Langflow Ransomware: ENCFORGE Targets AI Model Files via RCE (July 2026)

Langflow: What Happened

Researchers at Sysdig have confirmed that Langflow was targeted in a critical ransomware campaign orchestrated by the JADEPUFFER group. The attackers exploited a remote code execution (RCE) vulnerability—CVE-2025-3248—in Langflow versions prior to 1.3.0, gaining unauthorized access through the unauthenticated /api/v1/validate/code endpoint. Once inside, the threat actors deployed the Go-based ENCFORGE ransomware, which systematically encrypted AI model checkpoints, vector indexes, and training datasets. There is no current evidence of data exfiltration, but the attack resulted in significant disruption to AI production pipelines and model availability.

Attack Vector & Technical Detail

The initial access vector was CVE-2025-3248, a critical RCE vulnerability in Langflow that allowed unauthenticated attackers to execute arbitrary code via the /api/v1/validate/code endpoint. JADEPUFFER escalated privileges by leveraging access to the Docker socket, enabling host-level compromise. The ENCFORGE ransomware binary (SHA256 packed: 8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2; unpacked: ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328) was deployed to encrypt files using AES-256-CTR, appending a .locked extension before self-deletion. MITRE tactics observed include Initial Access (TA0001), Defense Evasion (TA0005), Credential Access (TA0006), Discovery (TA0007), and Impact (TA0040). The ransom note directed victims to contact e78393397@proton.me.

Confirmed Impact

ENCFORGE’s targeting of AI model checkpoints, vector indexes, and training datasets has led to the encryption of critical assets required for AI operations. Multiple specialized model variants and associated data were rendered inaccessible, with estimated reconstruction costs ranging from $75,000 to $500,000 per model. The campaign affected organizations globally, particularly those running unpatched Langflow instances. While no regulatory data exposure has been confirmed, the operational impact is severe, disrupting AI-driven services and research pipelines.

What This Means for Your Organization

Organizations leveraging Langflow for AI model development and deployment are at heightened risk if running versions prior to 1.3.0. The attack demonstrates how RCE vulnerabilities in AI infrastructure can be rapidly weaponized to disrupt business-critical operations. Immediate patching and restriction of exposed endpoints are essential. Regularly auditing Docker socket permissions and monitoring for unauthorized code execution can mitigate similar threats. Proactive defense is critical given the high cost and operational impact of AI model loss.

Detection & Response

• Immediate: Audit all Langflow deployments for unauthorized access and encrypted files with the .locked extension.
• Hunt: Search for the ENCFORGE ransomware binary SHA256 hashes (8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2, ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328) and related process activity.
• Patch: Upgrade Langflow to version 1.3.0 or later to remediate CVE-2025-3248 and audit for CVE-2026-33017 and CVE-2026-55255 as referenced in ongoing campaigns.

Source: https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html