PromptLock is the first known AI-powered ransomware that uses artificial intelligence to generate malicious scripts and perform cyberattacks, representing a new frontier in cybersecurity threats.
What makes PromptLock different from traditional ransomware?
Unlike conventional ransomware that uses static, pre-written code, PromptLock leverages Lua scripts generated from hard-coded prompts to enumerate the local filesystem, inspect target files, exfiltrate selected data, and perform encryption. Think of it like having a malicious digital assistant that can adapt its attack methods on the fly, rather than following a rigid playbook.
The malware functions as a hard-coded prompt injection attack on a large language model, causing the model to assist in carrying out a ransomware attack. This means it tricks AI systems into becoming unwilling accomplices in cybercrime.
How does PromptLock’s technical architecture work?
The PromptLock malware uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts on the fly. The ransomware is written in Golang programming language and has been observed in both Windows and Linux variants.
Here’s how the attack chain unfolds:
- Initial infection: PromptLock infects a system like traditional malware
- AI communication: It connects to OpenAI’s gpt-oss:20b model through the Ollama API
- Script generation: The AI generates unique Lua scripts based on hard-coded prompts
- Execution: These scripts perform file enumeration, data theft, and encryption
Notably, attackers don’t need to deploy the entire gpt-oss-20b model within the compromised network – they can simply establish a tunnel or proxy from the affected network to a server running Ollama with the model.
Why is PromptLock harder to detect than regular ransomware?
The AI-powered nature of PromptLock creates significant detection challenges. Because the malware relies on scripts generated by AI, indicators of compromise (IoCs) may vary from one execution to another.
This variability works like a digital chameleon – traditional security tools look for known patterns and signatures, but PromptLock generates slightly different scripts each time it runs. The fact that the model runs locally also makes it so OpenAI can’t track the ransomware operators, eliminating another detection avenue.
What specific capabilities does PromptLock have?
PromptLock’s design allows it to generate Lua scripts on demand for file system enumeration, selective data exfiltration, and encryption across Windows, macOS, and Linux environments. The malware uses several sophisticated techniques:
- Cross-platform compatibility: The generated Lua scripts work across multiple operating systems
- SPECK 128-bit encryption: Uses this algorithm for file encryption
- Intelligent targeting: Asks the AI to verify the contents of files to determine if they contain personally identifiable information
- Custom ransom notes: Uses its “analysis mode” to generate a ransom note based on what the program thought a ransomware actor might write
Is PromptLock currently being used in cyberattacks?
Currently, ESET considers PromptLock a proof of concept rather than fully operational malware deployed in the wild. The researchers have found multiple indicators suggesting it’s a work-in-progress rather than active malware.
ESET told CyberScoop that they have yet to see evidence of the malware being deployed by threat actors in ESET telemetry. However, its appearance marks a significant technical leap in ransomware evolution.
What are the prerequisites for a PromptLock attack?
PromptLock attacks would require several pre-conditions that are unlikely to be met in typical networks. These include:
- Local AI infrastructure: The victim’s system needs Ollama running, which requires substantial computational resources
- Poor network security: Success depends on victims having poor network segmentation and failing to implement prompt guardrails
- Unrestricted traffic: Systems must allow outgoing traffic aimed at LLM ports and protocols
How can organizations defend against AI-powered ransomware like PromptLock?
Security experts recommend several defensive measures against this emerging threat:
Network monitoring and controls
- Monitor for anomalous Lua script execution, particularly those involving system enumeration or encryption routines
- Inspect outbound connections for signs of proxy tunneling to LLM-serving infrastructure, especially via the Ollama API
- Implement proper network segmentation to prevent AI model access
AI-specific security measures
- Deploy runtime security solutions to detect prompt injection attempts
- Implement input validation and sanitization for AI interactions
- Monitor for unusual AI behavior patterns
- Restrict access to local AI models and APIs
Traditional security foundations
- Maintain robust endpoint detection and response systems
- Keep security patches and updates current
- Train employees to recognize social engineering attempts
- Implement zero-trust network architectures
What does PromptLock mean for the future of cybersecurity?
The prospect of AI-powered malware that can adapt to the environment and change its tactics on the fly represents a new frontier in cyberattacks. This development signals several important trends:
- Lower barriers to entry: AI tools drastically lower the barrier to entry for less tech-savvy attackers, allowing them to punch above their weight
- Dynamic threat landscape: Unlike static malware, AI-integrated threats can alter behavior in real-time
- Detection challenges: Traditional signature-based defenses become less effective against variable, AI-generated attacks
Regardless of the intent behind PromptLock, its discovery points to how AI tools can be used to automate various stages of ransomware attacks, from reconnaissance to data exfiltration, at a speed and scale once thought impossible.
While PromptLock itself remains a proof-of-concept, it serves as an important warning about the evolving cybersecurity landscape where artificial intelligence becomes both a powerful defensive tool and a sophisticated weapon in the wrong hands.