Langflow Vulnerability Exploited to Deliver Flodrix Botnet (Campaign)

The report describes exploitation of CVE-2025-3248 in Langflow — an unauthenticated RCE in the code validation endpoint that allows execution of attacker-supplied Python — used to deliver downloader scripts and the Flodrix botnet. Flodrix, an evolution of the LeetHozer family, establishes TCP/UDP C2 channels, performs DDoS and resource hijacking, supports self-deletion and anti-debugging, and can parse encrypted C2 configs; multiple active downloaders and evolving samples indicate an ongoing campaign.