MarGib – The World Behind the Keyboard: ENCFORGE: New ransomware encrypting AI models – how it works and how to defend against it in 2026

ENCFORGE: New ransomware encrypting AI models – how it works and how to defend against it in 2026

MarGib October 18, 2026

🌐 🇵🇱 Polski · 🇬🇧 EN

In June 2026, the cybersecurity world was shaken by news of a new threat – ENCFORGE ransomware, which specializes in attacks on artificial intelligence models. Why now? Because AI infrastructure has become a lucrative target, and vulnerabilities in popular tools like Langflow are opening doors for cybercriminals. In this article, we will take a look at how ENCFORGE works, why it targets AI files, and – most importantly – how to protect yourself against it.

Illustration of ENCFORGE ransomware attacking artificial intelligence models, with encrypted files in the background. — ENCFORGE ransomware attacking AI models – threat visualization.

What is ENCFORGE ransomware and why is it unique?

ENCFORGE is a ransomware discovered in June 2026 that stands out from other threats due to one key element: its primary targets are files associated with artificial intelligence models. It does not encrypt entire drives or office documents – instead, it hunts for model weights, configurations, and training data, making it particularly dangerous for companies and developers working with AI.

Unique features of ENCFORGE

Selective encryption: It attacks only files with extensions typical for AI, such as .bin (model weights), .pt (pytorch), .h5 (tensorflow/Keras), or .onnx (ONNX Runtime). This makes the attack faster and harder to detect than traditional ransomware.
Encryption algorithm: It uses AES-256 in CFB (Cipher Feedback) mode, which ensures a high level of security for encrypted data – but simultaneously makes it impossible to recover without the key.
No central C2 server: Communication with the command server takes place via a decentralized TOR and IPFS network, which makes it difficult to track the attackers and block their infrastructure.
Ransom demands: Victims receive a note ENCFORGE_README.txt with payment instructions in the cryptocurrency Monero (XMR). Amounts range from 0.5 to 50 XMR (equivalent to tens to hundreds of thousands of PLN), depending on the size of the company.

Interestingly, ENCFORGE is not limited to model files. It also encrypts metadata, configurations, and training data, which can paralyze the work of entire AI teams. Unlike traditional ransomware that blocks access to the operating system, ENCFORGE operates "silently" – the system runs normally, but key files become useless.

Where did the name ENCFORGE come from?

The ransomware's name comes from a combination of two elements: ENC (from "encryption") and FORGE, which refers to the AES-CFB (Cipher Feedback) algorithm. This is an unusual approach to naming, suggesting that the creators of ENCFORGE wanted to emphasize the technical aspect of their creation.

How does infection occur? ENCFORGE attack mechanisms

ENCFORGE does not appear out of nowhere – it exploits specific vulnerabilities and attack vectors to gain access to systems. Here are the most common infection methods:

1. Exploiting a vulnerability in Langflow (CVE-2026-4567)

The most high-profile attack vector is a vulnerability in the popular Langflow platform, used for building and deploying AI models. In July 2026, a vulnerability CVE-2026-4567 was discovered that allows for Remote Code Execution (RCE) via malicious API requests. The vulnerability affects Langflow versions from 0.6.x to 1.2.0 and was only patched in version 1.2.1 (released on July 2, 2026).

How does the attack work?

The attacker sends a specially crafted request to the /api/v1/flows endpoint in Langflow.
Malicious code is executed on the server with application privileges.
ENCFORGE is downloaded and executed, starting the AI file encryption process.

Importantly, the vulnerability affects both open-source versions and commercial implementations of Langflow. The platform's creators have issued an official statement on the matter, recommending an immediate update.

2. Phishing and fake updates

The second popular attack vector is phishing campaigns. Cybercriminals send emails impersonating updates for Langflow or other AI tools, for example:

Fake notifications about a "critical security patch" for Langflow.
Offers for "free AI model optimization tools."
Invitations to webinars or AI security training.

Hidden in attachments or links are malicious files that, when executed, install ENCFORGE.

3. Malicious Python packages on PyPI

In July 2026, several fake packages were discovered in the PyPI repository, impersonating legitimate AI libraries. An example is the package langflow-secure-updater, which, upon installation, downloaded and executed ENCFORGE. This is further proof that cybercriminals are increasingly using trusted sources to distribute malware.

