CVE-2025-3248 — an unauthenticated Langflow remote code execution flaw with a CVSS score of 9.8 that has sat in CISA’s Known Exploited Vulnerabilities catalog since May 5, 2025 — was the unchanged entry vector for an operator now deploying a compiled Go ransomware that targets AI model files.
ENCFORGE: a ransomware built for models, not general files
Sysdig’s analysis shows the new payload, named ENCFORGE in recovered artifacts, is a UPX 5.20–packed static Go 1.22.12 ELF whose internal project name is encfile and whose error text references a companion keygen called keyforge. The binary’s default extension list covers PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors, ONNX, GGUF and GGML weights, FAISS vector indexes, Parquet and Arrow training datasets, NumPy arrays, and TensorFlow records, among roughly 180 extensions in total. The built-in help text mentions LoRA fine-tuning adapters and legacy GGML weights as examples — a choice Sysdig reads as deliberate targeting of AI infrastructure rather than incidental coverage.
ENCFORGE encrypts selected regions of files with AES-256-CTR, wraps a per-run symmetric key under an embedded RSA-2048 public key, and renames processed files with a .locked extension. It kills processes holding files open before encryption, survives restarts without re-encrypting completed files, drops ransom notes named README, HOW_TO_DECRYPT, and README_DECRYPT, and deletes itself after running. The recovered binary carries no networking code, no cloud storage client and no staging mechanism; researchers found no evidence of data exfiltration, a leak site, or a Tor payment portal in the session they observed.
From Langflow RCE to host breakout: JADEPUFFER’s method
Both the prior campaign and this follow-up used the same Langflow entry point: versions before 1.3.0 expose the /api/v1/validate/code endpoint without authentication, allowing arbitrary Python execution. Sysdig links this operation to JADEPUFFER, the AI‑agent‑driven operator it documented earlier in July.
After achieving code execution, the operator swept the container for credentials and found the Docker socket at /var/run/docker.sock. A first attempt to pull ENCFORGE from a GCP command‑and‑control server failed; over five minutes and 24 seconds the operator iteratively created and revised six Python scripts through the Langflow RCE channel until a host breakout worked. The earliest scripts were constructed one line at a time to keep individual requests inert for signature inspection; subsequent scripts were encoded in base64 and decoded inside exec() calls to avoid shell-level detection.
The final script used the Docker API to start a privileged container with PidMode: host, NetworkMode: host, Privileged: true, and a read-write bind mount of the host root filesystem. It located a target process, copied ENCFORGE through /proc/<pid>/root into place, and executed it on the host via nsenter. Before the live run the operator executed --try-run to scan the filesystem, then --lock for the live encryption pass; the final script checked process status, read the lock log, and counted .locked files. Sysdig did not publish the count of files encrypted.
Evidence, attribution, and the limits of leverage
Sysdig retrieved the binary from the attacker C2 server where it was hidden as /.lockd (the leading dot hides it from plain directory listings and a direct request to /lockd returns 404). Threat intelligence platforms returned no detections for the packed or unpacked hashes at the time of analysis. Binary SHA‑256 values reported by Sysdig are: packed 8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2 and unpacked ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328.
Sysdig published the source and C2 addresses, the embedded RSA‑2048 key fingerprint, and a YARA rule in its full report. The extortion contact baked into the ransom notes is e78393397@proton.me — the same Proton Mail address used in the earlier JADEPUFFER campaign — which Sysdig describes as its strongest attribution link between the operations. During the observed session Sysdig found no exfiltration capability in the ENCFORGE binary; its leverage in that instance was encryption of local data alone.
How this lands for technologists, regulators, and affected enterprises
- Technologists and security teams: patch Langflow to 1.9.1 or a currently supported release (Langflow 1.3.0 fixed CVE-2025-3248; CISA’s KEV catalog also lists CVE-2026-33017, an unauthenticated RCE fixed in 1.9.0 added March 25, 2026, and CVE-2026-55255, a cross‑user authorization bypass fixed in 1.9.1 added July 7, 2026). Rotate AI provider keys, cloud credentials, database secrets and any tokens accessible to the Langflow process; patching alone does not revoke harvested credentials. Remove /var/run/docker.sock from containers that do not need it, or restrict access through narrow proxies where unavoidable. Alert on application use of Docker container-creation APIs, containers launched with Privileged: true or PidMode: host, host-root bind mounts, and nsenter execution from inside containers.
- Affected enterprises and procurement leaders: treat model weights, vector indexes, and training datasets as recovery-tier assets. Sysdig estimates rebuilding a production model once encrypted could cost between $75,000 and $500,000 per model in cloud GPU compute and engineering time. Keep those artifacts in offline or immutable snapshots and monitor for mass .locked file creation.
- Regulators and incident responders: note that Sysdig published C2 indicators, an embedded key fingerprint and a YARA rule; The Hacker News contacted Sysdig for further campaign-scope detail and attribution confidence but Sysdig had not responded by publication.
ENCFORGE is a forensic pivot: compiled tooling, AI-specific file targeting, and host-breakout scripts that adapt under failed delivery change the calculus for defenders who treated model artifcats as lower-risk. Sysdig’s findings push model weights and vector indexes into the same restoration tier as source code and production databases — and they leave a clear operational task: patch Langflow, rotate harvested credentials, and assume that any container with an exposed Docker socket is a host escape waiting to happen.
Source: The Hacker News — New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack
