As reported by The Hacker News, Sysdig researchers have identified ENCFORGE — a compiled Go ransomware strain purpose-built to encrypt AI infrastructure assets — deployed by the JADEPUFFER threat operator through a Langflow remote code execution vulnerability. This is not simply another ransomware variant with a new name. It represents a meaningful shift in adversarial targeting logic that defenders must take seriously.

Ransomware Alert: As reported by The Hacker News, Sysdig researchers have identified ENCFORGE — a compiled Go ransomware strain purpose-built to encrypt AI infrastructure assets — deployed by the JADEPUFFER threat operator through a Langflow remote code execution vulnerability.

Why This Is Different from Traditional Ransomware

Most ransomware operates on a broad-spectrum encryption model: encrypt everything valuable, demand payment for decryption keys. ENCFORGE appears to be purpose-engineered for a specific class of victim — organizations running AI pipelines, machine learning platforms, and LLM-based applications. By targeting model weights, vector indexes, and training datasets specifically, the attacker is demonstrating a sophisticated understanding of where the real value lives in an AI-centric organization.

Consider what's at stake when a ransomware strain targets:

Why This Is Different from Traditional Ransomware
Model weights: Potentially months or years of training compute — often irreplaceable without significant cloud spend
Vector indexes: The semantic memory layer of RAG pipelines and agent architectures, built from proprietary document corpora
Training datasets: Curated, often licensed or internally generated data that cannot simply be re-downloaded
AI agent state files: Runtime context that may contain sensitive business logic or API credentials

For organizations that have invested heavily in fine-tuned models or proprietary embeddings, ENCFORGE-style attacks are potentially more damaging than traditional data encryption. Backup strategies designed for databases and file servers frequently do not extend to model artifact repositories and vector stores.

The JADEPUFFER Operator: Persistence and Sophistication

The fact that JADEPUFFER returned to the same Langflow server for a second intrusion — this time deploying ransomware after an initial access operation — is operationally significant. It suggests the operator conducts multi-stage campaigns: initial access for reconnaissance and credential harvesting, followed by a destructive or monetization payload once the target's value is confirmed. This dwell time between access and impact is precisely the window defenders must use for detection and response.

AI-agent platforms like Langflow are increasingly attractive initial access vectors because they are often deployed rapidly by data science teams outside traditional IT governance, with internet exposure and elevated system privileges — a combination that is nearly ideal for an attacker.

Vulnerability Context

Affected Platform
Langflow (AI agent orchestration framework)
Attack Class
Remote Code Execution (RCE) — consistent with CVE-2025-3248 (Critical, CVSS 9.8), a previously disclosed unauthenticated RCE in Langflow's code execution API endpoint
Exploitation Status
Actively exploited in the wild; CISA added CVE-2025-3248 to its KEV catalog in May 2025
Patch Availability
Patched in Langflow 1.3.0 and later; organizations should verify their deployed version immediately
Who Is at Risk
MLOps teams, AI/LLM application developers, enterprises running self-hosted Langflow instances — particularly those internet-exposed or lacking authentication enforcement

Shield53 Recommendations

Immediate Actions

  • Patch immediately: Upgrade Langflow to 1.3.0 or later. Treat any internet-facing Langflow instance as compromised until verified clean.
  • Audit exposure: Scan for Langflow instances using Shodan, Censys, or internal asset discovery. Any public-facing deployment without authentication is a critical risk.
  • Review logs for JADEPUFFER TTPs: Look for unusual process spawning from Langflow worker processes, outbound connections to unfamiliar IPs, and file system writes to model artifact directories.
  • Isolate AI infrastructure: Model weight repositories, vector databases, and training data stores should not be accessible from the same network segment as externally exposed application servers.

Longer-Term Defensive Posture

  • Extend backup coverage to AI artifacts: Ensure model weights, FAISS/Chroma/Pinecone snapshots, and training datasets are included in immutable, offsite backup policies — not just relational databases and file shares.
  • Implement file integrity monitoring on model directories: Tools like AIDE, Wazuh, or commercial EDR solutions should alert on bulk file modifications in ML artifact paths.
  • Apply network egress controls to AI agent runtimes: Langflow and similar platforms should operate under strict outbound allow-lists; anomalous C2 beaconing will not be detected if agents are permitted arbitrary internet access.
  • Include AI platforms in shadow IT discovery: Data science and engineering teams frequently spin up agent orchestration platforms without security review. ENCFORGE demonstrates why these tools require the same scrutiny as production web applications.

ENCFORGE is an early indicator of a threat category that will grow: ransomware operators adapting their tooling specifically for AI-native organizations. The security community's defensive frameworks for ransomware — backup strategies, segmentation, EDR detection rules — were built for traditional enterprise environments. Closing the gap before this threat class matures should be a board-level priority for any organization treating AI capability as a competitive asset.