INTEL_REPORT
The Hacker News · published 7/21/2026, 7:34:32 AM · TLP amber
Summary
Ingested excerpt (first ~500 chars of normalized text).
New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator it first documented earlier this month. The same operator has now been spotted deploying ENCFORGE, a new compiled Go ransomware designed to encrypt model weights, vector indexes, training datasets, and other AI infrastructure files across the host filesystem. The entry New ENCFORGE Ran…
https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html
sha256:c23ee10f8489a4934d94edab7dcadcdf363c09ea87e19fefeabd41e2549b37f9
What we pulled out
Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).
Indicators
Linked with report → mentions → indicator. Values open the indicator workspace.
Malware families
Allowlist token matches only.
Threat actors mentioned
Allowlist mentions — not a formal attribution verdict.
ATT&CK techniques
MITRE IDs referenced in text and present in local technique table.
CONTINUE INVESTIGATION
High-signal pivots without leaving the thread you started in search.
Browse the report corpus.
Neighborhood from the first linked indicator.
| ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328 |
| Open → |