Sysdig researchers have linked a second attack on the same Langflow server to JADEPUFFER, an AI-agent-driven operator first documented earlier this month. This time, the operator deployed ENCFORGE, a new compiled Go ransomware designed to encrypt model weights, vector indexes, training datasets, and other AI infrastructure files across the host filesystem. The entry point remains the same: Langflow versions before 1.3.0 expose the /api/v1/validate/code endpoint without authentication, allowing any remote attacker to execute arbitrary Python on the server. The flaw, CVE-2025-3248, carries a CVSS score of 9.8 and has been in CISA's Known Exploited Vulnerabilities catalog since May 5, 2025.

The ENCFORGE binary, hidden as /.lockd on the attacker's command-and-control server, is a UPX-packed Go 1.22.12 ELF file. It targets approximately 180 file extensions, including PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors, ONNX models, GGUF and GGML formats, FAISS vector indexes, Parquet and Arrow datasets, and NumPy arrays. The ransomware uses AES-256-CTR for file encryption, with the symmetric key wrapped under an embedded RSA-2048 public key. Rather than encrypting entire files, it encrypts selected regions—a speed optimization used by LockBit and BlackCat. Each processed file gets a .locked extension, and the binary kills processes holding files open before encrypting, drops ransom notes as README, HOW_TO_DECRYPT, and README_DECRYPT, then deletes itself after running. The extortion contact is e78393397@proton.me, the same Proton Mail address used in the prior campaign.

After confirming code execution, JADEPUFFER swept the container for credentials and found the Docker socket at /var/run/docker.sock. Over five minutes and 24 seconds, the operator created and revised six Python scripts through the same Langflow RCE channel until it had a working path to the host. The final version used the Docker API to spin up a privileged container with the host PID namespace and root filesystem mounted, located the target process, copied ENCFORGE through /proc//root, then ran it on the host via nsenter. Researchers estimate that rebuilding a production AI model once encrypted could cost between $75,000 and $500,000 per model in cloud GPU compute and engineering time. Sysdig recommends upgrading Langflow to 1.9.1 or later, rotating all credentials accessible to the Langflow process, removing the Docker socket from containers that don't require it, and keeping model weights and training datasets in offline or immutable snapshots.

Source: The Hackers News