The cybersecurity landscape has added a threat as sophisticated as it is peculiar: ENCFORGE, a ransomware specifically designed to destroy trained artificial intelligence models, but with no mechanism to collect a ransom. This malicious software, detected by Sysdig's research team, does not seek money: it seeks to erase the most valuable asset of organizations investing in AI. The question is direct: what is the point of a data hijacking if the attacker cannot return it?
ENCFORGE operates through CVE-2025-3248, an authentication vulnerability in Langflow that allows remote Python code execution. The same entry vector was used in two separate campaigns: in the first, the agent improvised by encrypting Nacos configurations with MySQL's native functions; in the second, it already carried a compiled Go binary that sweeps over 180 file extensions. What sets ENCFORGE apart from other ransomware families is its surgical focus: it targets specific AI ecosystem formats such as PyTorch, TensorFlow, SafeTensors, GGUF, FAISS, Parquet and NumPy. While generic ransomware encrypts everything it finds, ENCFORGE names them explicitly, using LoRA adapters and GGML weights as examples in its flags. This reveals that whoever designed this tool knows the environment it attacks perfectly.
The ransomware includes no network code. There are no outbound calls, no payment portal, no data leak; the only pressure it exerts is destruction. It uses AES-256-CTR with a per-run key wrapped in an embedded RSA-2048 key, optimizing speed for large files. Michael Clark, leader of Sysdig's research team, sums it up: 'it destroys the one thing an organization cannot simply restore.' And indeed, while restoring a database from Friday's backup costs a weekend of transactions, recovering a fine-tuned model involves everything learned since that Friday, with no rows to replay. Rebuilding a production-ready model can cost between $75,000 and $500,000, according to Sysdig estimates, considering cloud GPU rates and engineering hours. And if training data resides on the same host as the weights, recovery is blocked until the dataset is rebuilt.
But there is an even darker detail: in the first campaign, the encryption key was generated randomly, printed once to the console, and never saved. That turned the payload into a wiper wearing a ransom note. Paying was not an option, and in the second campaign the design follows the same philosophy. ENCFORGE cannot exfiltrate anything, only destroy. Kayne McGladrey, IEEE Senior Member, points out that security teams lose these battles by classifying the exposure under the wrong heading: 'they should focus on business risks, not just cybersecurity risks, because if it doesn't affect financial losses, nobody will budget appropriately.' A destroyed model has a known replacement cost, and that is the version of the story a CFO understands.
Official guidance has not caught up. In May 2025, the NSA, CISA and the FBI published 'AI Data Security', the most authoritative document on the subject, which mentions three risks: the data supply chain, maliciously modified data, and data drift. They all ask whether the data can be trusted. ENCFORGE asks whether it still exists. And the answer for many organizations might be no.
The incident also reveals the attacker's agility. After confirming execution, the agent swept the host for cloud keys, connection strings and API tokens, and found the Docker socket at /var/run/docker.sock, which is functionally root. When it tried to download the binary from its C2 server, the fetch failed. Instead of retrying, it changed strategy and built six Python scripts through the Langflow channel, converging on a container escape in five minutes and 24 seconds. In the first campaign, that same behavior was a failed login diagnosed and fixed in 31 seconds. The problem got harder, but the method held.
Sam Evans, former CISO of Clearwater Analytics, puts it in budget terms: 'In security, it's all about dwell time. If a bad actor is in your environment for a while, dwell time increases, so the blast radius grows. The probability of it becoming a material incident is exponentially high.' Mike Riemer, SVP Network Security Group at Ivanti, has seen that pivot become standard: vendors hardened the front door, so attackers quit knocking. 'I can't get through the front door, so let me get somebody's house key, and I can make it through the back door with a house key,' he explains. Behind it sits everything teams assume is covered because it is not directly exposed to the internet, but it is not.
No one claimed a machine did this unsupervised. A human aimed the attack, and everything after ran with nobody at the keyboard. Heath Renfrow, co-founder and CISO of Fenix24, notes that when an agent compresses hours of operator work into minutes, 'defenders lose valuable time.' The door had been open for 14 months: CVE-2025-3248 carries a CVSS score of 9.8, CISA added it to the Known Exploited Vulnerabilities catalog on May 5, 2025, and Langflow fixed it in version 1.3.0. When JADEPUFFER (the group behind) returned in July 2026, the server was more than 14 months past that listing and already publicly documented as a breach victim.
