New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack

ENCFORGE: Ransomware Built to Destroy AI Infrastructure

Security researchers at Sysdig have identified a novel ransomware strain dubbed ENCFORGE being deployed against AI infrastructure through the actively exploited Langflow remote code execution (RCE) vulnerability. The campaign is attributed to JADEPUFFER, an AI-agent-driven threat operator that Sysdig first documented earlier in July 2026.

What Happened

Sysdig researchers tracking JADEPUFFER activity observed the threat actor returning to the same compromised Langflow server for a second wave of attacks. This time, the operator deployed ENCFORGE — a newly identified ransomware written in compiled Go — designed specifically to target the file types that constitute AI infrastructure:

• Model weights (.bin, .pt, .safetensors, .gguf and similar formats)
• Vector indexes (embedding stores used by RAG pipelines)
• Training datasets (curated data used to fine-tune models)
• Langflow workflow definitions (automation pipelines)

This represents a significant escalation in ransomware targeting, moving beyond traditional business data to attack the intellectual property and operational core of AI-dependent organizations.

Who Is JADEPUFFER?

JADEPUFFER is a threat operator distinguished by its use of AI agents in attack orchestration — one of the first documented examples of adversarial AI-assisted cyber operations at scale. Sysdig first profiled JADEPUFFER in early July 2026 after observing automated reconnaissance, lateral movement, and payload delivery that appeared to be driven by AI decision-making rather than direct human operation.

The AI-agent-driven nature of JADEPUFFER's operations enables the operator to scale attacks, adapt to defenses autonomously, and execute multi-stage intrusions faster than traditional human-operated campaigns.

Langflow: The Entry Point

Langflow is an open-source visual framework for building AI agentic workflows and LLM pipelines. It has seen rapid adoption by organizations deploying custom AI assistants, RAG systems, and automation pipelines.

JADEPUFFER is exploiting a remote code execution vulnerability in Langflow to gain initial access to AI infrastructure environments. Once inside:

1. Initial Access — Langflow RCE exploitation
2. Persistence — foothold established on AI server
3. Reconnaissance — enumerate model files, datasets, pipeline configs
4. Payload Delivery — ENCFORGE ransomware deployed
5. Encryption — AI model weights, vector indexes, training data encrypted
6. Extortion — ransom demand for decryption + threat of data destruction/leak

This is notably the second attack on the same server, suggesting either inadequate remediation after the first intrusion or deliberate re-exploitation of a known-good foothold.

ENCFORGE Technical Profile

ENCFORGE is a purpose-built Go ransomware — compiled Go binaries are popular with threat actors because they produce standalone executables with no runtime dependencies and are cross-platform compilable.

Unlike commodity ransomware that targets document and database files, ENCFORGE's file targeting logic suggests it was engineered specifically for AI environments — making it a novel and targeted threat rather than a generic ransomware deployment.

Why AI Model Files Are High-Value Ransomware Targets

Encrypting AI model weights and training datasets can be catastrophic for organizations:

• Model weights represent months or years of compute investment — retraining from scratch after destruction could cost hundreds of thousands to millions of dollars
• Vector indexes built from proprietary data are often irreplaceable without re-embedding entire document corpora
• Training datasets may be curated from internal sources that cannot be easily reconstructed
• Business continuity — AI-dependent services go offline immediately when model files are inaccessible

This creates extreme extortion leverage, particularly for organizations where AI models are core to product delivery.

Affected Organizations

The Langflow RCE has affected a broad range of organizations deploying AI infrastructure. The JADEPUFFER/ENCFORGE campaign specifically targets:

• Companies running self-hosted Langflow instances
• Organizations with exposed AI pipeline servers (unpatched or misconfigured)
• Enterprises with valuable proprietary AI models and datasets

Defensive Recommendations

Immediate Actions

1. Patch Langflow immediately — update to the latest version addressing the RCE vulnerability. Check Langflow's GitHub releases for the current patched version.

2. Audit Langflow access — review who has network access to Langflow instances:

# Check exposed Langflow ports
netstat -tlnp | grep 7860
ss -tlnp | grep langflow

3. Isolate AI infrastructure — Langflow and model-serving endpoints should not be internet-facing without strong authentication and network controls.

4. Back up model files offline — maintain offline, air-gapped copies of model weights and training datasets:

# Example: rsync model files to offline backup
rsync -av --progress /models/ /backup/offline-models/

Longer-Term Hardening

AI Infrastructure Security Checklist:
- Place Langflow behind VPN or zero-trust network access
- Require authentication for all AI API endpoints
- Implement file integrity monitoring on model directories
- Maintain versioned, immutable backups of model weights
- Monitor for unusual file access patterns in model directories
- Apply principle of least privilege to model-serving processes
- Keep all AI framework dependencies patched

Broader Context: AI Infrastructure as an Attack Surface

The JADEPUFFER/ENCFORGE campaign reflects an emerging threat trend: adversaries now recognize AI infrastructure as high-value extortion targets. As organizations invest heavily in proprietary models and AI pipelines, the stakes of an AI infrastructure ransomware attack grow significantly.

Security teams building AI stacks should treat model weight storage, inference servers, and AI pipeline frameworks with the same rigor as production databases — complete with access controls, monitoring, backup strategies, and patch management.

Sysdig published the original research on JADEPUFFER. The Hacker News reported on the ENCFORGE deployment. CosmicBytez Labs will update this article as additional technical details emerge.

Related Reading

• Critical Palo Alto VPN Bug Now Exploited by Qilin Ransomware Gang
• Anubis Ransomware Claims Coca-Cola Fairlife Attack
• CISA Flags Langflow RCE as Actively Exploited