Overview
- Sysdig researchers reported Monday that the operator known as JadePuffer re-entered a previously breached Langflow instance and staged a UPX-packed Go ransomware called ENCFORGE that was built to target AI assets.
- The intrusion used an unauthenticated Langflow code‑validation flaw (CVE-2025-3248) to run Python for reconnaissance, then abused an exposed Docker socket and iterated six delivery scripts over about five minutes to spawn a privileged container and break out to the host.
- ENCFORGE encrypts files with AES-256 in counter mode and wraps keys with an embedded RSA-2048 public key, kills processes holding files, appends .locked, self-deletes after running, and shows no built-in data-exfiltration or leak-site capability.
- The binary deliberately targets roughly 180 AI and ML file types, including PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors, GGUF/GGML weights, FAISS vector indexes, Parquet and TFRecord datasets, which could force model rebuilds costing an estimated $75,000 to $500,000 per model.
- Researchers urge immediate fixes and hardening: upgrade Langflow to 1.3.0 or later, remove or proxy /var/run/docker.sock, run containers as non-root, apply filesystem ACLs or immutable snapshots to model and data directories, and deploy machine-speed detection and automated containment.