Executive Summary
Sysdig linked a second attack on the same Langflow server to JADEPUFFER, which deployed ENCFORGE, Go ransomware built to encrypt model weights, vector indexes, training datasets and other AI files.
What Happened
Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator it first documented earlier this month. The same operator has now been spotted deploying ENCFORGE, a new compiled Go ransomware designed to encrypt model weights, vector indexes, training datasets, and other AI infrastructure files across the host filesystem. The entry
Affected Products
- Langflow
Vulnerability / Attack Technique
Ransomware targeting AI model and data files
Technical Mechanism
After the Langflow RCE, the operator deployed ransomware that searches the filesystem for AI artifacts and encrypts them.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
Relevant Frameworks
RealGround Analysis
Ransomware now targets model weights and vector stores specifically. RealGround analysis: back up AI artifacts like any critical data.
Recommended Controls
- Back up model weights, vector indexes and datasets offline
- Patch and isolate Langflow
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.