Sysdig Threat Research Team documented two break-ins against the same internet-facing Langflow server: the first campaign on July 1 and a second on July 20. The attacker used the same entry point in both incidents, but the payload changed dramatically between the two intrusions.
How the intrusions occurred
Both attacks exploited CVE-2025-3248, an authentication-bypass flaw in Langflow’s code-validation endpoint that allows anyone who can reach the server to execute Python. In the first campaign the actor improvised: it encrypted 1,342 Alibaba Nacos configuration items using MySQL’s encryption function and then dropped the tables. In the second campaign the attacker deployed ENCFORGE, a compiled Go binary that sweeps roughly 180 file extensions.
ENCFORGE is built for AI assets
The list of targeted extensions reveals the intent. Sysdig found PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors weights, the GGUF format used by many local LLM deployments, FAISS vector indexes, and training data in Parquet and NumPy formats among the targeted types.
Generic ransomware often encrypts model files by accident because it encrypts everything; ENCFORGE explicitly names and seeks them. Its format-appending flag uses LoRA adapters and legacy GGML weights as examples — knowledge that signals the attacker understands these systems and the environments they run in.
Michael Clark, who leads Sysdig’s threat research team, framed the goal as destroying “the one thing an organization can’t simply restore.” ENCFORGE contains no network code: Sysdig found no outbound dialing in the binary, no leak site and no payment portal. Both ransom notes included the same Proton Mail contact, which ties the campaigns to the actor group Sysdig tracks as JADEPUFFER.
The locker’s encryption method targets speed and destruction rather than exfiltration. It encrypts regions of files rather than entire files, using AES-256-CTR with a per-run key wrapped by an embedded RSA-2048 key — a common ransomware optimization to ruin large files quickly.
Why model weights are uniquely costly to lose
Restoring a database from a recent snapshot may cost a weekend of transactions; restoring a fine-tuned model erases everything learned since that snapshot because model training is not a sequence of rows that can be replayed. Sysdig estimates direct recovery costs for a production-ready fine-tuned model at between $75,000 and $500,000, reflecting cloud GPU time across the training runs required and the engineering hours behind them. That is a per-model figure; teams commonly keep several variants on shared storage.
If training data sits on the same host as weights, recovery is blocked until datasets are rebuilt. Paying a ransom may not help: in the first campaign the encryption key was generated at random, printed once to the console and never saved, effectively making the payload a wiper with a ransom note.
Kayne McGladrey, an IEEE Senior Member with a career in identity security, told VentureBeat that security teams often misclassify these exposures and therefore fail to budget for them. A destroyed model has a measurable replacement cost — the kind of metric a CFO is likely to act on.
Guidance, exploits and a rapid escape
In May 2025 the NSA’s Artificial Intelligence Security Center, CISA and the FBI published “AI Data Security,” highlighting risks in the data supply chain, maliciously modified data and data drift. ENCFORGE’s effect is different: it asks whether the data still exists.
The campaign also showed an operationally clever escape. After confirming execution, the agent searched the host for cloud keys, connection strings and API tokens, replayed them against internal database and cache services, and found the Docker socket at /var/run/docker.sock — which effectively grants root. The attacker tried to pull a ransomware binary from its command-and-control server but the fetch failed.
Instead of retrying that download, the actor pivoted: it built six Python scripts through the Langflow channel and converged on a working host escape in five minutes and 24 seconds, each script correcting the previous failure. The final script used the Docker API to find the host process ID, copied the binary across the namespace boundary, ran the encryption, and counted files to confirm success. In the first campaign a similar behavior fixed a failed login in 31 seconds.
Human role, automation and dwell time
TechCrunch reported on July 6 that the initial operation still required a human to pick the target and stand up infrastructure; Sysdig could not trace the root credentials. The second intrusion ran without an operator at the keyboard.
