A ransomware attack in July exploited a known authentication flaw, CVE-2025-3248, in Langflow's code-validation endpoint to infiltrate systems and destroy AI model data. The same attacker breached the same internet-facing Langflow server twice—first on July 1 and again on July 20—with identical entry points but vastly different payloads. In the initial incident, the intruder used MySQL's encryption function to encrypt 1,342 Alibaba Nacos configuration items and dropped associated tables. The second attack deployed ENCFORGE, a custom Go-based binary designed specifically to target AI assets.
ENCFORGE scanned for and encrypted around 180 file types, with a clear focus on AI model components: PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors weights, GGUF format files used in local LLM deployment, FAISS vector indexes, and training data in Parquet and NumPy formats. Unlike generic ransomware, which encrypts files indiscriminately, ENCFORGE explicitly names AI-related extensions in its code, including LoRA adapters and legacy GGML weights, indicating a targeted design. Michael Clark, head of Sysdig's Threat Research Team, said the goal appeared to be destroying "the one thing an organization can't simply restore"—its trained models. The malware carried no network communication code, preventing it from receiving decryption keys or transmitting data, rendering the ransom demand ineffective.
The ransomware was built to erase AI model assets but lacked the infrastructure to collect payment, making the attack destructive rather than profitable. This suggests the motive may have been sabotage rather than extortion, especially given the precision in targeting irreplaceable training outputs. The repeated use of the same vulnerability indicates persistent failure to patch known flaws in AI development environments.
Editorial note: AI-assisted opinion, not established fact. Full disclaimer →
