Gafgyt Botnet Exploits Langflow Flaw to Hijack AI Systems for DDoS

Akamai has detected a new Gafgyt botnet campaign that exploits a vulnerability in Langflow, a framework for AI applications, allowing attackers to hijack AI infrastructure through remote code execution (RCE). The exploit targets Langflow's untrusted code execution feature, enabling the deployment of a DDoS payload aimed at flooding networks via different attack modes. The botnet variant uses a modified RC4 stream cipher for command-and-control traffic, complicating detection efforts. Recommended defenses include patching vulnerabilities, applying strict filtering, and treating AI development environments as untrusted.