First AI-powered Ransomware “PromptLock” Signals New Threat
Security researchers have
uncovered a worrying new development in cybercrime: the first known ransomware
powered by artificial intelligence
The malware, dubbed PromptLock, was detected by cybersecurity firm ESET and is believed to be a proof-of-concept rather than an active threat. Nonetheless, its design reveals a potentially dangerous shift in cyberattack strategies. PromptLock operates using a locally hosted large language model, specifically OpenAI’s gpt-oss:20b, accessed through the Ollama API, to generate malicious Lua scripts in real time.
These dynamically generated scripts are compatible across Windows, macOS and Linux platforms. They carry out tasks such as scanning local filesystems, inspecting targeted files, exfiltrating data, and encrypting or potentially even destroying it, although erasure functionality appears not yet implemented.
Crucially, PromptLock’s use of AI introduces unpredictability: Lua scripts vary with each execution, complicating detection and analysis by traditional cybersecurity tools. ESET researchers emphasise that this variability could significantly undermine defenders’ ability to identify malware quickly.
Although still in the
experimental stage, PromptLock demonstrates how generative AI may soon lower
the barrier to entry for sophisticated cyberattacks, even for actors with
limited technical skills. Analysts caution that the use of LLMs to automate
malware creation could represent a dangerous new frontier in ransomware
evolution.
Leave A Comment