Fast Facts
- Researchers linked a second attack on Langflow servers to the JADEPUFFER threat group, which now deploys ENCFORGE ransomware to encrypt AI infrastructure files.
- ENCFORGE is a compiled Go malware targeting model weights, datasets, and vector indexes, using AES-256-CTR encryption with RSA-2048 keys, and designed without exfiltration capabilities.
- The attack exploits a CVE-2025-3248 vulnerability in Langflow <version 1.3.0> allowing remote code execution, enabling operators to escalate to host-level encryption via Docker socket and privileged containers.
- To defend, organizations should patch Langflow, rotate credentials, restrict Docker socket access, monitor suspicious API calls, and secure model data with offline or immutable storage.
New Ransomware Targets AI Files on Vulnerable Servers
Recently, a new type of malware called ENCFORGE has emerged. It specifically targets AI model files stored on affected servers. Security researchers have linked this ransomware to a previously identified attacker group called JADEPUFFER. The attack begins through a security flaw in older versions of Langflow, a popular AI tool. If the server has a version before 1.3.0, hackers can exploit it without needing a password. This flaw, known as CVE-2025-3248, is very dangerous because it scores high on security threat scales. Once they gain access, the attackers deploy ENCFORGE, which encrypts vital AI data like model weights and training datasets. The encrypted files then become useless without a decryption key. The goal is to lock organizations out of their AI infrastructure, causing costly delays and data loss. The attackers leave ransom notes demanding payment but do not steal or transmit data during the process. Experts warn that rebuilding compromised AI models could cost hundreds of thousands of dollars. Protecting AI files is critical, especially since the ransomware is built to focus exclusively on these assets.
How the Attack Escalates from Vulnerable Code to Full System Breach
The attack does not stop at exploiting the security flaw. After gaining initial access, the attackers carefully escalate their presence on the target server. They initially try to pull their malicious ENCFORGE binary from a remote server. When that fails, they switch tactics. Over several minutes, they create multiple Python scripts designed to hide their actions. In these scripts, they embed code in base64 format to avoid detection. Ultimately, they use the Docker API to run the ransomware directly on the host system. This involves creating a privileged container with full control over the server’s root file system. The attacker then locates specific files, copies the ENCFORGE binary into the system, and begins encrypting files. The process is precise enough to target only AI-related data, such as models stored in various formats or training datasets. Notably, ENCFORGE encrypts files quickly and securely using strong cryptographic methods, leaving no clues of data exfiltration. Researchers warn that this type of attack can cause extensive damage and are urging organizations to update their software and restrict Docker socket access. By understanding these complex steps, organizations can better defend against future breaches and safeguard their AI investments.
Stay Ahead with the Latest Tech Trends
Learn how the Internet of Things (IoT) is transforming everyday life.
Explore past and present digital transformations on the Internet Archive.
CyberAttacks-V1
