New Ransomware Targets AI Model Weights, Lacks Exfiltration or Payment Mechanism

Ransomware Targets AI Assets

Sysdig's Threat Research Team identified a new ransomware variant, ENCFORGE, which specifically targets AI model weights and training data. This ransomware was deployed in a second attack campaign against an internet-facing Langflow server, following an initial attack that encrypted Alibaba Nacos configuration items.

Exploiting Langflow Vulnerability

Both attack campaigns utilized CVE-2025-3248, a missing-authentication flaw in Langflow's code-validation endpoint, allowing remote Python execution. The attacker, tracked as JADEPUFFER, changed the payload in the second incident to ENCFORGE, a compiled Go binary.

AI-Specific Destruction

ENCFORGE is designed to encrypt AI-specific file types, including PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors weights, GGUF format files, FAISS vector indexes, and Parquet and NumPy training data. Unlike generic ransomware that might accidentally encrypt such files, ENCFORGE explicitly targets these formats, indicating a specialized intent to destroy AI assets.

Unusual Ransomware Mechanics

The ransomware operates without network code, meaning it cannot exfiltrate data or communicate with a payment portal. Its sole function is to render files unusable by encrypting regions of them using AES-256-CTR with a per-run key wrapped in an embedded RSA-2048 key. This design suggests the attacker's primary objective is data destruction rather than financial gain through traditional ransom payment.

High Recovery Costs

Restoring fine-tuned AI models is significantly more complex and costly than restoring traditional databases. Sysdig estimates the direct recovery cost for a production-ready fine-tuned model to be between $75,000 and $500,000, factoring in cloud GPU rates for retraining and engineering hours. This highlights the severe impact of such attacks on organizations relying on AI models.