ENCFORGE: The Ransomware That Goes After AI Brains, Not Your Spreadsheets
Sysdig says the same crew that broke into a Langflow server earlier this month is back, and this time it encrypts model weights instead of office files.
Key points
- Sysdig researchers have linked a second attack on a Langflow server to a group they call JADEPUFFER.
- The group deployed a new strain of ransomware, written in Go, that Sysdig has named ENCFORGE.
- ENCFORGE is built to lock up AI model weights and vector indexes rather than office documents.
- The break-in used a flaw in Langflow, an open-source tool for building AI agents.
- Sysdig first documented JADEPUFFER on 2 July, describing it as an AI-agent-driven operator.
A new ransomware strain, malicious software that scrambles a victim's files and demands payment to unscramble them, has turned up with an unusual target list. It doesn't want your invoices.
Security firm Sysdig says a group it tracks as JADEPUFFER hit the same Langflow server twice in a matter of weeks. Langflow is an open-source tool that developers use to wire up AI agents, small automated programs that call large language models to do work. The second visit brought something new: ransomware Sysdig is calling ENCFORGE. We first reported on JADEPUFFER on 2 July, when Sysdig described a large language model handling intrusion, lateral movement and database destruction without a human at the keyboard.
ENCFORGE is written in Go, a programming language from Google that produces small, fast programs running on almost any operating system. That's a common choice for modern malware: one build works everywhere.
How did the hackers get in?
Through Langflow itself. JADEPUFFER exploited a remote code execution flaw in the tool. Remote code execution, or RCE, means an attacker can send a request over the internet that tricks the server into running their commands. Once that works, dropping ransomware onto the machine is the easy part.
The fact that the same server was hit twice suggests it was never fully cleaned up after the first intrusion, or the Langflow instance was never patched. Both are depressingly normal. CISA added a Langflow authorisation bypass to its must-patch list on 8 July after Sysdig spotted attackers stealing cloud keys.
Why target AI files at all?
Because they're worth money and hard to restore.
Most ransomware scans for documents and backups. ENCFORGE hunts for model weights, the huge numerical files that make up a trained AI model, along with vector indexes (search databases used by AI systems) and training datasets. A trained model can represent months of compute time and a serious cloud bill. Vector indexes are often rebuilt from customer data that may no longer exist in the same form. Unlike a file server full of Word documents, there's often no clean nightly backup of any of it.
Lock the weights and you've got the victim cornered in a way they can't resolve by restoring from tape.
Honesty requires a note here. Strip away the AI branding and ENCFORGE is a Go binary that walks the filesystem and encrypts files matching certain extensions. That pattern is a decade old. The novelty is the target list, not the mechanism. It's closer to a classic file-encrypting worm with a taste for .safetensors than to some exotic new class of attack.
The target list still matters. It tells you where criminals think the money is now.
Should you worry if you run Langflow?
Patch it, and assume any exposed instance has already been probed. Langflow servers sitting on the public internet with default settings are exactly what attackers scan for. If yours is one of them, treat it as suspect until proven otherwise and check whether unfamiliar Go binaries have appeared on the host.
For everyone else, the lesson is quieter. AI systems are production infrastructure now. They need the same hygiene you already apply to databases: patching, network segmentation, offsite backups. The attackers have clearly figured that out.
