AI Meets Ransomware : Open‑Weight AI Models Fueling Ransomware Evolution

This week, the SonicWall Capture Labs Threat Research team analyzed an interesting ransomware sample discovered about an year ago, that leverages AI capabilities in its attack workflow. Unlike conventional ransomware that embeds its malicious logic directly within the binary, PromptLock adopts a fundamentally different approach. Rather than shipping precompiled ransomware routines, it contains a collection of hardcoded natural-language prompts that are sent to a Large Language Model (LLM) at runtime. This shifts much of the malware's functionality from static code to dynamically generated code.

PromptLock leverages OpenAI's gpt-oss:20b model through an Ollama-compatible API to generate malicious Lua scripts on demand. Instead of implementing ransomware functionality directly, the malware instructs the LLM to behave as a code-generation assistant, producing Lua scripts for specific attack stages. These generated scripts are then executed directly in memory, minimizing the amount of malicious logic embedded in the binary. 

This design significantly reduces the computational requirements on infected endpoints, as only a single machine within the environment needs to host the LLM. All other devices act as lightweight clients that consume the generated output.

Infection Cycle

Upon execution, the malware prompts an LLM to generate Lua code that recursively enumerates the file system and identifies files containing potentially valuable or sensitive data.

Beyond file enumeration, the malware relies on the LLM for contextual decision-making. It prompts the model to classify the target system (for example, as a personal computer, server, or industrial controller) and evaluate the potential value of discovered files. Files identified as valuable are uploaded to the attacker's infrastructure for exfiltration before being securely erased from the host.

Files selected for encryption are processed using Lua code generated by the LLM. The malware prompts the model to produce an encryption routine that implements the lightweight 128-bit SPECK block cipher, which is subsequently used to encrypt the targeted files.

Once the encryption routine is done, the malware uses an LLM to automate the creation of ransom notes. By prompting the model to act as a cybersecurity expert, it generates a professional-looking extortion message intended for the victim.

This dynamic code generation presents a significant challenge for traditional malware detection techniques. Signature-based security products rely on recognising known byte patterns, while behavioural detection engines depend on previously observed execution characteristics. Since PromptLock generates new code at runtime, both the code itself and, in some cases, its execution behaviour may differ across infections. This reduces the effectiveness of static signatures and complicates behavioural analysis, requiring defenders to shift their focus toward detecting the underlying LLM interaction patterns, prompt execution workflow, and network communications with local or remote Ollama endpoints rather than relying solely on conventional malware signatures.

IOC

SHA256 - E24FE0DD0BF8D3943D9C4282F172746AF6B0787539B371E6626BDB86605CCD70

Sonicwall Protection

SonicWall Capture ATP detects this threat with RTDMI™ and the Capture Client endpoint solution.