ENCFORGE: The Ransomware That Goes After AI Brains, Not Your Spreadsheets
Sysdig says the same crew that broke into a Langflow server earlier this month is back, and this time it encrypts model weights instead of office files.
Key points
- Sysdig researchers have linked a second attack on a Langflow server to a group they call JADEPUFFER.
- The group deployed a new strain of ransomware, written in the Go programming language, that Sysdig has named ENCFORGE.
- ENCFORGE is built to lock up AI model files, training data and vector indexes rather than the usual office documents.
- The break-in used a flaw in Langflow, an open-source tool for building AI agents.
- Sysdig first documented JADEPUFFER earlier in the same month, describing it as an AI-agent-driven operator.
A new kind of ransomware, which is malicious software that scrambles a victim's files and demands payment to unscramble them, has turned up with an unusual target. It does not want your invoices. It wants the AI.
Security firm Sysdig says a group it tracks as JADEPUFFER hit the same Langflow server twice in a matter of weeks. Langflow is an open-source tool that developers use to wire up AI agents, the small automated programs that call large language models to do work. The second visit brought something new: a piece of ransomware Sysdig is calling ENCFORGE.
ENCFORGE is written in Go, a programming language from Google that produces small, fast programs that run on almost any operating system. That is a common choice for modern malware because one build works everywhere.
What makes it interesting is what it goes after.
Most ransomware scans a hard drive for documents, databases and backups. ENCFORGE hunts for model weights, which are the huge number files that make up a trained AI model, along with vector indexes (search databases used by AI systems) and training datasets. In other words, the expensive, hard-to-replace stuff that a company building AI products actually cares about.
How did the hackers get in?
Through Langflow itself. Sysdig's earlier writeup, reported alongside coverage from The Hacker News, described JADEPUFFER exploiting a remote code execution flaw in the tool. Remote code execution, or RCE, means an attacker can send a request over the internet that tricks the server into running commands for them. Once that works, the server is theirs.
From there, dropping a piece of ransomware onto the machine is the easy part.
The fact that the same server was hit twice suggests it was never fully cleaned up after the first intrusion, or the underlying Langflow instance was never patched. Both are depressingly normal.
Why target AI files at all?
Because they are worth money and they are hard to restore.
A trained model can represent months of compute time and a serious cloud bill. Vector indexes are often rebuilt from customer data that may no longer exist in the same form. Training datasets are sometimes curated by hand. Unlike a file server full of Word documents, there is often no clean nightly backup of any of it.
That makes an AI startup a tempting mark. Lock the weights, and you have leverage the victim cannot shrug off by restoring from tape.
It is worth being honest about the analogy here. Strip away the AI branding and ENCFORGE is a Go ransomware binary that walks the filesystem and encrypts files matching certain extensions. That is a pattern security teams have seen for a decade. The novelty is the target list, not the mechanism. It is closer to a classic file-encrypting worm with a taste for .safetensors than it is to some exotic new class of attack.
Still, the target list matters. It tells you where the criminals think the money is now.
What should teams running Langflow do?
Patch it, and assume any exposed instance has already been poked at. Langflow servers sitting on the public internet with default settings are the kind of thing attackers scan for constantly. If yours is one of them, treat it as suspect until proven otherwise, and check whether unfamiliar Go binaries have appeared on the host.
For everyone else, the lesson is quieter. AI systems are becoming production infrastructure. That means they need the same boring hygiene, patching, network segmentation, backups you already apply to databases. The attackers have clearly figured that out.
