AI-Driven Ransomware Threatens AI Infrastructure: Sysdig Reports New Findings
Recent investigations by cybersecurity researchers at Sysdig have unveiled a severe threat to artificial intelligence (AI) infrastructure via an evolving ransomware strain known as ENCFORGE. This ransomware is part of a broader campaign linked to the JADEPUFFER operator, which has previously exploited vulnerabilities in the Langflow server software. The apprehension surrounding these developments underscores the growing risks posed by cybercriminals targeting AI systems.
The vulnerabilities exploited are centered on Langflow versions prior to 1.3.0, which expose the /api/v1/validate/code endpoint without the necessary authentication protocols. This significant oversight permits remote attackers to execute arbitrary Python code on the server, leading to critical security breaches. This flaw, classified under CVE-2025-3248, has a concerning CVSS score of 9.8 and has been included in the Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities catalog since May 2025.
Researchers recount that the previous assaults employed rudimentary Python scripts and the MySQL function AES_ENCRYPT() to encrypt vital components of infrastructure, including production databases and configuration servers, particularly targeting Nacos from Alibaba. However, the newly identified ENCFORGE payload showcases a marked evolution in tactics, migrating from basic scripts to sophisticated compiled Go ransomware specifically designed to encrypt model weights, vector indexes, training datasets, and other essential AI infrastructure files.
The Mechanics of ENCFORGE
The new ransomware variant was secretively retrieved from the attacker’s command-and-control (C2) server, ingeniously concealed under the filename /.lockd. This obfuscation strategy prevents casual discovery, as a direct request to /lockd returns a 404 error. Sysdig identified this binary as a UPX 5.20-packed static Go 1.22.12 ELF file. During their examination, threat intelligence platforms yielded no detections on either the packed or unpacked file hashes, indicating a novel and undetected threat.
ENCFORGE is built with a range of file extensions in mind, indicative of its focus on AI environments; it covers extensions associated with popular platforms such as PyTorch and TensorFlow. The binary uses AES-256-CTR for file encryption, cleverly opting to encrypt selected regions of files rather than entire files in their entirety, thereby optimizing speed—a strategy that mirrors methods employed by other high-profile ransomware strains like LockBit.
Upon successful encryption, each targeted file is renamed with a .locked extension. The ransomware extinguishes any processes holding the files prior to encryption and self-deletes after executing its payload. The ransom notes left behind inform victims of the attack, although researchers found no evidence of data exfiltration; the only leverage for the operators resides in the encrypted data.
JADEPUFFER’s Operational Tactics
The attack mechanism of JADEPUFFER is nothing short of intricate. After gaining initial access to the Langflow server, it conducted systematic credential sweeping within the Docker environment. When initial attempts to pull ENCFORGE from its GCP command-and-control server failed, the operator proceeded to adapt its strategy. Over several minutes, it crafted six Python scripts, improving upon each version to effectively gain access to the host and deploy its ransomware.
These scripts were built incrementally while employing base64 encoding to elude signature-based detections. The operator ultimately employed the Docker API to establish a privileged container, accessing host process namespaces to facilitate the encrypted deployment directly on the host.
Mitigation Measures for Affected Organizations
In light of these developments, Sysdig emphasizes the critical importance of patching Langflow to version 1.9.1 or a more recent release. Organizations must also undertake several proactive measures, including:
- Rotating Keys: Existing AI provider keys and cloud credentials must be rotated to mitigate risks from previously harvested credentials.
- Addressing Docker Misconfigurations: Organizations are urged to restrict access to the /var/run/docker.sock to essential containers only, treating any unrestricted access as a significant misconfiguration.
- Monitoring Processes: Alerts should be set on applications that call Docker container creation APIs, focusing on privileged or host-mode containers.
- Protecting Model Artifacts: Keeping critical model weights and datasets in offline or immutable snapshots and monitoring directories for unusual activity or mass file encryption attempts will be of utmost importance.
The repercussions of a ransomware attack targeting AI infrastructure can be staggering, with estimates suggesting that reconstructing a production AI model could cost between $75,000 and $500,000. Given the intertwined nature of AI models and their training datasets, the ramifications of not securing these assets could devastate operations.
Conclusion: The Imperative to Act
As the landscape of cyber threats continues to evolve, organizations reliant on AI technologies must prioritize safeguarding their infrastructures. The findings from Sysdig’s report serve as a stark reminder that the risks posed by AI-targeted ransomware are profound. Organizations should act swiftly not only to protect their current assets but also to ensure they are prepared for the evolving nature of threats in this domain. Failing to do so could render them vulnerable to potentially catastrophic data losses and significant financial repercussions.