Blog

Security Research

Langflow Exploited to Build Custom DDoS Gafgyt Botnets

Larry Cashdollar has been working in the security field as a vulnerability researcher for more than 20 years and is currently a Principal Security Researcher on the Security Intelligence Response Team at Akamai. He studied computer science at the University of Southern Maine. Larry has documented more than 300 CVEs and has presented his research at BotConf, BSidesBoston, OWASP Rhode Island, and DEF CON. He enjoys the outdoors and rebuilding small engines in his spare time.

Key takeaways

Attackers are actively exploiting a remote code execution (RCE) vulnerability within the code validation API endpoint of Langflow, a popular visual framework for prototyping AI and large language model (LLM) applications.

Once the framework is breached, the exploit drops a highly customized variant of the veteran Gafgyt distributed denial-of-service (DDoS) bot.…