Researchers at cybersecurity firm ESET have discovered what they said is the "first known AI-powered ransomware" strain.
Dubbed ‘PromptLock’, researchers said it uses OpenAI's open source gpt-oss:20b model, released earlier this month, locally via the Ollama API to generate malicious Lua scripts on the fly, which it then executes.
"PromptLock leverages Lua scripts generated from hard-coded prompts to enumerate the local filesystem, inspect target files, exfiltrate selected data, and perform encryption," said researchers Anton Cherepanov and Peter Strycek in posts on several social media sites, including X.
"These Lua scripts are cross-platform compatible, functioning on Windows, Linux, and macOS. Based on the detected user files, the malware may exfiltrate data, encrypt it, or potentially destroy it."
PromptLock is written in Golang and uses the SPECK 128-bit encryption algorithm, developed by the US National Security Agency (NSA), to encrypt files. It sends its requests through Ollama, an open source API for interfacing with large language models.
The Bitcoin address used in the AI prompt for a payment demand is the one associated with the cryptocurrency's creator, Satoshi Nakamoto, whose real identity has never been discovered.
Cherepanov and Strycek said they've identified both Windows and Linux variants uploaded to VirusTotal, a Google-owned service that catalogs malware and checks files for malicious threats.
The good news is that the malware doesn't seem to be fully functional yet - the destruction functionality hasn't been implemented.
"Although multiple indicators suggest the sample is a proof-of-concept (PoC) or work-in-progress rather than fully operational malware deployed in the wild, we believe it is our responsibility to inform the cybersecurity community about such developments," Cherepanov and Strycek said.
Concerns rising over AI ransomware threats
Ransomware gangs have increasingly been using AI to automate communications and enhance their social engineering techniques, research shows.
A recent study from Acronis found that the increase in the use of AI by ransomware gangs appeared to be reflected in their chosen threat vectors. Social engineering and BEC attacks increased from 20% to 25.6% in the first five months of 2025 compared to the same period in 2024.
This, researchers noted, was probably down to the growth in AI use for crafting convincing impersonations.
Earlier this year, Malwarebytes warned that businesses need to be prepared for AI-powered ransomware attacks.
Up to now, AI agents have generally been used to increase the efficiency of attacks, rather than introducing new capabilities or altering the underlying tactics used by hackers.
According to Malwarebytes, though, this could all change soon as attackers use AI more broadly.
"We are in the earliest days of regular threat actors leveraging local/private AI, said John Scott-Railton, a spyware researcher at Citizen Lab, commenting on the ESET research. "And we are unprepared."
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- Mandiant says generative AI will empower new breed of information operations, social engineering
- AI breaches aren’t just a scare story any more – they’re happening in real life
- Think DDoS attacks are bad now? Wait until hackers start using AI assistants to coordinate attacks
-
A senior Microsoft exec says future Windows versions will offer more interactive, ‘multimodal’ experiencesNews With speculation over a Windows 12 reveal mounting, a senior company figure claims the new operating system will mark a step change for users
-
NinjaOne appoints industry veteran Paul Redding to lead MSP partnershipsNews The former CyberQP executive will spearhead NinjaOne’s efforts to accelerate growth for MSP partners and customers
-
Data I/O shuts down systems in wake of ransomware attackNews Regulatory filings by Data I/O suggest the costs of dealing with the attack could be significant
-
Microsoft quietly launched an AI agent that can detect and reverse engineer malwareNews Researchers say the tool is already achieving the “gold standard” in malware classification
-
Flaw in Lenovo’s customer service AI chatbot could let hackers run malicious code, breach networksNews Hackers abusing the Lenovo flaw could inject malicious code with just a single prompt
-
Using DeepSeek at work is like ‘printing out and handing over your confidential information’News Thinking of using DeepSeek at work? Think again. Cybersecurity experts have warned you're putting your enterprise at huge risk.
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
-
Passwords are a problem: why device-bound passkeys can be the future of secure authenticationIndustry insights AI-driven cyberthreats demand a passwordless future…
-
Microsoft patched a critical vulnerability in its NLWeb AI search tool – but there's no CVE (yet)News Researchers found an unauthenticated path traversal bug in the tool debuted at Microsoft Build in May
