New Ransomware Targets AI Model Weights, Leaving Victims with No Way to Restore

Ransomware attacks have evolved to target the most critical assets of modern businesses. In a recent series of breaches, an attacker exploited a known vulnerability in Langflow servers to deploy ENCFORGE, a ransomware variant specifically designed to destroy AI model weights. Sysdig's Threat Research Team documented these attacks on July 1 and July 20, highlighting the severity and sophistication of the threat.

The entry point for both campaigns was CVE-2025-3248, a missing-authentication flaw in Langflow’s code-validation endpoint that allows unauthorized users to execute Python code on the server. In the first attack, the attacker encrypted 1,342 Alibaba Nacos configuration items using MySQL's encryption function and dropped the tables. This was disruptive but not as targeted.

In the second campaign, ENCFORGE took center stage. This compiled Go binary is designed to target specific file extensions associated with AI models. Sysdig identified PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors weights, GGUF format files (common in local LLM deployments), FAISS vector indexes, and training data stored in Parquet and NumPy formats.

• Targeted File Extensions: The ransomware specifically targets file extensions associated with AI models.
  • PyTorch and TensorFlow checkpoints
  • Hugging Face SafeTensors weights
  • GGUF format files (common in local LLM deployments)
  • FAISS vector indexes
  • Training data stored in Parquet and NumPy formats

The specificity of the targeted file extensions indicates that the attacker has a deep understanding of the machine learning ecosystem. ENCFORGE’s ability to identify and encrypt these files suggests it was developed by someone familiar with the inner workings of AI model storage.

Michael Clark, who leads Sysdig's threat research team, emphasized the unique objective of this ransomware: "The goal is to destroy the one thing an organization can't simply restore." Unlike traditional ransomware that locks down entire systems, ENCFORGE focuses on making AI models unusable. It does not include network code or a payment portal, and there’s no exfiltration mechanism. The only pressure it applies is by rendering files unusable.

ENCFORGE encrypts regions of a file rather than the whole file, using AES-256-CTR with a per-run key wrapped in an embedded RSA-2048 key. This approach is common among ransomware families to quickly corrupt large files. The lack of exfiltration capabilities means that once the files are encrypted, they cannot be restored from backups or cloud storage.

The Financial Impact

Restoring a fine-tuned AI model can be a costly and time-consuming process. Sysdig estimates that direct recovery for a production-ready fine-tuned model ranges from $75,000 to $500,000. This cost includes:

• Cloud GPU rates across the training runs required to achieve a usable result
• Engineering hours dedicated to retraining and validating the model

These costs are per model, and many teams maintain multiple variants on shared storage. The financial impact can quickly escalate, especially for organizations that rely heavily on AI models for their operations.

Key Takeaways

1. Vulnerability Exploitation: CVE-2025-3248 remains a critical vulnerability in Langflow servers, allowing unauthorized code execution.
2. Targeted Ransomware: ENCFORGE is specifically designed to destroy AI model weights, targeting file extensions associated with machine learning frameworks.
3. Financial Impact: The cost of recovering fine-tuned models can range from $75,000 to $500,000 per model, reflecting the significant investment in cloud resources and engineering time.

The emergence of ENCFORGE underscores the evolving threat landscape in cybersecurity. Organizations must prioritize patch management, secure their internet-facing servers, and implement robust backup and recovery strategies to protect their valuable AI assets.