Attackers are actively exploiting CVE-2025-3248, a critical RCE vulnerability in Langflow's code validation API, to deploy a customized Gafgyt DDoS bot on AI development servers. The bot uses a modified RC4 stream cipher for C2 communications and is optimized purely for network flooding attacks (UDP, TCP, HOLD, Junk). AI infrastructure is targeted due to high bandwidth availability, shadow IT deployment practices, and permissive egress filtering.
Gafgyt
1 post
Langflow Exploited to Build Custom DDoS Gafgyt Botnets