Particle.news

Agentic Hacker Returns to Langflow With Ransomware Built to Wipe AI Models

The ENCFORGE locker escapes containers to run on host filesystems and encrypts model checkpoints and training data, creating costly gaps that backups may not close.

Overview

  • Sysdig researchers reported Monday that the operator known as JadePuffer re-entered a previously breached Langflow instance and staged a UPX-packed Go ransomware called ENCFORGE that was built to target AI assets.
  • The intrusion used an unauthenticated Langflow code‑validation flaw (CVE-2025-3248) to run Python for reconnaissance, then abused an exposed Docker socket and iterated six delivery scripts over about five minutes to spawn a privileged container and break out to the host.
  • ENCFORGE encrypts files with AES-256 in counter mode and wraps keys with an embedded RSA-2048 public key, kills processes holding files, appends .locked, self-deletes after running, and shows no built-in data-exfiltration or leak-site capability.
  • The binary deliberately targets roughly 180 AI and ML file types, including PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors, GGUF/GGML weights, FAISS vector indexes, Parquet and TFRecord datasets, which could force model rebuilds costing an estimated $75,000 to $500,000 per model.
  • Researchers urge immediate fixes and hardening: upgrade Langflow to 1.3.0 or later, remove or proxy /var/run/docker.sock, run containers as non-root, apply filesystem ACLs or immutable snapshots to model and data directories, and deploy machine-speed detection and automated containment.