ENCFORGE勒索軟體鎖定AI模型：Langflow漏洞全解析 | ENCFORGE Ransomware Targets AI Models via Langflow Flaw

7月 26, 2026

By Kit 小克 | AI Tool Observer | 2026-07-27

🇹🇼 ENCFORGE勒索軟體鎖定AI模型：Langflow漏洞全解析

如果你的團隊用 Langflow 建 AI agent 或 RAG pipeline，這篇要認真看：一個叫 ENCFORGE 的新型勒索軟體，專門鎖定 AI 模型檔案下手，而且已經有真實受害案例。這不是又一次「AI 會毀滅人類」式的恐慌新聞，是很具體、你這週就該檢查伺服器版本的資安問題。

ENCFORGE 是什麼：專打 AI 模型檔案的勒索軟體

資安公司 Sysdig 揭露，一個代號 JADEPUFFER 的攻擊者最近把攻擊工具升級，部署了用 Go 語言寫的 ENCFORGE 勒索軟體。跟一般勒索軟體亂加密所有檔案不同，ENCFORGE 刻意鎖定約 180 種副檔名，包含：

Hugging Face SafeTensors 模型權重檔
PyTorch、TensorFlow 訓練產出的模型檔
llama.cpp 的 GGUF、GGML 量化模型
FAISS 向量索引與訓練資料集

換句話說，它不是要加密你的照片或文件，是衝著 AI 基礎設施來的。

攻擊怎麼進來的：Langflow 未授權 RCE 漏洞

入侵管道是 Langflow（熱門的低代碼 AI agent 建構工具）在 1.3.0 以前版本的一個漏洞 CVE-2025-3248，CVSS 高達 9.8 分。問題出在 /api/v1/validate/code 這個 API 端點完全沒有身分驗證，任何人都能透過它在伺服器上執行任意 Python 程式碼。這個漏洞早在 2025 年 5 月就被 CISA 列入「已知遭利用漏洞」名單，代表已經有真實攻擊在用它，不是理論風險。

為什麼這比一般勒索軟體更痛

安全研究估計，模型權重、訓練資料、向量索引一旦被加密銷毀，重新訓練或微調要花上數週到數月，單一模型的財務損失落在 7.5 萬到 50 萬美元之間，看模型規模而定。對很多還在燒錢做 fine-tuning 的 AI 新創來說，這筆帳可能比付贖金還痛。

該做什麼：不是等新聞，是現在動手

立刻檢查 Langflow 版本，未達 1.3.0 馬上升級
確認 /api/v1/validate/code 沒有暴露在公開網路
模型權重、資料集要有離線或不可變（immutable）備份，別只放在同一台被攻陷就全滅的機器上
用 EDR 監控 AI pipeline 主機的異常檔案加密行為，不是只防端點電腦

ENCFORGE 提醒我們一件事：AI 團隊把重心都放在「模型好不好用」，卻常常忘記部署它的基礎設施跟其他伺服器一樣會被打。資安不是加分項，是及格線。

好不好用，試了才知道。

🇺🇸 ENCFORGE Ransomware Targets AI Models via Langflow Flaw

If your team runs Langflow for AI agents or RAG pipelines, pay attention: a new ransomware strain called ENCFORGE is specifically targeting AI model files, and there are already real victims. This isn't another "AI will destroy humanity" scare story — it's a concrete security issue you should check this week.

What ENCFORGE Is: Ransomware Built for AI Model Files

Security firm Sysdig disclosed that a threat actor tracked as JADEPUFFER has upgraded its toolkit to deploy ENCFORGE, a ransomware locker written in Go. Unlike typical ransomware that encrypts everything indiscriminately, ENCFORGE deliberately targets roughly 180 file extensions, including:

Hugging Face SafeTensors model weights
PyTorch and TensorFlow training artifacts
llama.cpp GGUF and GGML quantized models
FAISS vector indexes and training datasets

It isn't after your photos or documents — it's built to hit AI infrastructure specifically.

The Entry Point: An Unauthenticated Langflow RCE

The attack chain runs through CVE-2025-3248, a flaw in Langflow versions before 1.3.0 with a CVSS score of 9.8. The /api/v1/validate/code API endpoint ships with no authentication, letting anyone execute arbitrary Python on the server. CISA added it to the Known Exploited Vulnerabilities catalog back in May 2025 — this is an actively exploited bug, not a theoretical risk.

Why This Hurts More Than Typical Ransomware

Researchers estimate that once model weights, training data, and vector indexes are encrypted or destroyed, retraining or re-fine-tuning can take weeks to months, with financial damage estimated between $75,000 and $500,000 per model depending on size. For AI startups already burning cash on fine-tuning, that bill can hurt more than paying the ransom.

What to Actually Do — Don't Wait for the Next Headline

Check your Langflow version now; upgrade past 1.3.0 immediately
Confirm /api/v1/validate/code isn't exposed to the public internet
Keep offline or immutable backups of model weights and datasets — not just on the same box an attacker can wipe
Monitor AI pipeline hosts for anomalous mass-encryption behavior, not just endpoint laptops

ENCFORGE is a reminder: AI teams obsess over whether the model is good, but often forget the infrastructure running it is a server like any other — and it gets attacked like one. Security isn't a bonus feature here; it's table stakes.

好不好用，試了才知道。

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

搜尋此網誌

AI小貼士