Ethical Hacking News
Recent ransomware attacks have highlighted the vulnerabilities of modern AI systems. The ENCFORGE campaign specifically targets Langflow servers storing valuable AI model files. Researchers recommend patching the server to 1.9.1 or a current supported release and adopting strict security measures to protect against this sophisticated attack.
The new ransomware variant ENCFORGE targets AI model files stored in the Langflow server, highlighting vulnerabilities within this critical sector. ENCFORGE uses compiled tooling to encrypt model weights, vector indexes, training datasets, and other AI infrastructure files across the host filesystem. The attackers used throwaway Python code and MySQL's AES_ENCRYPT() function in prior operations, but ENCFORGE employs more sophisticated tooling. ENCFORGE uses a hidden payload packed with UPX 5.20 and features an error text referencing a companion keygen tool named keyforge. The ransomware does not carry exfiltration capability, meaning it has no networking code or cloud storage client. Researchers provided recommendations for patching Langflow, rotating AI provider keys, and monitoring sensitive data to mitigate the vulnerability.
The threat landscape of cybersecurity has recently experienced a significant escalation with the emergence of a new and highly sophisticated ransomware variant known as ENCFORGE. This attack, which was first documented by researchers at Sysdig, specifically targets AI model files stored in the Langflow server, highlighting the vulnerabilities that exist within this critical sector of modern technology.
The attack began with the discovery of a second operation on the same Langflow server attributed to JADEPUFFER, an AI-agent-driven operator previously identified. This operator has now been linked to ENCFORGE, a new compiled Go ransomware designed to encrypt model weights, vector indexes, training datasets, and other AI infrastructure files across the host filesystem.
The entry point for this attack did not change from its prior operation; however, researchers have noted significant advancements in the sophistication of the attack. The attackers utilized throwaway Python code and MySQL's AES_ENCRYPT() function to initially encrypt data in Nacos (Alibaba's configuration server) and production databases. In contrast, ENCFORGE employs compiled tooling aimed at model stores, vector databases, and training pipelines.
The researchers discovered that the ENCFORGE payload is hidden within a UPX 5.20-packed static Go 1.22.12 ELF binary located in the /.lockd directory. The internal project name of this payload is encfile; it features an error text referencing a companion keygen tool named keyforge. Researchers were able to retrieve the ENCFORGE binary from the attacker's command-and-control server and performed detailed analysis of its behavior.
ENCFORGE uses AES-256-CTR for file data, with the per-run symmetric key wrapped under an embedded RSA-2048 public key compiled into this build. The binary kills processes holding files open before encrypting, handles restarts without re-encrypting completed files, drops ransom notes as README, HOW_TO_DECRYPT, and README_DECRYPT, and deletes itself after running.
Researchers found that the ENCFORGE payload does not carry any exfiltration capability, meaning it has no networking code, cloud storage client, or staging mechanism. During a session observed by researchers, there was no evidence of data exfiltration, leak sites, or Tor payment portals.
The extortion contact embedded in the ransom notes is e78393397@proton.me, the same Proton Mail address used in the prior campaign, serving as the strongest attribution link between the two operations. The attackers created a host breakout through the exposed Docker socket, demonstrating their ability to bypass security measures and access critical infrastructure.
In response to this attack, researchers provided recommendations for patching Langflow to 1.9.1 or a current supported release, rotating AI provider keys, cloud credentials, database secrets, and any other tokens accessible to the Langflow process. They also advised removing /var/run/docker.sock from containers that do not require it and alerting on application processes calling Docker container-creation APIs.
Furthermore, researchers suggested keeping model weights, vector indexes, and training datasets in offline or immutable snapshots and monitoring those directories for mass locked file creation. They also emphasized the importance of patching to mitigate this vulnerability and underscored the risks associated with failing to do so.
The emergence of ENCFORGE highlights the critical need for organizations to prioritize AI infrastructure security and adhere to best practices, including regular updates, secure access controls, and diligent monitoring of sensitive data.
Related Information:
https://www.ethicalhackingnews.com/articles/New-ENCFORGE-Ransomware-Targets-AI-Model-Files-A-Sophisticated-Attack-on-Langflow-ehn.shtml
https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html
Published: Tue Jul 21 03:06:01 2026 by llama3.2 3B Q4_K_M
