The JADEPUFFER threat actor is actively exploiting a critical Langflow vulnerability, CVE-2025-3248, to run unauthorised Python code and deploy ENCFORGE ransomware. This attack targets AI models, training data and vector databases, putting sensitive intellectual property at risk.
How the Attack Unfolds: Exploiting Langflow CVE-2025-3248
The campaign begins with the exploitation of CVE-2025-3248, a severe missing-authentication flaw in the Langflow platform. Langflow is widely used to orchestrate and build AI data pipelines, making it a prime target for attackers seeking access to valuable machine learning assets.
This vulnerability resides in Langflow’s code-validation endpoint, which fails to enforce authentication. As a result, unauthenticated attackers can send specially crafted requests to execute arbitrary Python code on any exposed Langflow instance. This flaw provides a direct route to environments where cloud service keys, API tokens and database credentials are often accessible.
- Vulnerability: CVE-2025-3248 (missing authentication on code-validation endpoint)
- Product Affected: Langflow (specific versions not detailed in initial reporting, but all unpatched or exposed instances are at risk)
- Attack Vector: Remote, unauthenticated HTTP requests
- Initial Access: Arbitrary Python code execution
Langflow’s popularity in the AI development community, combined with default configurations that may leave endpoints exposed, amplifies the scale and urgency of this vulnerability.
JADEPUFFER’s Tactics: ENCFORGE Ransomware Deployment
Once inside a vulnerable Langflow environment, JADEPUFFER deploys ENCFORGE, a ransomware strain engineered to encrypt assets specific to AI workflows. This includes machine learning models, training datasets and vector databases that underpin search, recommendation and generative AI systems.
The ENCFORGE ransomware is notable for its focus on AI infrastructure, seeking out files and directories typical of model storage and dataset repositories. It encrypts these assets using robust cryptographic routines and then drops ransom notes demanding payment in exchange for decryption keys.
- Targeted Assets: AI models (such as PyTorch and TensorFlow files), training data (CSV, JSON, Parquet, etc.) and vector indexes (used in similarity search and retrieval tasks)
- Encryption Impact: Loss of access to proprietary models, intellectual property and the datasets required to retrain or restore services
- Ransom Demand: Victims receive instructions for cryptocurrency payment to recover their encrypted assets
Because AI model training and data collection are often time- and resource-intensive, the consequences of ENCFORGE’s encryption can be severe. Organisations face not only operational outages but also potential long-term damage to AI product development and research.
Timeline and Current Exploitation Status
The JADEPUFFER campaign was first identified in early June 2024, with attacks correlating with the public disclosure of CVE-2025-3248. Security researchers observed a sudden spike in unauthorised code execution attempts against Langflow endpoints exposed to the internet.
- Early June 2024: Vulnerability disclosure and initial scanning activity
- Mid June 2024: Confirmed ENCFORGE ransomware deployments traced to compromised Langflow servers
- Late June 2024: Ongoing exploitation, with evidence of opportunistic targeting and possibly automated attack scripts
At the time of writing, active exploitation of unpatched Langflow instances continues. There is no indication that JADEPUFFER is targeting specific sectors; rather, any internet-accessible Langflow deployment appears at risk. Security advisories recommend organisations check for indicators of compromise, such as unexplained Python process execution and the presence of ENCFORGE ransom notes.
Why This Attack Matters for AI and Data Security
This campaign marks a significant escalation in ransomware tactics, as attackers increasingly target the core assets of modern AI-driven organisations. The ability to encrypt not just databases but also models and training data raises the stakes for businesses investing in machine learning technology.
The attack demonstrates that as AI adoption grows, so too does the attack surface. Tools like Langflow, often deployed hastily to support rapid innovation, may lack hardening or proper access controls, making them attractive targets.
Immediate Steps for Organisations Using Langflow
- Apply all available patches for Langflow, prioritising fixes for CVE-2025-3248
- Restrict access to Langflow endpoints by enforcing authentication and network controls
- Remove any hard-coded secrets from Langflow configuration files
- Rotate API keys, cloud tokens and database credentials that may have been exposed
- Monitor for suspicious activity, especially unknown Python code execution or presence of ENCFORGE files
Organisations should review their AI infrastructure for other similar exposures, ensuring that only trusted users and systems can interact with critical pipelines and datasets.
Originally reported by cybersecuritynews.com.
