A recent cyberattack has brought to light a significant vulnerability in AI infrastructure as researchers from Sysdig have identified a new ransomware strain named ENCFORGE. This ransomware targets AI model weights, vector indexes, and training datasets, encrypting these critical files and leaving organizations at risk of significant loss. The malicious activity was traced back to the JADEPUFFER operator, who exploited the Langflow server vulnerability, identified as CVE-2025-3248. This flaw allows remote execution of Python code on servers running Langflow versions prior to 1.3.0. ENCFORGE uses AES-256-CTR encryption in combination with RSA-2048 to lock files, leveraging encrypted data as its primary extortion tool.
The attack method was sophisticated, beginning with an entry through the Langflow server and advancing with a series of Python scripts. Despite initial setbacks, the attackers adapted quickly, using the Docker API to deploy a privileged container and execute the ransomware. This process highlights the advanced skills of the attackers, as they successfully bypassed traditional security measures. Notably, the ransomware does not exfiltrate data, focusing solely on encryption, which underscores its reliance on ransom payments for decryption.
Victim organizations face potential costs ranging from $75,000 to $500,000 to rebuild a single production AI model. This financial burden emphasizes the importance of robust backup and recovery strategies. The attack demonstrates a targeted approach, specifically against AI environments, as evidenced by the ransomware's default extension list, which includes formats like PyTorch and TensorFlow checkpoints.
Sysdig has shared detailed indicators of compromise, including file hashes and YARA rules, to aid in detection and prevention. The investigation continues, with Sysdig's Threat Research Team working to uncover the full scope of the campaign and its implications for AI security.