Heath Renfrow, co-founder and CISO at breach-recovery firm Fenix24, warned that compressing hours of operator work into minutes robs defenders of critical reaction time. Sam Evans, then CISO at Clearwater Analytics, emphasized dwell time: the longer an attacker has access, the larger the blast radius and the higher the likelihood of a material incident.
Mike Riemer, Ivanti’s SVP Network Security Group and Field CISO, said attackers have adapted to hardened front doors by stealing internal credentials or keys and using them to move through less protected paths. Many weaknesses exploited in these campaigns were routine misconfigurations or old, patched bugs left exposed; assembling them at machine speed is what made the operations effective.
Patch delays and exposed instances
CVE-2025-3248 has a CVSS score of 9.8. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on May 5, 2025, with a federal remediation deadline of May 26; Langflow fixed it in version 1.3.0. When JADEPUFFER returned in July 2026, the server was over fourteen months past that listing and already publicly documented as a breach victim.
Sysdig noted none of the campaign techniques were novel. The first campaign forged a Nacos admin token using a default signing key public since 2020, exploited CVE-2021-29441 (an Alibaba authentication bypass patched in 2021), and found a MinIO store with minioadmin:minioadmin credentials. Sysdig counted more than 600 payloads, each leaning on a known misconfiguration or a patched bug left exposed. The second campaign added an exposed Docker socket. Every weakness was routine; what changed was the attacker’s ability to chain them automatically.
Langflow draws attention because of the sensitive material it often holds. VentureBeat reported in June that roughly 7,000 Langflow instances are exposed — most in North America — containing provider API keys, cloud credentials and live connections to the vector stores ENCFORGE was designed to encrypt. Riemer warned that placing security at the network edge invites the world to the edge of the network.
CISA has added five Langflow flaws to its KEV catalog, two of them in July. CISA added CVE-2026-55255 on July 7, a cross-tenant bypass that let any authenticated user on a shared instance run another tenant’s flows with that tenant’s credentials (rated 9.9 and fixed in 1.9.1). On July 21 CISA added CVE-2026-0770; Trend Micro found an unauthenticated path to root code execution through the exec_globals parameter on the same validate endpoint JADEPUFFER abused, and rated it 9.8. KEVIntel logged exploitation attempts from June 27, recording more than 220 attempts across 64 addresses. According to KEVIntel founder Ryan Dewhurst speaking to BleepingComputer, payloads went beyond reconnaissance for AWS credentials and container metadata. Federal agencies had until July 24 to respond.
These are not edge-case environments: a Cloud Security Alliance survey of 418 professionals, commissioned by Token Security, found 82% of organizations had discovered AI agents nobody knew about and 65% had handled an agent-related incident in the past year.
Immediate mitigation steps
Security experts suggest five actions that require no new purchases:
- Bring every internet-reachable Langflow instance to the current supported release. Anything older is exposed to at least one of the five flaws CISA listed; review historical requests to /api/v1/validate/code for the exec_globals pattern.
- Remove the Docker socket from application containers. Langflow has no legitimate reason to create it; if it is required, put a socket proxy in front that only allows necessary calls.
- Name model artifact paths in the backup plan. Keep immutable snapshots of checkpoints, vector indexes and training data; test restores and keep backups off the host that stores weights.
- Rotate every credential the host could have reached, then remove provider keys from runtime. Patching does not revoke credentials that already left the environment: the first campaign harvested OpenAI, Anthropic and cloud credentials within seconds.
- Detect mass .locked file creation in directories holding .gguf, .safetensors, .ckpt or .faiss files. Sysdig published a YARA rule and both hashes; the observed behavior is a live encryption pass rather than a measured file count.
Conclusion
An attacker who gains access to an exposed AI framework can now bring a payload built specifically to destroy the artifacts it connects to — assets that conventional backups may not reproduce. Model artifacts must be included in recovery planning alongside databases. Between Sysdig’s two reports, fewer than three weeks passed and the attacker progressed from improvised Python to a compiled locker, underlining how rapidly risk can escalate.
