The First AI-Powered Ransomware & How It Works
Essential information
- Published
- 29/08/2025 13:41
- Modified
- 29/08/2025 15:49
- Tags
- 2025-08-29 ai-powered cross-platform dynamic ransom notes filesystem scanning go-language lua scripts ollama api promptlock proof-of-concept ransomware speck encryption
- Related entities
- 6 techniques (mitre), 1 malware
Description
PromptLock, a proof-of-concept AI-powered ransomware, leverages Lua scripts generated from hard-coded prompts to perform malicious activities across Windows, Linux, and macOS. Written in Go, it communicates with a locally hosted LLM through the Ollama API. The malware scans the filesystem, identifies sensitive information, and uses SPECK 128-bit encryption in ECB mode to encrypt files. It dynamically generates ransom notes and adapts its behavior based on the infected machine type. PromptLock's cross-platform compatibility and AI-driven script generation make it a significant concern for cybersecurity professionals, highlighting the need for advanced defensive strategies against evolving AI-powered threats.