New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack

Sysdig researchers observed JADEPUFFER, an AI-agent-driven threat operator, exploiting a Langflow RCE to deploy ENCFORGE — a compiled Go ransomware engineered to encrypt AI model weights, vector indexes, training datasets, and Langflow pipeline definitions — representing a targeted escalation that threatens AI-dependent organizations; the report details the attack chain, technical profile, affected targets, and mitigation steps including patching, isolation, and offline backups.