Riemer puts a number on how little time that leaves: 'If I release a patch and a customer doesn't patch within 72 hours, they're open to exploitation, because that's how fast they can do it now.' Most customers need a week to patch manually. 72 hours versus 14 months: the gap stops reading as a slip. Nothing in either campaign was new. The first forged a Nacos admin token with a default signing key public since 2020, exploited CVE-2021-29441 (an authentication bypass Alibaba patched in 2021), and found a MinIO store on minioadmin:minioadmin. Sysdig counted over 600 payloads, every one leaning on a known misconfiguration or a patched bug left exposed. The second added an exposed Docker socket. Every weakness was routine. Assembling them at machine speed was not.
Langflow draws this attention because of what it holds. VentureBeat reported in June that roughly 7,000 instances are exposed, most in North America, holding provider API keys, cloud credentials and live connections to the vector stores ENCFORGE was built to encrypt. CISA has added five Langflow flaws to its catalog, two of them this month: CVE-2026-55255 (cross-tenant bypass, score 9.9) and CVE-2026-0770 (unauthenticated code execution via exec_globals parameter, score 9.8). None of this is an exotic environment. A Cloud Security Alliance survey of 418 professionals found that 82% of organizations had discovered AI agents nobody knew about, and 65% had handled an agent-related incident in the past year.
McGladrey traces the permission problem back four decades: companies always cloned one employee's access profile onto the next hire, and now do it with agents. An agent 'does whatever it needs to do to get its job done, and it uses far more permissions than it should, much more than a human would, because of the speed of scale and also intent.' Organizations investing in AI must review their security posture before the board asks. Evans recalls: 'Every time some new ransomware attack is published in the news, we get the inquiry from the board: what are we doing about this? And if it involves AI, it sparks their fear even more.'
Five things are worth answering this week, and none requires buying anything. First, get every internet-reachable Langflow instance onto the current supported release. Anything off it is exposed to at least one of the five flaws CISA has now listed. Second, review historical requests to /api/v1/validate/code for the exec_globals pattern. Third, get the Docker socket out of application containers. Langflow has no reason to create them; if the mount is required, front it with a socket proxy allowing only needed calls. Fourth, name model artifact paths in the backup plan. Immutable snapshots of checkpoints, vector indexes and training data, restore tested, data off the host holding the weights. Fifth, rotate every credential the host could reach, then pull provider keys out of its runtime. Patching does not revoke what already left. The first campaign harvested OpenAI, Anthropic and cloud credentials within seconds. Scope replacements to a secrets manager.
Detect mass .locked file creation in directories holding .gguf, .safetensors, .ckpt or .faiss files. Sysdig published a YARA rule and both hashes, neither with antivirus coverage at analysis time. It published no file count, so what is documented is a live encryption pass, not a measured loss. An attacker coming through an exposed AI framework now arrives carrying something built for what it connects to, and those assets are the ones a restore cannot reproduce. Model artifacts belong in the recovery plan next to the databases.
Under three weeks passed between Sysdig's two reports, all this attacker needed to go from improvised Python to a compiled locker. Speed is not the only worrying factor: the precision with which ENCFORGE targets AI models shows that cybercriminals have begun to understand the real value of the data they steal (or destroy). For companies developing AI-based applications, the lesson is clear: security cannot be limited to protecting traditional infrastructure. Intangible assets that differentiate the organization in the market must also be shielded.
At Q2BSTUDIO, as a software and technology development company, we understand that AI-driven digital transformation requires a comprehensive cybersecurity approach. It is not enough to implement advanced artificial intelligence solutions; they must be protected by design. We offer cybersecurity and pentesting services to identify vulnerabilities in AWS/Azure cloud environments, custom software, and BI/Power BI systems that integrate AI models. Additionally, we help organizations automate processes securely, ensuring that AI agents do not become an attack vector. Prevention, continuous monitoring, and rapid response are the keys to preventing a ransomware like ENCFORGE from turning the most valuable asset into digital ashes.
The ENCFORGE threat is not an anomaly; it is a sign of what is to come. AI models trained with millions of dollars in data and compute have become prime targets. Organizations must act now, not when the board asks. Because, as this case demonstrates, the ransom cannot always be paid, and sometimes it is never offered.