4. Attacks on clouds and stolen API keys

ENCFORGE is not limited to local machines. Attackers also use stolen API keys for clouds (AWS, GCP, Azure) to gain access to AI models stored in the cloud. In several cases, victims reported that their models were encrypted directly in services such as Amazon S3 or Google Cloud Storage.

Why did Langflow become a target?

Langflow is an open-source platform for building and deploying AI models that gained popularity due to its simplicity and flexibility. Unfortunately, its architecture has several weak points that make it susceptible to attacks:

1. Lack of default API authentication

In older versions of Langflow, the API was available by default without authentication, meaning anyone could send a request to the server if they knew its address. This was an open door for attackers who could exploit this vulnerability for remote code execution.

2. Storing API keys in plaintext

Many Langflow users store API keys and tokens in configuration files (.json, .yaml) in plaintext. If an attacker gains access to the system, they can easily intercept this data and use it for further attacks, e.g., on clouds.

3. Outdated dependencies

Langflow uses many external libraries that are not always updated regularly. This creates a risk of exploiting known vulnerabilities in dependencies, such as older versions of requests or pydantic.

Official response from Langflow creators

After the discovery of the CVE-2026-4567 vulnerability, the Langflow team responded quickly:

Patch 1.2.1 (July 2, 2026) was released, which fixes the vulnerability.
Updating to version 1.3.0 (released July 15, 2026) was recommended, which introduces additional authentication mechanisms and API security.
An official statement with advice for users was published.

Despite these actions, many companies still use older versions of Langflow, which exposes them to attacks.

Consequences of an ENCFORGE attack – what do victims lose?

An ENCFORGE attack can have serious consequences, both financial and operational. Here is what victims face:

1. Loss of key AI files

ENCFORGE encrypts:

Model weight files (.bin, .pt, .h5).
Configuration files (.json, .yaml).
Training data (.csv, .parquet).

Without these files, AI models become useless, and recreating them from scratch can take weeks or months.

2. Ransom demands and time pressure

Victims receive a note ENCFORGE_README.txt with payment instructions. Typical demands are:

Ransom amount: From 0.5 XMR (for small companies) to 50 XMR (for corporations).
Deadline: 72 hours from infection. After this time, the price increases by 50%.
Payment method: Monero (XMR) only, which makes tracking transactions difficult.

Worse, there is no guarantee that data will be recovered after paying the ransom. In several cases, victims reported that despite paying, their data was published or deleted. A bleepingcomputer report from July 18, 2026, indicates that some attackers use "double extortion" tactics – first demanding a ransom for decryption, and then threatening to publish the data if the victim does not pay again.

3. Operational downtime and financial losses

For companies that rely on AI models, an ENCFORGE attack can mean:

Downtime for AI-based products or services.
Financial losses related to downtime and data recovery.
Loss of customer trust and reputation.

How to defend against ENCFORGE? Practical tips

An ENCFORGE attack is a serious threat, but there are effective ways to minimize the risk. Here is what you can do today:

1. Update Langflow and other AI tools

The most important step is to update Langflow to the latest version (1.3.0 or newer). If you are using an older version, update it immediately to patch the CVE-2026-4567 vulnerability.

Also, check if other AI tools you use are up to date. Many ransomware attacks exploit known software vulnerabilities that have already been patched.

2. Implement API authentication

If you use Langflow or other AI platforms with API access, ensure that:

All API endpoints require authentication (e.g., API keys, JWT tokens).
API keys are not stored in plaintext – use secret management tools such as HashiCorp Vault or AWS Secrets Manager.
Restrict API access to trusted IP addresses only.

3. Segment the network and isolate AI environments

Do not allow AI environments to be directly connected to the rest of the corporate network. Instead:

Isolate AI servers in a separate subnet.
Restrict access to them only to necessary personnel and systems.
Use firewalls to block unauthorized traffic.

4. Deploy EDR/XDR tools

Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) tools can help detect and block ransomware attacks. Here are some solutions that detect ENCFORGE (as of July 2026):

CrowdStrike Falcon.
SentinelOne.
Kaspersky Endpoint Security (detects as Trojan-Ransom.Win32.Encforge).
Bitdefender (detects as Gen:Variant.Ransom.Encforge.1).
Windows Defender (since update 1.381.2500.0 from July 10, 2026).

These tools monitor unusual file operations and can block ENCFORGE before it starts encrypting data.

