New ENCFORGE ransomware attacks AI models: no ransom demanded, just destruction

What happened?

The threat group known as JADEPUFFER has launched a second wave of attacks against exposed Langflow servers, using a new ransomware dubbed ENCFORGE. According to Sysdig's report on July 20, the attack exploits the same vulnerability CVE-2025-3248 (missing authentication in Langflow's code validation endpoint) that enabled a first campaign on July 1. In that instance, the agent encrypted 1,342 Alibaba Nacos configuration items. In the second, the payload was completely different: a Go-compiled binary that scans approximately 180 file extensions, focusing on artificial intelligence assets.

ENCFORGE: a ransomware designed for AI

What sets ENCFORGE apart from other ransomware is its list of target extensions. Sysdig identified that it specifically targets PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors weights, GGUF format (used in local LLM deployments), FAISS vector indexes, and training data in Parquet and NumPy. While a generic ransomware encrypts everything it finds, ENCFORGE explicitly names these formats. Its flag for adding formats includes LoRA adapters and GGML weights as examples, demonstrating that the attacker knows exactly which machines they are attacking.

Michael Clark, leader of Sysdig's threat research team, described the goal as destroying "the one thing an organization cannot simply restore." ENCFORGE contains no network code: no outbound calls, no leak site, no payment portal. The only contact is a Proton Mail address identical in both ransom notes, linking the campaigns to the JADEPUFFER group. The agent steals credentials during access, but the ransomware cannot exfiltrate anything; its only pressure is to render files unusable. It encrypts regions of each file rather than the entire file, using AES-256-CTR with a per-execution key wrapped in an embedded RSA-2048 key, a speed optimization that established ransomware families use to damage large files quickly.

Why is this important?

The impact of this attack goes beyond data loss. Restoring a database from a Friday backup costs a weekend of transactions. But restoring a fine-tuned model costs everything learned since Friday, and none of that is stored as reproducible rows. Rebuilding a model is not a restoration job: Sysdig estimates that direct recovery of a production-ready fine-tuned model costs between $75,000 and $500,000, considering cloud GPU rates for the required training plus engineering hours. And that's per model; teams often maintain multiple variants on shared storage. If training data resides on the same host as the weights, recovery is blocked until the dataset is rebuilt. Paying is not an option: in the first campaign, the encryption key was randomly generated, printed once to console, and never saved, turning that payload into a wiper disguised as a ransom note.

Kayne McGladrey, IEEE Senior Member and identity security expert, noted that security teams lose these battles by classifying exposure under the wrong heading. Companies "should focus on business risks rather than some cybersecurity risk, because if it doesn't affect the business—like a financial loss—nobody will pay attention, they won't budget properly, nor put controls in place to prevent it." A destroyed model has a known replacement cost, which is the version of this story that management understands.

Consequences for businesses and users

This attack marks a before and after in AI security. Until now, ransomware focused on traditional data; now it targets the heart of AI systems: model weights. Companies deploying large language models (LLMs) or embedding-based recommendation systems must reconsider their backup strategies. Traditional backups do not cover model weights, and reconstruction can take weeks and cost hundreds of thousands of dollars.

Moreover, the lack of exfiltration and payment capability makes this ransomware purely destructive. There is no incentive to pay, but the damage is equally devastating. Organizations must implement specific security measures for AI assets: network segmentation, multi-factor authentication on model servers, and versioned backups of weights and training data.

What should readers know?

• Critical vulnerability: CVE-2025-3248 affects Langflow; any internet-exposed server without authentication is vulnerable. Patching or restricting access is urgent.
• Target assets: Files .pt, .pth, .ckpt, .safetensors, .gguf, .ggml, .bin, .index (FAISS), .parquet, .npy. If your organization handles these formats, you are a target.
• Ransom is useless: ENCFORGE cannot decrypt; it is a wiper. Do not pay, but also do not rely on backup restoration if weights are not included.
• Recovery cost: Between $75,000 and $500,000 per model. Justifies investment in proactive security.
• JADEPUFFER group: Active and evolving; went from attacking configurations to destroying AI models in weeks.

"A destroyed model has a known replacement cost, which is the version of this story that management understands." — Kayne McGladrey, IEEE Senior Member

Future implications

This attack is a wake-up call for the AI industry. Model security must be integrated into the AI development lifecycle, not an afterthought. Tools like robust authentication on model servers, encryption of weights at rest and in transit, and monitoring for anomalous access are essential. Additionally, the open-source community must review vulnerabilities in frameworks like Langflow, which have become gateways for targeted attacks.

The future points to industry-specific ransomware: AI models, genomic data, intellectual property. Companies must prepare not only to protect data, but to protect the knowledge embedded in their models.