Researchers at Sysdig have linked a second cyberattack on the same vulnerable Langflow server to JADEPUFFER, the AI agent driven threat operator previously documented earlier this month. During the latest incident, the same operator deployed ENCFORGE, a newly identified ransomware written in Go that is specifically designed to encrypt artificial intelligence infrastructure, including model weights, vector indexes, training datasets, and other files associated with AI environments. According to the researchers, the attack continued to exploit the same Langflow vulnerability that exposed the /api/v1/validate/code endpoint without authentication, allowing remote attackers to execute arbitrary Python code. The vulnerability, tracked as CVE 2025 3248, carries a CVSS score of 9.8 and has remained in CISA’s Known Exploited Vulnerabilities catalog since May 5, 2025.
Sysdig explained that while the earlier JADEPUFFER campaign relied on temporary Python scripts and MySQL AES encryption functions to encrypt and destroy data in Nacos configuration servers and production databases, the latest operation replaces those methods with a dedicated ransomware payload aimed directly at AI infrastructure. Researchers recovered the ENCFORGE binary from the attacker’s command and control server, where it was concealed as a hidden file named .lockd. The binary is a UPX packed static Go 1.22.12 ELF executable and, at the time of analysis, threat intelligence platforms had no detections for either the packed or unpacked versions. Internal references within the malware include the project name “encfile” and error messages mentioning a companion tool named “keyforge,” providing stable indicators for future detection. ENCFORGE supports approximately 180 targeted file extensions covering PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors, ONNX models, GGUF and GGML formats, FAISS vector indexes, Parquet and Arrow datasets, NumPy arrays, and TensorFlow records. Researchers noted that the malware also allows operators to include additional file types through an include option, with examples specifically referencing LoRA fine tuning adapters and legacy GGML model weights, reinforcing the conclusion that AI environments are the intended targets rather than general purpose systems.
The ransomware uses AES 256 CTR encryption for file data, with each encryption key protected by an embedded RSA 2048 public key. Instead of encrypting entire files, ENCFORGE encrypts selected portions to improve execution speed, a technique also used by established ransomware families. Encrypted files are renamed with a .locked extension, while the malware terminates processes using targeted files, resumes interrupted operations without repeating completed work, creates ransom notes under filenames including README, HOW_TO_DECRYPT, and README_DECRYPT, and removes itself after execution. Researchers found no evidence that ENCFORGE steals data, communicates with cloud storage services, or transfers information outside the compromised environment. No leak site or Tor based payment portal was identified during the observed attack, making encrypted data the attacker’s primary means of extortion. The ransom notes contain the Proton Mail address e78393397@proton.me, the same contact used in the earlier JADEPUFFER campaign, which Sysdig described as the strongest attribution link between the two operations. Although the researchers disclosed one observed attack session, they did not identify the victim organization or report additional confirmed deployments.
The investigation also revealed how the attackers successfully escaped from the vulnerable Langflow container to the host system after an initial attempt to download ENCFORGE failed. Once remote code execution was established, JADEPUFFER searched the container for credentials and discovered the Docker socket located at /var/run/docker.sock. Over a period of five minutes and twenty four seconds, the operator repeatedly modified Python scripts through the Langflow vulnerability until a working host breakout method was achieved. The final script used Docker APIs to create a privileged container with access to the host process namespace and mounted root filesystem, copied the ransomware to the host through the /proc filesystem, and executed it using nsenter. Before launching encryption, the attacker performed a trial scan using a try run option before executing the final lock operation. Sysdig believes task identifiers found during the attack indicate the compromised system was tracked as a Google Cloud target within a broader campaign, although no additional victims were disclosed. Researchers estimate rebuilding a production AI model after encryption could cost between 75,000 and 500,000 US dollars in cloud GPU resources and engineering effort, particularly when multiple model variants and training datasets share the same storage. To reduce risk, Sysdig recommends upgrading Langflow to version 1.9.1 or another supported release, noting that version 1.3.0 addressed CVE 2025 3248 while later releases also fixed CVE 2026 33017 and CVE 2026 55255. The company also advises organizations to rotate credentials that may have been exposed, remove unnecessary Docker socket access, monitor for privileged container creation and abnormal container activity, and maintain offline or immutable backups of AI model weights, vector indexes, and training datasets to improve recovery after ransomware incidents.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
