for extortion as the prior JADEPUFFER campaign, strengthening attribution.
Exploiting Langflow and Docker for Host Breakout
The entry point for the ENCFORGE deployment remains the critical remote code execution (RCE) vulnerability, CVE-2025-3248, in Langflow versions prior to 1.3.0. This flaw, with a CVSS score of 9.8, allows unauthenticated attackers to execute arbitrary Python code on the server. Once initial code execution was confirmed within the Langflow container, JADEPUFFER demonstrated remarkable adaptability. When its initial attempt to pull the ENCFORGE binary directly failed, the operator iteratively crafted and refined six Python scripts over five minutes. These scripts were designed to exploit the exposed Docker socket at /var/run/docker.sock, ultimately creating privileged containers with host PID and root filesystem mounted. This sophisticated maneuver allowed the attacker to copy ENCFORGE through /proc/<pid>/root and execute it on the host system via nsenter, effectively breaking out of the containerized environment to compromise the underlying host.
JADEPUFFER's Adaptive Tactics and Persistence
The JADEPUFFER operator's actions in deploying ENCFORGE highlight a high degree of operational sophistication and persistence. Researchers observed the attacker quickly correcting failed attempts, such as a previous Nacos login failure, and similarly adapting when the preferred ransomware delivery route was blocked. The use of base64 encoding for full scripts within exec() calls demonstrates an effort to evade signature-based detection at the shell level. Furthermore, the presence of task IDs like gcp_h1 and gcp_test suggests that JADEPUFFER is systematically tracking targets within a broader campaign, indicating a structured and organized approach to their attacks. This evolution from improvised Python scripts and MySQL functions to a compiled Go ransomware like ENCFORGE signifies a professionalization of their toolkit and a dedicated focus on high-value AI assets.
Key points
- A new Go ransomware, ENCFORGE, specifically targets AI model files, vector indexes, and training datasets.
- The ransomware is deployed by the JADEPUFFER operator, previously known for improvised data destruction.
- Initial access is gained via CVE-2025-3248, a critical RCE vulnerability in Langflow versions before 1.3.0.
- JADEPUFFER uses sophisticated techniques, including exploiting the Docker socket, to achieve host breakout from containers.
- ENCFORGE uses AES-256-CTR encryption, targets specific AI file extensions, and lacks data exfiltration capabilities.
The detailed disclosure of ENCFORGE and JADEPUFFER's tactics by Sysdig researchers provides crucial intelligence for organizations to patch vulnerable Langflow instances and implement stronger container security. This proactive information sharing can lead to improved defenses and a reduced attack surface for AI development environments.
The continued exploitation of known, high-severity vulnerabilities like CVE-2025-3248, combined with the sophisticated host breakout techniques, suggests that many AI development environments remain exposed. The specialized targeting of AI model files by ENCFORGE poses a significant risk of data loss and operational disruption for organizations heavily invested in AI.
