Ransomware built for AI weights signals a shift in attacker incentives
Sysdig's Threat Research Team documented two intrusions through the same exposed Langflow server, fourteen months apart. The first ran improvised Python against configuration files. The second brought ENCFORGE, a compiled Go binary whose extension list was written for AI infrastructure specifically. PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors weights, GGUF format files, FAISS vector indexes, LoRA adapters, Parquet and NumPy training data. Generic ransomware picks up model files because it encrypts everything. ENCFORGE names them.
That distinction matters because the recovery math is different from databases. Restoring a database from Friday's snapshot costs a weekend of transactions. Restoring a fine-tuned model costs everything learned since Friday, and none of it sits in replayable rows. Sysdig estimates direct recovery for a production-ready fine-tuned model at $75,000 to $500,000, reflecting cloud GPU rates across training runs plus engineering hours. That is per model, and teams typically hold several variants on shared storage. The figure makes the threat fundable in both directions: attackers can price it, and finance teams can approve defenses against it.
The campaign also shows what happens when paying fails as leverage. Sysdig found no outbound dial in the binary, no leak site, and no payment portal. The ransom note carried a Proton Mail contact tied to the actor tracked as JADEPUFFER, but the first campaign already demonstrated the designer's approach to negotiation. The encryption key was generated at random, printed to the console once, and never saved. That payload was a wiper wearing a ransom note. An organization that paid ENCFORGE would receive nothing the attacker had not already taken.
The entry point was CVE-2025-3248, a missing-authentication flaw in Langflow's code-validation endpoint that lets anyone with network access to the server execute Python on it. CISA added it to the Known Exploited Vulnerabilities catalog on May 5, 2025, with a federal deadline of May 26, and Langflow patched it in version 1.3.0. When JADEPUFFER returned in July, the server had been exposed for more than fourteen months and had already been documented publicly as a breach victim. The gap between a 72-hour exploit window and fourteen months of exposure stops reading as a patching failure and starts reading as a visibility failure.
Once inside, the attacker used Langflow's own execution channel to build escape scripts when the ransomware binary failed to download from the command-and-control server. Six Python scripts ran in sequence, each correcting a failure in the one before it. The final script found the host process ID through the Docker API, copied the binary across the namespace boundary, executed the encryption, and counted files to confirm it worked. The host escape took five minutes and 24 seconds. The first campaign's equivalent moment was a failed login that the agent diagnosed and fixed in 31 seconds. The problem got harder and the method held.
The Docker socket at /var/run/docker.sock is functionally root. Langflow has no legitimate requirement to create containers from within its application process. An organization running Langflow in a container should audit whether that socket is mounted into the workload and front it with a socket proxy allowing only the calls the application actually needs. If the mount is necessary, the blast radius already includes the host.
Langflow draws this attention because of what exposed instances hold. Roughly 7,000 sit reachable from the internet, most in North America, holding provider API keys, cloud credentials, and live connections to the vector stores ENCFORGE was built to encrypt. CISA has added five Langflow flaws to its Known Exploited Vulnerabilities catalog. CVE-2026-55255, a cross-tenant bypass rated 9.9 that lets any authenticated user on a shared instance run another tenant's flows with that tenant's credentials, was added July 7. CVE-2026-0770, an unauthenticated path to root code execution through the exec_globals parameter on the same validate endpoint JADEPUFFER used, rated 9.8, was added July 21. KEVIntel logged exploitation of CVE-2026-0770 from June 27, with more than 220 attempts across 64 addresses reaching past reconnaissance for AWS credentials and container metadata. Federal agencies had until July 24 to patch.
The source reports that 82% of organizations in a Cloud Security Alliance survey of 418 professionals had discovered AI agents nobody on the security team knew about, and 65% had handled an agent-related incident in the past year. The visibility gap that allows shadow AI deployment also allows shadow AI exposure. An agent that holds credentials to production services and is reachable from the internet is a persistent insider threat with a public address.
The official guidance has not caught up. The NSA's Artificial Intelligence Security Center, CISA, and the FBI published guidance in May 2025 co-sealed with the U.K., Australia, and New Zealand. The three risks it names are the data supply chain, maliciously modified data, and data drift. All three ask whether the data can be trusted. ENCFORGE asks whether the data still exists. That gap between what existing frameworks address and what the threat model requires is where organizations should be directing their next audit.
The core operational controls are not novel. Get every internet-reachable Langflow instance onto the current supported release, then review historical requests to the validate endpoint for the exec_globals parameter pattern. Name model artifact paths in the backup plan: immutable snapshots of checkpoints, vector indexes, and training data, restore tested, data off the host holding the weights. Rotate every credential the host could reach and scope replacements to a secrets manager, since the first campaign harvested OpenAI, Anthropic, and cloud credentials within seconds and patching does not revoke what already left. The detection opportunity is mass .locked file creation in directories holding .gguf, .safetensors, .ckpt, or .faiss files. Sysdig published a YARA rule and both hashes. At analysis time, neither had antivirus coverage.