AI-Designed Ransomware Emerges with PromptLock Malware

An AI-designed ransomware strain, identified by cybersecurity firm ESET as PromptLock, marks a significant shift in malware design. It leverages a local AI model to generate its attack components.

An article in Cyber Security News by Guru Baran explains that, unlike traditional ransomware that relies on pre-compiled malicious logic, PromptLock dynamically produces Lua scripts through OpenAI’s gpt-oss:20b model using the Ollama API.

While currently a proof of concept, its architecture demonstrates how threat actors may exploit AI to create more adaptive and evasive threats across various platforms.

PromptLock’s development stems from broader advancements in local large language models and cross-platform malware.

Written in Golang, the ransomware has variants for Windows and Linux, and uses hard-coded prompts to instruct the AI model to generate scripts performing system enumeration, file inspection, and data exfiltration, with subsequent encryption.

Lua’s lightweight, embeddable nature facilitates the execution of scripts across operating systems. Encryption is performed using the SPECK 128-bit block cipher.

ESET researchers note that some functions, including data destruction, remain incomplete, indicating the malware is still in its developmental stage.

Unusual artifacts, such as a Bitcoin address referencing Satoshi Nakamoto, appear in the code, likely as placeholders or misdirection.

The malware’s emergence raises considerations about evolving threats. Although no active campaigns deploying PromptLock have been reported, its dynamic, AI-generated approach could dramatically increase complexity in detecting and mitigating ransomware.

Policies addressing AI-assisted cyber threats must be developed quickly.

Legal teams must address the challenges to traditional definitions of intent and control posed by the use of AI-designed ransomware, and anticipate the implications for liability and regulatory compliance.