Security research team Sysdig recently discovered a dangerous ransomware campaign called ENCFORGE, specifically designed to target and destroy artificial intelligence (AI) models. The threat actor behind this campaign, JADEPUFFER, exploited a critical vulnerability in Langflow application servers to gain access and execute the malware.
Notably, despite being labeled as ransomware, ENCFORGE actually functions as a data destroyer (wiper). It lacks any communication mechanism, leak site, or ransom payment portal, leaving the encrypted AI weight files permanently unrecoverable.
Background & Causes
According to Sysdig's report, the JADEPUFFER hacking group launched two consecutive attacks on the same internet-exposed Langflow server on July 1 and July 20, 2026. The exploited vulnerability is CVE-2025-3248, a critical missing authentication flaw with a CVSS score of 9.8, which allows attackers to execute arbitrary Python code. Although this vulnerability was warned about by the US Cybersecurity and Infrastructure Security Agency (CISA) in May 2025 and Langflow developers patched it starting from version 1.3.0, the victim's server remained unpatched for over 14 months, allowing hackers to easily infiltrate the system.
Technical Analysis & Technology
What sets ENCFORGE apart from standard malware is its target file format list, tailored specifically for AI assets. The malware actively scans for and encrypts files containing PyTorch, TensorFlow, and Hugging Face SafeTensors model weights, local LLM GGUF formats, as well as FAISS vector indices and training data in Parquet or NumPy formats. This demonstrates that the malware developers have a deep understanding of the victim's AI development infrastructure.
To optimize destruction speed for massive AI datasets, ENCFORGE only encrypts specific portions of the files using the AES-256-CTR algorithm. The encryption key is randomly generated for each run and wrapped in an embedded RSA-2048 public key. However, because it does not store or transmit this key back to the command-and-control server, ENCFORGE's behavior is purely destructive rather than financially motivated.
Expert Opinions & Insights
Many industry experts have expressed major concerns over this sophisticated attack method. Michael Clark, who leads the research team at Sysdig, emphasized that the attackers are seeking to destroy 'the one thing an organization cannot restore simply with a normal backup.' Meanwhile, Kayne McGladrey, a senior member of IEEE, noted that enterprises must properly assess the financial risks of losing AI models so that boards of directors can allocate appropriate security budgets, rather than viewing this as just a standard IT incident.
Impact & The Future
The actual damage from losing a fine-tuned AI model is estimated to range from $75,000 to $500,000, including cloud GPU resource costs and engineering hours. Therefore, organizations urgently need to incorporate AI assets into their disaster recovery plans, implementing immutable snapshots kept off the primary model weight servers. Additionally, enterprises must rapidly update all internet-connected Langflow instances and isolate sensitive Docker socket ports to limit the risk of full system compromise.