{ "id": "a82a524e-8c00-4dd9-888f-6ad4ca22bc20", "created_at": "2026-07-28T02:02:23.356917Z", "updated_at": "2026-07-28T02:03:56.336437Z", "deleted_at": null, "sha1_hash": "0db8db2e5125f1538359240aabf69f4a1c3c97af", "title": "New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 835035, "plain_text": "https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html\n\nNew ENCFORGE Ransomware Targets AI Model Files in\n\nLangflow RCE Attack\n\nBy The Hacker News\n\nPublished: 2026-07-21 ยท Archived: 2026-07-28 02:00:16 UTC\n\nResearchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-\n\ndriven operator it first documented earlier this month.\n\nThe same operator has now been spotted deploying ENCFORGE, a new compiled Go ransomware designed to\n\nencrypt model weights, vector indexes, training datasets, and other AI infrastructure files across the host\n\nfilesystem.\n\nThe entry point did not change. Langflow versions before 1.3.0 expose the /api/v1/validate/code endpoint\n\nwithout authentication, allowing any remote attacker to execute arbitrary Python on the server. The flaw, CVE-\n\n2025-3248 , carries a CVSS score of 9.8 and has been in CISA's Known Exploited Vulnerabilities catalog since\n\nMay 5, 2025.\n\nAs The Hacker News reported earlier this month, the prior operation used throwaway Python code and MySQL's\n\nAES_ENCRYPT() function to encrypt and destroy data in Nacos (Alibaba's configuration server) and production\n\ndatabases.\n\nThe new ENCFORGE payload replaces those improvised scripts with compiled tooling aimed at the model stores,\n\nvector databases, and training pipelines the first campaign swept for credentials.\n\nPage 1 of 5\n\nhttps://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html\n\nThe ENCFORGE Payload\n\nResearchers retrieved the binary from the attacker's command-and-control server, where it was hidden as\n\n/.lockd ; a direct request to /lockd returns 404, and the leading dot keeps it off a plain directory listing. The\n\nfile is a UPX 5.20-packed static Go 1.22.12 ELF.\n\nThreat intelligence platforms returned no detections on either the packed or unpacked hash at the time of Sysdig's\n\nanalysis. The internal project name is encfile ; the binary's error text references a companion keygen tool named\n\nkeyforge . Both strings survive recompilation of the same codebase and serve as stable detection anchors.\n\nIts default extension list covers PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors, ONNX\n\ninterchange format, GGUF (the current standard for locally deployed LLMs) and its predecessor GGML, FAISS\n\nvector indexes, Parquet and Arrow training datasets, NumPy arrays, and TensorFlow records.\n\nAn --include flag lets the operator append additional file globs; the built-in help text uses LoRA fine-tuning\n\nadapters and legacy GGML weights as examples. The full list runs to approximately 180 extensions. Those\n\nexamples point directly at AI environments; a generic file locker would have little reason to name LoRA adapters\n\nor legacy GGML weights. Researchers read the choice as deliberate targeting, not incidental coverage.\n\nENCFORGE uses AES-256-CTR for file data, with the per-run symmetric key wrapped under an embedded RSA-\n\n2048 public key compiled into this build. Rather than encrypting whole files, it encrypts selected regions, the\n\nsame speed optimization LockBit and BlackCat-class lockers use.\n\nEach processed file is renamed with a .locked extension. The binary kills processes holding files open before\n\nencrypting, handles restarts without re-encrypting completed files, drops ransom notes as README ,\n\nHOW_TO_DECRYPT , and README_DECRYPT , and deletes itself after running.\n\nPage 2 of 5\n\nhttps://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html\n\nThe recovered ENCFORGE binary has no exfiltration capability. It carries no networking code, cloud storage\n\nclient, or staging mechanism, and researchers found no evidence of data exfiltration, a leak site, or a Tor payment\n\nportal during the session it observed. Its only leverage is the encrypted data.\n\nThe extortion contact embedded in the ransom notes is e78393397@proton.me , the same Proton Mail address\n\nused in the prior campaign. Sysdig describes this as the strongest attribution link between the two operations.\n\nResearchers disclosed one observed session, did not name the organization, and provided no victim count or\n\nevidence of another ENCFORGE deployment.\n\nFrom Langflow to the Host\n\nAfter confirming code execution, JADEPUFFER swept the container for credentials and found the Docker socket\n\nat /var/run/docker.sock . Its first attempt to pull ENCFORGE from the GCP command-and-control server\n\nfailed. Rather than stopping, it adapted.\n\nOver five minutes and 24 seconds, the operator created and revised six Python scripts through the same Langflow\n\nRCE channel until it had a working path to the host. The first script was built one line at a time, keeping any\n\nsingle request inert for signature-based inspection.