Ransomware targets AI model files but lacks a payment path

Sysdig’s Threat Research Team documented two intrusions against the same internet-facing Langflow server on July 1 and July 20, both exploiting CVE-2025-3248, a missing-authentication flaw in Langflow’s code-validation endpoint. The first campaign encrypted 1,342 Alibaba Nacos configuration items and dropped tables, while the second deployed ENCFORGE, a compiled Go ransomware binary that swept roughly 180 file extensions.

ENCFORGE was built to target AI assets including PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors weights, GGUF files, FAISS vector indexes and training data in Parquet and NumPy. Sysdig found no outbound network code, leak site or payment portal, leaving the malware with no apparent way to collect a ransom. The locker encrypts file regions under AES-256-CTR with a per-run key wrapped in an embedded RSA-2048 key.

The operational risk centers on recovery. Sysdig estimates direct recovery for a production-ready fine-tuned model between $75,000 and $500,000, and recovery can fail if training data is stored on the same compromised host. The attacker also adapted quickly after a failed binary download, building Python scripts through Langflow to escape the container and run encryption via the exposed Docker socket.