[DigitalToday reporter Chi-gyu Hwang (황치규)] U.S. security firm Sysdig said the same attacker breached an internet-exposed Langflow server twice, and used dedicated ransomware targeting AI models called ENCFORGE in the second attack, VentureBeat reported on July 27 local time.

The first attack occurred on July 1, 2026, and the second on July 20, the report said. Both attacks exploited an authentication bypass vulnerability in Langflow's code validation function (CVE-2025-3248, CVSS 9.8) to run arbitrary Python code on the server. The second attack evolved beyond deleting data to encrypting the AI assets themselves.

Unlike typical ransomware, ENCFORGE is designed to target AI environments. It selectively encrypts PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors, GGUF model files, FAISS vector indexes, and Parquet and NumPy training data.

Sysdig assessed that the attack group JADEPUFFER focused on making corporate AI assets unusable rather than on money. The ransomware had no data exfiltration capability or negotiation infrastructure, and encrypted only parts of files using AES-256-CTR to quickly damage even large models, VentureBeat reported.

Unlike typical databases, AI models cannot be easily restored with backups alone. Sysdig estimated that rebuilding a single fine-tuned model used in production could cost about $75,000 to $500,000, including cloud GPU costs and engineering staff. If training data is also damaged, the cost and time needed for recovery increase further.

After failing to download malware, the attacker immediately changed strategy. It generated multiple Python scripts via Langflow and created an alternative path to escape a Docker environment in about 5 minutes, successfully running the ransomware. Security experts said such automation sharply reduces response time after an intrusion and increases the scale of damage.

The vulnerability was added in May 2025 to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, and Langflow fixed it in version 1.3.0. The targeted server had gone unpatched for more than 14 months, it was confirmed.