Experimental PromptLock ransomware uses AI to encrypt, steal data
PromptLock, the first AI-powered ransomware, was found by threat researchers. It encrypts and steals data from Windows, macOS, and Linux systems using Lua scripts.
The malware dynamically creates the harmful Lua scripts from hard-coded prompts using OpenAI's gpt-oss:20b model via the Ollama API.
ESET researchers claim that PromptLock is written in Golang and accesses the gpt-oss:20b big language model via the Ollama API. The threat actor uses a proxy tunnel to connect to the distant server hosting the LLM.
The malware employs hard-coded prompts to tell the model to create malicious Lua scripts on the fly, such as those for data exfiltration, file encryption, target file inspection, and local filesystem enumeration.
Although it hasn't been used, the researchers also discuss dat...