ENCFORGE Ransomware Targets AI Models via Langflow RCE

Introduction

The cybersecurity landscape is witnessing a disturbing evolution: ransomware operators are no longer content with locking generic business documents. They are now setting their sights on the crown jewels of modern enterprises—artificial intelligence assets. Researchers at Sysdig have revealed a sophisticated follow-up attack by the threat actor known as JADEPUFFER, who has deployed a brand-new strain of ransomware dubbed ENCFORGE. This malware is uniquely compiled in Go and designed to hunt down and encrypt critical AI infrastructure, including model weights, vector indexes, and training datasets. The initial foothold? A remote code execution (RCE) vulnerability in Langflow, a popular open-source UI for building LangChain applications. This incident underscores a critical shift in threat modeling: AI infrastructure is now a primary target.

JADEPUFFER Returns with AI-Focused Ransomware

JADEPUFFER first appeared on researchers' radars earlier this month, characterized as an "AI-agent-driven operator." This designation suggests the threat actor leverages autonomous or semi-autonomous AI agents to conduct reconnaissance, lateral movement, and payload deployment at machine speed. The fact that they returned to the same compromised Langflow server indicates a high level of persistence and intentional targeting. Rather than deploying a generic encryptor, they chose a custom-built tool—ENCFORGE—tailored to the specific file structures and extensions found in machine learning environments. This level of customization implies the operator possesses deep domain knowledge of MLOps workflows and the high value of the data they are holding hostage.

ENCFORGE: Anatomy of an AI-Targeted Encryptor

Written in Go (Golang), ENCFORGE benefits from the language's cross-compilation capabilities, allowing it to run seamlessly across Linux and Windows hosts commonly found in AI training clusters. Unlike traditional ransomware that targets user documents (e.g., .docx, .xlsx, .pdf), ENCFORGE's file extension targeting list reads like a data scientist's workspace:

• Model Weights: .bin, .pt, .pth, .safetensors, .h5, .ckpt
• Vector Indexes: .index, .faiss, .ann, .hnsw
• Training Data & Configs: .parquet, .arrow, .tfrecord, .yaml, .json (specific to ML pipelines)
• Dataset Artifacts: Preprocessed tokenized datasets, embedding caches, and tokenizer vocabularies.

By encrypting these specific assets, ENCFORGE effectively halts the entire ML lifecycle—inference, fine-tuning, and retraining—potentially causing millions in compute waste and intellectual property loss. The ransom note reportedly demands payment in cryptocurrency for a decryptor, though researchers warn that custom Go ransomware often suffers from flawed encryption implementations, making recovery without the key mathematically impossible even if the ransom is paid.

Langflow RCE: The Entry Point for AI Infrastructure Compromise

The initial access vector was a remote code execution flaw in Langflow. As a low-code/no-code interface for LangChain, Langflow instances often run with elevated permissions to interact with vector databases, LLM APIs, and local file systems for document loading. This makes them a high-value target: compromising a Langflow server often equates to compromising the entire AI backend. The vulnerability allows unauthenticated attackers to execute arbitrary code on the host. In this campaign, JADEPUFFER exploited this flaw to drop the ENCFORGE binary, execute it with the host's privileges, and propagate encryption across mounted volumes containing model registries and dataset stores.

Key mitigation steps for Langflow administrators include:

• Immediately patching to the latest version addressing the RCE vulnerability.
• Running Langflow containers with read-only root filesystems and dropped capabilities.
• Isolating model artifact storage on separate, access-controlled network volumes.
• Implementing runtime security monitoring (e.g., Falco, Tetragon) to detect unexpected binary executions.

Conclusion

The JADEPUFFER campaign and the deployment of ENCFORGE serve as a stark wake-up call. The boundary between "traditional infrastructure" and "AI infrastructure" has effectively dissolved for threat actors. A vulnerability in an AI orchestration tool like Langflow provides a direct highway to an organization's most valuable intellectual property: its trained models and curated knowledge bases. Defending this new attack surface requires a paradigm shift from perimeter-based security to data-centric, runtime-aware protection strategies. As AI becomes the core engine of business value, the security posture surrounding model weights, vector databases, and training pipelines must be elevated to the highest priority. Grivyonx Cloud's AI-driven cyber intelligence platform is engineered to provide exactly this level of visibility—correlating runtime anomalies in ML workloads with threat intelligence feeds to detect and neutralize campaigns like JADEPUFFER before they encrypt your competitive advantage.