\n\nStarting with the second, the operator encoded each full script in base64 and decoded it inside an exec() call,\n\navoiding shell-level searches for commands such as base64 -d . The final version used the Docker API to spin\n\nup a privileged container with the host PID namespace and root filesystem mounted, located the target process,\n\ncopied ENCFORGE through /proc/\u003cpid\u003e/root , then ran it on the host via nsenter .\n\nAcross all iterations, the containers were created with Privileged: true , PidMode: host , NetworkMode:\n\nhost , and the root filesystem bind-mounted read-write. That is host root.\n\nPage 3 of 5\n\nhttps://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html\n\nBefore the live run, the operator launched --try-run to scan the filesystem, then --lock for the live encryption\n\npass. The final script checked process status, read the lock log, and counted files ending in .locked .\n\nResearchers did not publish the resulting count; the disclosed evidence establishes a live encryption attempt, not\n\nhow many model or dataset files were successfully encrypted.\n\nSysdig assessed the --task-id gcp_h1 flag as evidence the operator was tracking this host as a GCP target\n\nwithin a broader campaign; a try-run earlier in the session used task ID gcp_test . The report disclosed no\n\nadditional victims or deployment sites.\n\nResearchers documented the prior JADEPUFFER campaign correcting a failed Nacos login in 31 seconds. The\n\nsame pattern held here against a harder problem: the operator built a host breakout through the exposed Docker\n\nsocket when its preferred delivery route was blocked.\n\nPatch Langflow, Then Protect the Models\n\nResearchers estimate that rebuilding a production AI model once it has been encrypted could cost between\n\n$75,000 and $500,000 per model in cloud GPU compute and engineering time.\n\nProduction environments often run multiple specialized variants on shared storage, so a single ENCFORGE run\n\ncould encrypt multiple variants stored on the same accessible filesystem. If training data sits on the same host, the\n\norganization has to reconstruct it before any retraining can start.\n\nBinary SHA-256: packed 8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2 ; unpacked\n\nea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328 .\n\nSysdig has published the source and C2 addresses, the embedded RSA-2048 key fingerprint, and a YARA rule in\n\nits full report.\n\nUpgrade Langflow to 1.9.1 or a current supported release. Version 1.3.0 closed CVE-2025-3248 , the entry\n\nvector for this campaign, but CISA has since added two more Langflow vulnerabilities to its KEV catalog:\n\nCVE-2026-33017 , an unauthenticated RCE flaw fixed in 1.9.0, added to KEV March 25, 2026; and CVE-\n\n2026-55255 , a cross-user authorization bypass fixed in 1.9.1, added July 7, 2026.\n\nRotate AI provider keys, cloud credentials, database secrets, and any other tokens accessible to the\n\nLangflow process. Patching does not revoke credentials already harvested through a vulnerable instance.\n\nRemove /var/run/docker.sock from any container that does not require it. Where socket access is\n\nunavoidable, scope it through a narrowly configured proxy; a standard Langflow deployment generally has\n\nno need to create containers, and unrestricted Docker socket access should be treated as a misconfiguration.\n\nAlert on application processes calling Docker container-creation APIs, containers launched with\n\nPrivileged: true or PidMode: host , host-root bind mounts, and nsenter execution from inside a\n\ncontainer.\n\nPage 4 of 5\n\nhttps://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html\n\nKeep model weights, vector indexes, and training datasets in offline or immutable snapshots. Monitor those\n\ndirectories for mass .locked file creation.\n\nThe Hacker News contacted Sysdig's Threat Research Team for further detail on the fleet campaign scope and\n\nattribution confidence; Sysdig had not responded by publication.\n\nModel artifacts now belong in the same recovery tier as source code and production databases. An organization\n\nthat can rebuild the application but cannot restore its weights, indexes, or training state has no clean route back.\n\nFound this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content\n\nwe post.\n\nSource: https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html\n\nPage 5 of 5", "extraction_quality": 1, "language": "EN", "sources": [ "MISPGALAXY", "Malpedia" ], "origins": [ "web" ], "references": [ "https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html" ], "report_names": [ "new-encforge-ransomware-targets-ai.html" ], "threat_actors": [], "ts_created_at": 1785204143, "ts_updated_at": 1785204236, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/0db8db2e5125f1538359240aabf69f4a1c3c97af.pdf", "text": "https://archive.orkl.eu/0db8db2e5125f1538359240aabf69f4a1c3c97af.txt", "img": "https://archive.orkl.eu/0db8db2e5125f1538359240aabf69f4a1c3c97af.jpg" } }