Ransomware built to destroy AI models hit the same server twice, and the second attack could cost half a million dollars to undo
A hacker group exploited a 14-month-old security hole to deploy malware designed specifically to wipe out trained AI models worth hundreds of thousands of dollars. The ransom was uncollectable. The damage was not.
Key points
- Security firm Sysdig documented two separate attacks on the same unpatched server on July 1 and July 20, 2025, both carried out by a group it calls JADEPUFFER.
- The second attack deployed ENCFORGE, a piece of ransomware built specifically to destroy trained AI model files rather than general business data.
- Sysdig estimates replacing a single destroyed production AI model costs between $75,000 and $500,000.
- The entry point, a publicly known security flaw called CVE-2025-3248, had been listed as actively dangerous by US federal agencies since May 5, 2025, yet the server remained unpatched for over 14 months.
- In the first attack, the encryption key was generated randomly and never saved, making it a wiper disguised as ransomware: paying would have recovered nothing.
A hacker group broke into the same vulnerable server twice in three weeks. The first time they encrypted a company's configuration data. The second time they brought a weapon built for one purpose: erasing trained AI models that can cost hundreds of thousands of dollars and months of work to rebuild.
Security firm Sysdig published its findings after tracking both intrusions. The group behind them, which Sysdig calls JADEPUFFER, used the same front door both times.
What door did they walk through?
The vulnerability is CVE-2025-3248, a critical flaw in Langflow, a popular software tool that lets companies build AI-powered applications by connecting different services together visually, without writing much code. The flaw scores a 9.8 out of 10 on the standard severity scale used by security researchers.
The flaw let anyone who could reach the Langflow server send it Python commands and have them run. No password required. The US Cybersecurity and Infrastructure Security Agency added it to its list of known, actively exploited vulnerabilities on May 5, 2025, and set a federal deadline of May 26 to patch it. Langflow fixed the problem in version 1.3.0. The targeted server was still unpatched when JADEPUFFER came back in July, more than 14 months after the flaw was first publicly listed.
Security expert Mike Riemer from software firm Ivanti told VentureBeat that vendors have hardened the obvious entry points, so attackers now look for the back door. Once inside, they found an exposed Docker socket, a pathway that gives essentially full control over the underlying computer, not just the software running on it.
What makes ENCFORGE different from ordinary ransomware?
Ordinary ransomware encrypts everything it finds and demands payment for the key. ENCFORGE, a custom-built program written in the Go programming language, was designed around AI files specifically.
Sysdig found it targets roughly 180 file types. The list reads like a catalogue of AI development: PyTorch and TensorFlow checkpoints (files that store a model's learned knowledge at a point in time), Hugging Face SafeTensors weights (a common format for storing finished AI models), GGUF files (the format most people use to run AI models locally on their own computers), FAISS vector indexes (databases that help AI systems search through large amounts of information quickly), and training data stored in Parquet and NumPy formats. Generic ransomware hits these files only by accident. ENCFORGE names them deliberately.
The encryption itself uses AES-256-CTR, a strong encryption method, with a unique key for each attack, that key then locked inside the program using RSA-2048. Rather than encrypt entire large files, it encrypts sections of them, a speed trick established ransomware families use to cripple big files fast.
There is one extraordinary wrinkle. In the first attack, the encryption key was printed once to a computer screen and never saved anywhere. Paying the ransom would have recovered nothing. The tool was a wiper wearing a ransom note as a costume. Both ransom notes shared the same Proton Mail contact address, linking the campaigns to the same crew.
Why is losing a trained AI model so much worse than losing other data?
Restoring a wiped database from a Friday backup costs a weekend of lost transactions. Restoring a destroyed AI model costs everything the model learned, ever, with no row-by-row record to replay.
Sysdig puts the direct cost of rebuilding a single production-ready fine-tuned model (one that has been trained on a company's specific data to do a specific job) at $75,000 to $500,000. That figure reflects the cost of renting the specialist computer chips needed for training, plus the engineering time involved. Most teams keep several model versions on shared storage. If the training data sat on the same server as the model files, rebuilding is blocked until that dataset is reconstructed too.
Michael Clark, who leads Sysdig's threat research team, described the goal as destroying "the one thing an organization can't simply restore."
Security strategist Kayne McGladrey, a Senior Member of the IEEE (the world's largest professional association for engineers and technologists), said the problem is that security teams file these risks under the wrong category. Frame it as a cybersecurity issue and it loses budget fights. Frame it as a $500,000 business loss and a CFO acts.
What should organisations running AI infrastructure do right now?
Patch immediately. CVE-2025-3248 was fixed in Langflow 1.3.0. If you or your team run Langflow anywhere, confirm the version today.
The broader lesson is about what lives on the same server as a public-facing tool. JADEPUFFER found cloud credentials, database connection strings, and API tokens (digital keys that let software access other services) alongside the model files. Internal systems assumed to be safe because they sit behind another system were reachable once that outer layer fell.
| Attack | Date | Payload | Files targeted | Estimated damage |
|---|---|---|---|---|
| First campaign | July 1, 2025 | Encrypted 1,342 config items, dropped database tables | Config data | Data loss, recovery time |
| Second campaign | July 20, 2025 | ENCFORGE binary | AI model weights, training data | $75,000 to $500,000 per model |
| Flaw first catalogued | May 5, 2025 | CVE-2025-3248, score 9.8 | All Langflow servers | N/A |
| Patch available | Langflow 1.3.0 | Fix released before both attacks | All versions prior | Preventable |
About 7,000 Langflow instances sit exposed on the public internet, most of them in North America, first reported by VentureBeat in June. Each one holds credentials and live connections that look like exactly what JADEPUFFER came looking for.
The honest takeaway: back up your model weights the same way you back up your databases, store them separately from your training data, and treat a 9.8-severity patch notice as a 72-hour deadline, not a to-do list item.
