Security researchers have just identified what could be the first ‘AI-powered’ ransomware strain – and it uses OpenAI’s gpt-oss-20b model
PromptLock uses OpenAI's gpt-oss-20b model and generates malicious scripts on the fly
Researchers at cybersecurity firm ESET have discovered what they said is the "first known AI-powered ransomware" strain.
Dubbed ‘PromptLock’, researchers said it uses OpenAI's open source gpt-oss:20b model, released earlier this month, locally via the Ollama API to generate malicious Lua scripts on the fly, which it then executes.
"PromptLock leverages Lua scripts generated from hard-coded prompts to enumerate the local filesystem, inspect target files, exfiltrate selected data, and perform encryption," said researchers Anton Cherepanov and Peter Strycek in posts on several social media sites, including X.
"These Lua scripts are cross-platform compatible, functioning on Windows, Linux, and macOS. Based on the detected user files, the malware may exfiltrate data, encrypt it, or potentially destroy it."
PromptLock is written in Golang and uses the SPECK 128-bit encryption algorithm, developed by the US National Security Agency (NSA), to encrypt files. It sends its requests through Ollama, an open source API for interfacing with large language models.
The Bitcoin address used in the AI prompt for a payment demand is the one associated with the cryptocurrency's creator, Satoshi Nakamoto, whose real identity has never been discovered.
Cherepanov and Strycek said they've identified both Windows and Linux variants uploaded to VirusTotal, a Google-owned service that catalogs malware and checks files for malicious threats.
The good news is that the malware doesn't seem to be fully functional yet - the destruction functionality hasn't been implemented.
"Although multiple indicators suggest the sample is a proof-of-concept (PoC) or work-in-progress rather than fully operational malware deployed in the wild, we believe it is our responsibility to inform the cybersecurity community about such developments," Cherepanov and Strycek said.
Concerns rising over AI ransomware threats
Ransomware gangs have increasingly been using AI to automate communications and enhance their social engineering techniques, research shows.
A recent study from Acronis found that the increase in the use of AI by ransomware gangs appeared to be reflected in their chosen threat vectors. Social engineering and BEC attacks increased from 20% to 25.6% in the first five months of 2025 compared to the same period in 2024.
This, researchers noted, was probably down to the growth in AI use for crafting convincing impersonations.
Earlier this year, Malwarebytes warned that businesses need to be prepared for AI-powered ransomware attacks.
Up to now, AI agents have generally been used to increase the efficiency of attacks, rather than introducing new capabilities or altering the underlying tactics used by hackers.
According to Malwarebytes, though, this could all change soon as attackers use AI more broadly.
"We are in the earliest days of regular threat actors leveraging local/private AI, said John Scott-Railton, a spyware researcher at Citizen Lab, commenting on the ESET research. "And we are unprepared."
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- Mandiant says generative AI will empower new breed of information operations, social engineering
- AI breaches aren’t just a scare story any more – they’re happening in real life
- Think DDoS attacks are bad now? Wait until hackers start using AI assistants to coordinate attacks
-
NetApp snaps up DataPelago to bolster AI data infrastructure portfolioNews The acquisition brings GPU-accelerated data processing into NetApp's storage layer to help customers speed up AI workloads
-
How AI certification can help employees to climb the career ladderIn depth Research shows that validating AI knowledge and skills can help to boost job mobility and salaries
-
The case for the channel in an AI-driven security marketIndustry Insights AI won't replace channel partners; SMB cybersecurity still relies on trust
-
Cisco just launched two cyber-focused small language models: Antares-350M and Antares-1B aim to supercharge codebase analysis – and they run at a “fraction of the compute expense” of popular frontier modelsNews The Antares models unveiled by Cisco aim to cut costs in codebase analysis
-
Cyber professionals are flocking to AI tools, but they’re getting tired of fixing mistakes and reviewing outputsNews Cyber pros are spending significantly more time validating AI outputs and deciding when to trust AI-generated recommendations
-
This one cyber crime group accounted for nearly a fifth of all ransomware attacks in JuneNews The Gentlemen, a ransomware a service operator, now accounts for 17% of published attacks
-
The agents you use to beef up cybersecurity could be turned against you – ‘Friendly Fire’ attacks can manipulate OpenAI and Anthropic models into running malicious codeNews Research shows agents can be fooled into executing malicious code while performing security reviews of third-party software
-
Working with the enemy: Ransomware negotiator-turned cyber criminal jailed after working with hackers to extort clientsNews Angelo Martino was supposed to be negotiating on behalf of victims, but was secretly working for ransomware operators
-
'It’s a marker of where extortion tradecraft is heading': Cyber experts say they've identified the first case of ‘agentic ransomware’ – but there’s a catchNews While the JadePuffer ransomware has alarm bells ringing, it still needed a human in the loop
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
