A new ENCFORGE ransomware campaign is targeting AI model files through vulnerable Langflow servers. Researchers linked this attack to the same threat actor behind an earlier campaign. The attackers exploit exposed Langflow instances to gain remote access. Therefore, AI environments face an increasing ransomware risk. The campaign focuses on encrypting valuable AI assets instead of traditional business files.
Vulnerable Langflow Servers Enable the Attack
Researchers found that the attackers exploited an unauthenticated remote code execution flaw. The vulnerability allowed them to execute Python code on exposed servers. However, only unsupported Langflow versions remained vulnerable. After gaining access, the attackers searched for sensitive credentials inside the environment. Therefore, they quickly expanded their control beyond the initial server.
The attackers also searched for Docker socket access. This feature allowed them to reach the underlying host system. Furthermore, they repeatedly modified their attack scripts until they succeeded. The report showed that the operator adapted quickly when the first method failed. As a result, the attack continued despite early obstacles.
ENCFORGE Focuses on AI Infrastructure
Unlike traditional ransomware, ENCFORGE ransomware specifically targets AI infrastructure files. The malware encrypts AI model weights, vector indexes, training datasets, and machine learning files. Furthermore, it supports many AI-related file formats. Therefore, organizations running AI workloads face greater operational disruption.
Researchers explained that the ransomware uses strong encryption to lock selected file regions. It then renames affected files with a new extension. Furthermore, the malware creates ransom notes across the infected system. The ransomware also removes itself after completing the attack. As a result, recovery depends heavily on secure backups.
Smart Techniques Increase the Damage
Researchers found that the ransomware avoids unnecessary file encryption. Instead, it tracks completed work and resumes interrupted sessions efficiently. Furthermore, it closes active processes before encrypting files. Therefore, it increases the likelihood of successful encryption.
The report found no evidence that the ransomware steals data before encryption. However, the attackers still rely on encrypted files to pressure victims. They also use the same contact information observed in previous attacks. Therefore, researchers linked both campaigns to the same operator. This connection strengthens the overall attribution.
Attackers Adapt During Every Stage
Researchers observed the attackers continuously improving their methods. They created multiple Python scripts before achieving host-level access. Furthermore, they encoded their scripts to reduce detection. This approach helped avoid simple security monitoring. Therefore, the attack became harder to identify during execution.
The attackers eventually launched privileged containers with full host access. They then transferred the ransomware directly onto the host system. Furthermore, they tested the environment before starting encryption. This preparation reduced operational errors during the attack. As a result, the ransomware successfully targeted critical AI assets.
Why AI Organizations Should Act Now
Researchers estimate that rebuilding encrypted AI models could require significant time and computing resources. Training datasets and model weights often represent months of development work. Therefore, losing these assets can severely disrupt business operations. Organizations should treat AI infrastructure as a critical business resource. Strong recovery planning is now more important than ever.
The report also recommends updating vulnerable software immediately. Furthermore, administrators should rotate exposed credentials after applying security patches. Simply installing updates does not invalidate stolen credentials. Therefore, organizations should review every credential accessible to compromised systems. Continuous monitoring also helps detect suspicious activity early.
How to Prevent ENCFORGE Ransomware
Organizations should keep AI platforms updated, remove unnecessary Docker socket access, and secure sensitive AI assets with immutable backups. Furthermore, managed vulnerability assessment services can identify exposed systems before attackers exploit them.
In addition, managed detection and response services provide continuous monitoring to detect ransomware activity, unauthorized access, and suspicious behavior before critical AI models become encrypted.
Sleep well, we got you covered.
