New Ransomware Strain Targets AI Model Weights, and Even Paying Won't Get Them Back

A hacking group broke into the same exposed AI development server twice. The first time, they improvised. The second time, they came with a purpose-built tool designed to permanently destroy trained AI models.

Sysdig's Threat Research Team documented both intrusions, the first on July 1 and the second on July 20, according to VentureBeat. Both attacks exploited the same flaw: CVE-2025-3248, a missing-authentication bug in Langflow, an open-source tool used to build applications on top of large language models. The vulnerability lets anyone who can reach the server run Python code on it, no login required.

In the July 1 incident, the attacker encrypted 1,342 Alibaba Nacos configuration items using MySQL's own encryption function and dropped the database tables, VentureBeat reported. That was opportunistic. By July 20, the same server, still unpatched, got hit again. This time the payload was ENCFORGE, a compiled Go binary built to sweep roughly 180 file extensions tied specifically to AI infrastructure.

Built to hit models, not spreadsheets

Generic ransomware encrypts whatever it finds. ENCFORGE is different. Sysdig found it specifically targeting PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors weights, the GGUF format used in most local LLM deployments, FAISS vector indexes, and training data stored in Parquet and NumPy formats, according to VentureBeat.

Michael Clark, who leads Sysdig's threat research team, said the goal was destroying the asset an organization can't simply restore. Coverage from q2bstudio confirmed the malware scans for extensions like .pt, .bin, .h5, .npy, and .json, the standard formats for models and configuration files, and encrypts them with what q2bstudio described as a robust algorithm.

The technical design backs up that intent. ENCFORGE encrypts only regions of a file rather than the whole thing, using AES-256-CTR with a per-run key wrapped in an embedded RSA-2048 key, a speed technique established ransomware families use to disable large files fast, per VentureBeat. Even a flag in the binary for appending new file formats uses LoRA adapters and legacy GGML weights as its example. Whoever wrote this code knew exactly whose machines they were targeting.

There's no one to pay

ENCFORGE has no network functionality. Sysdig found no outbound connection in the binary, no leak site, and no payment portal, according to VentureBeat. The Proton Mail contact address in the ransom notes was identical across both campaigns, which is how Sysdig tied the intrusions to a group it tracks as JADEPUFFER.

The attacker stole credentials on the way in, but the ransomware itself can't send data out and can't process payment. Its only leverage is making files permanently unusable. In the first campaign, the encryption key was generated randomly, displayed once in the console, and never saved anywhere, according to VentureBeat. That means even a victim willing to pay would have nothing to pay for. It functioned as a wiper wearing a ransom note.

What losing a model actually costs

Restoring a corrupted database is a known, bounded problem. You pull the last snapshot and replay whatever transactions happened since. Restoring a fine-tuned AI model doesn't work that way, because nothing about the learning process is stored as replayable rows.

Sysdig estimates direct recovery costs for a single production-ready fine-tuned model at $75,000 to $500,000, reflecting cloud GPU costs across the training runs required plus the engineering hours behind them, according to VentureBeat. That's per model. Organizations commonly keep multiple variants on the same shared storage, meaning one successful attack can wipe out several models at once. If training data sits on the same host as the weights, as it often does, recovery is blocked entirely until the dataset itself is rebuilt from scratch.

Kayne McGladrey, an IEEE Senior Member with a career background in identity security, told VentureBeat that security teams have been losing this fight by treating AI infrastructure like any other application server rather than recognizing the unique, non-recoverable value of the assets sitting on it.

The bigger pattern

This isn't an isolated incident in an otherwise quiet week for AI security. Help Net Security's roundup of the same period noted a Hugging Face breach and a pre-authentication remote code execution flaw in ServiceNow being exploited in the wild, alongside new research from Bishop Fox showing exposed data across 166 tested ServiceNow instances using a scanning tool called Snowpick. Separately, researchers at the University of Texas at Dallas examined patch quality across 1,646 open-source vulnerabilities and found that fixes requiring multiple commits often leave the underlying flaw in place after the first patch.

The common thread across the reporting is a security industry playing catch-up with infrastructure that grew faster than the defenses around it. Langflow's CVE-2025-3248 remains exploitable on any internet-facing instance that hasn't been patched, and Sysdig's write-up doesn't indicate how many such servers remain exposed. Whether Langflow's maintainers have issued guidance beyond the patch itself, and how many organizations running the tool have actually applied it, remains an open question the current reporting doesn't answer.