Skip to content
ESET researchers have identified what appears to be the first known case of AI-powered ransomware. Dubbed PromptLock, the malware demonstrates how artificial intelligence is now being woven into cybercriminals’ toolkits – and while not fully functional yet, it marks a worrying escalation in ransomware development.
Discovered by malware specialists Anton Cherepanov and Peter Strycek, PromptLock operates by using OpenAI’s recently released gpt-oss-20b model, running locally on infected devices through the Ollama API. This allows the ransomware to dynamically generate malicious Lua scripts in real-time, significantly complicating detection and response efforts.
The generated scripts enable the malware to:
- Enumerate local filesystems
- Identify and inspect files
- Exfiltrate selected data
- Encrypt targeted files
PromptLock has the potential to decide, based on file type and contents, whether to copy, encrypt, or even destroy data. While destruction features are not yet implemented, researchers warn that this functionality could appear in future iterations.
The malware uses the SPECK 128-bit encryption algorithm, and is written in Go, with confirmed samples targeting both Windows and Linux. The scripts themselves can run across Windows, Linux, and macOS, underlining the malware’s cross-platform design.
At present, PromptLock is considered a proof-of-concept (PoC) or work-in-progress, with no evidence of live deployments in the wild. However, its discovery signals a major shift: AI is lowering the barrier for ransomware authors to automate and refine attacks at scale.
For defenders, this serves as a clear warning. As AI models become more accessible, cybercriminals will inevitably exploit them to streamline their attack chains and evade detection. The emergence of PromptLock highlights the need for organisations to strengthen threat intelligence, detection capabilities, and incident response strategies before AI-driven ransomware becomes an operational reality.
If your business has been hit by ransomware, or you want to ensure you are prepared for the next wave of attacks, don’t wait until it’s too late. Contact Zensec today to secure your organisation and keep your data safe.
