Full Report
Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator it first documented earlier this month. The same operator has now been spotted deploying ENCFORGE, a new compiled Go ransomware designed to encrypt model weights, vector indexes, training datasets, and other AI infrastructure files across the host filesystem. The entry
Analysis Summary
# Incident Report: ENCFORGE Ransomware Targeting AI Infrastructure
## Executive Summary
The threat actor "JADEPUFFER" has been identified conducting a second campaign against an unpatched Langflow server. The attacker leveraged an unauthenticated Remote Code Execution (RCE) vulnerability to deploy ENCFORGE, a custom Go-based ransomware specifically designed to encrypt AI model weights, training datasets, and vector databases. This incident highlights a shift toward AI-specific extortion tactics where the "crown jewels" are machine learning assets rather than standard business documents.
## Incident Details
- **Discovery Date:** July 2026
- **Incident Date:** July 2026
- **Affected Organization:** Not disclosed
- **Sector:** Technology / AI Research
- **Geography:** Global (GCP-based C2 infrastructure)
## Timeline of Events
### Initial Access
- **Date/Time:** July 2026
- **Vector:** Exploitation of CVE-2025-3248
- **Details:** The attacker exploited an unauthenticated endpoint (`/api/v1/validate/code`) on a Langflow server (versions < 1.3.0), allowing for arbitrary Python code execution.
### Lateral Movement
- **Adaptation Phase:** Over a period of 5 minutes and 24 seconds, the attacker revised six different Python scripts to find a path from the initial container to the host.
- **Method:** The attacker discovered the Docker socket (`/var/run/docker.sock`) and used it to escape the container environment and gain host-level access.
### Data Exfiltration/Impact
- **Impact:** Encryption of ~180 file types including `.safetensors`, `.pth`, `.onnx`, `.gguf`, and FAISS vector indexes.
- **Exfiltration:** No evidence of data exfiltration was found; the ransomware lacks networking code, suggesting a pure "encryption-for-extortion" model or a destructive intent.
### Detection & Response
- **Detection:** Sysdig researchers observed the live session and identified the `/.lockd` binary on the attacker’s C2.
- **Response:** Analysis of the binary confirmed the link to JADEPUFFER via the Proton Mail address used in the ransom note.
## Attack Methodology
- **Initial Access:** RCE via Langflow API vulnerability (CVE-2025-3248).
- **Persistence:** Self-deleting binary after execution; primarily focused on immediate impact.
- **Privilege Escalation:** Container escape via Docker socket manipulation.
- **Defense Evasion:** UPX 5.20 packing; hidden file naming (`/.lockd`); killing processes holding files open.
- **Credential Access:** Sweeping containers for cloud credentials and Docker sockets.
- **Discovery:** Reconnaissance of the filesystem for AI-specific file extensions and model stores.
- **Impact:** AES-256-CTR encryption (intermittent/partial for speed) of AI infrastructure files; renaming files to `.locked`.
## Impact Assessment
- **Financial:** Potential ransom demands (extortion via Proton Mail).
- **Data Breach:** High-value AI IP (model weights/datasets) rendered inaccessible.
- **Operational:** Total disruption of AI inference and training pipelines.
- **Reputational:** Risk associated with the loss of proprietary AI breakthroughs or training data.
## Indicators of Compromise
- **Network Indicators:** GCP-based C2 (Note: Specific IPs defanged in original report as "GCP command-and-control server").
- **File Indicators:**
- `encfile` (Internal project name)
- `/.lockd` (Packed binary)
- `.locked` (Encrypted file extension)
- `keyforge` (Internal keygen tool string)
- **Behavioral Indicators:** Multiple rapid revisions of Python scripts executed via `/api/v1/validate/code`.
## Response Actions
- **Containment:** System isolation to prevent the spread of encryption.
- **Eradication:** Removal of the ENCFORGE binary (though it self-deletes) and closing the Langflow RCE vulnerability.
- **Recovery:** Restoration of model weights and datasets from offline backups.
## Lessons Learned
- **Vulnerability Management:** CVE-2025-3248 had been in the CISA KEV catalog for months; failure to patch known exploited vulnerabilities remains the primary entry point.
- **Container Security:** Mounting the Docker socket inside a container provides a direct path for attackers to escape to the host.
- **AI Asset Value:** Attackers are now specifically profiling for AI-specific file formats, recognizing their high reconstruction cost.
## Recommendations
- **Immediate Patching:** Update Langflow to version 1.3.0 or later immediately.
- **Network Hardening:** Restrict access to AI orchestration APIs using firewalls or VPNs; do not expose `/api/v1/` endpoints to the public internet.
- **Principle of Least Privilege:** Do not mount `/var/run/docker.sock` in containers unless absolutely necessary.
- **Backup Strategy:** Maintain immutable, off-site backups of large-scale datasets and model weights to negate ransomware leverage.