5. Create and test backups

Backups are the last line of defense against ransomware. To be effective, they must meet several conditions:

3-2-1 rule: Three copies of data, on two different media, with one copy offline.
Offline copies: Keep at least one copy on a medium that is not connected to the network (e.g., external drive, magnetic tape).
Regular tests: Check if the copies are intact and if they can be restored.

Remember that ENCFORGE may attempt to encrypt backups as well if they are connected to the network. Therefore, it is crucial to keep at least one copy offline.

6. Employee training

Many ransomware attacks start with phishing. Therefore, it is important to train employees in:

Recognizing suspicious emails and links.
Not opening attachments from unknown senders.
Verifying the authenticity of update notifications.

Regular cybersecurity training can significantly reduce the risk of infection.

Is ENCFORGE linked to other ransomware groups?

Analysis of the ENCFORGE code provides several clues about its origin, although there is no direct evidence of links to specific groups.

Similarities to BlackMatter and LockBit

Experts from Group-IB noted that some fragments of the ENCFORGE code show similarities to the BlackMatter ransomware (active in 2021–2022). However, this is not proof of a direct link – it could be the result of inspiration or the use of pre-made modules.

Another lead is the use of IPFS for C2 server communication, which resembles tactics used by the LockBit 3.0 group. Decentralization of infrastructure makes it difficult to track attackers, which is why it is increasingly used by cybercriminals.

Hypotheses regarding origin

Based on code and infrastructure analysis, experts point to several possible scenarios:

Financial motivation: Most likely. ENCFORGE appears to be a typical profit-driven ransomware.
Country of origin: There is no conclusive evidence, but some experts suggest that the attackers may operate from Russia or Eastern Europe. This is indicated by, among other things, the language used in the code and the location of C2 servers.
No political motivation: Unlike some ransomware groups, ENCFORGE does not appear to be a tool in a geopolitical conflict. Its targets are companies, not government institutions.

Broader implications of the ENCFORGE attack for the AI industry

The ENCFORGE attack is not just a security incident – it is a signal that the AI industry is facing new challenges. Here are the potential long-term consequences of such threats:

1. Increase in attacks on AI infrastructure

According to a Gartner report from April 2026, attacks on AI infrastructure increased by 200% year-over-year. Main targets include:

AI models stored in clouds.
APIs for AI services.
Training data and metadata.

ENCFORGE is just one of many examples of how cybercriminals adapt their methods to new technologies.

2. Legal regulations and security standards

Attacks on AI are forcing governments and organizations to introduce new regulations. Examples:

EU AI Act: Fully implemented since January 2026, it mandates security audits for high-risk AI systems.
NIST AI Risk Management Framework: The March 2026 update recommends encrypting AI data and models and conducting regular penetration tests.

Companies that do not meet these requirements may face financial penalties and loss of customer trust.

3. Development of cyber insurance for AI

More and more companies are deciding to purchase insurance policies that cover risks associated with the loss of AI models. An example is the offer from Lloyd’s of London, which has been offering products protecting against attacks on AI infrastructure since 2025.

These insurances can help companies recover financial losses, but they will not replace proper security measures.

4. Change in approach to open-source

Langflow is an open-source project, which means anyone can view and modify its code. While open-source has many advantages, it also creates risks – vulnerabilities can be more easily discovered and exploited by attackers.

In response to attacks like ENCFORGE, the open-source community is beginning to introduce more rigorous code review and security audit processes. An example is the analysis of a backdoor in the Linux system, which showed how important regular code reviews are.

Summary: What's next?

ENCFORGE is a warning for everyone working with AI models. This attack shows that AI infrastructure has become a new target for cybercriminals, and vulnerabilities in popular tools can have serious consequences.

What can you do?

Update software: Regularly check if you are using the latest versions of AI tools.
Secure APIs: Implement authentication and restrict access to endpoints.
Isolate AI environments: Separate them from the rest of the corporate network.
Create backups: Keep at least one copy offline.
Train employees: Teach them to recognize phishing and other threats.

The AI industry is developing at a breakneck pace, but with new opportunities come new threats. ENCFORGE is just the beginning – in the coming years, we can expect increasingly sophisticated attacks on AI models. Therefore, it is crucial to implement appropriate security measures today and be prepared for future challenges.

If you want to learn more about AI security, check out our other articles, e.g., how algorithms manipulate our choices or why end-to-end encryption is not perfect.