New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack

Summary

A new ransomware, ENCFORGE, targets AI model files and infrastructure. It exploits a Langflow vulnerability (CVE-2025-3248) to gain RCE and deploy the Go-based ransomware. The attack is attributed to the JADEPUFFER operator, with strong links through a Proton Mail address. Recommendations include patching Langflow, rotating credentials, and securing AI artifacts.

Key Takeaways

1. ENCFORGE, a new Go ransomware, targets AI model weights, vector indexes, training datasets, and other AI infrastructure files.
2. The attack exploits a critical vulnerability (CVE-2025-3248) in Langflow versions before 1.3.0, allowing unauthenticated remote code execution.
3. The ransomware deployment is linked to the JADEPUFFER operator, with a shared Proton Mail address serving as a strong attribution link.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents technical details about a ransomware attack, including specific file types targeted and attack vectors. It cites a cybersecurity research firm, Sysdig, for its findings, lending it credibility. However, it lacks direct quotes from the attackers or independent verification beyond the cited source.

Bias assessment: Technical Reporting. The article focuses on the technical aspects of a cybersecurity incident, detailing the ransomware's functionality and the attack method. It avoids sensationalism and presents information factually, with a clear aim to inform about a new threat.

Note: This article provides a detailed technical analysis of a new ransomware. Readers should cross-reference with other cybersecurity reports for a broader understanding of the threat landscape.

Credibility flag: Technical Insight

Claimed Facts (8)

• This is a factual statement reporting the findings of a research firm.
• This statement describes the new ransomware and its capabilities as observed by researchers.
• This details the specific technical vulnerability and its consequences.
• This provides specific identifiers and status for the vulnerability.
• This describes the encryption methodology used by the ransomware.
• This states a specific observable action performed by the ransomware.
• This provides a concrete piece of evidence linking the current and previous attacks.
• This presents a quantifiable estimate of the potential damage.

Opinions (4)

• This is an interpretation by the researchers about the attacker's intent.
• This is a conclusion drawn by the researchers based on the evidence.
• This is a recommendation or assessment of the importance of AI artifacts.
• This is a statement about the consequences and difficulty of recovery.

Claims (3)

• While stated as a fact, the absence of a capability can be difficult to definitively prove and might be subject to change or evasion tactics not yet observed.
• This is a statement about the absence of evidence, which is not the same as evidence of absence. Future versions or other observed instances might differ.
• This indicates incomplete information due to a lack of response from a key source, leaving potential gaps in the analysis.

Key Sources

• The Hacker News — Cybersecurity News Outlet
• Sysdig — Cybersecurity Research Firm