216.73.216.6

The First AI-Powered Ransomware & How It Works

· Published 29/08/2025 13:41 · Modified 29/08/2025 15:49

Export JSON

Essential information

Published
29/08/2025 13:41
Modified
29/08/2025 15:49
Tags
2025-08-29 ai-powered cross-platform dynamic ransom notes filesystem scanning go-language lua scripts ollama api promptlock proof-of-concept ransomware speck encryption
Related entities
6 techniques (mitre), 1 malware

Description

, a , leverages generated from hard-coded prompts to perform malicious activities across Windows, Linux, and macOS. Written in Go, it communicates with a locally hosted LLM through the . The malware scans the filesystem, identifies sensitive information, and uses SPECK 128-bit encryption in ECB mode to encrypt files. It dynamically generates ransom notes and adapts its behavior based on the infected machine type. 's compatibility and AI-driven script generation make it a significant concern for cybersecurity professionals, highlighting the need for advanced defensive strategies against evolving threats.

External references