Particle.news
Download on the App Store
6 ARTICLES
·
33m ago

ESET Uncovers 'PromptLock,' First AI-Powered Ransomware Using Local LLMs

ESET says the code appears to be a proof of concept rather than an active campaign.

AI hacking
Image
'PromptLock' AI Ransomware

Overview

  • PromptLock leverages a locally run open‑weight gpt-oss:20b model via the Ollama API to generate malicious Lua scripts on demand.
  • The AI‑produced scripts can enumerate files, exfiltrate data, and encrypt data on Windows, macOS, and Linux using the SPECK 128‑bit algorithm.
  • ESET found Windows and Linux samples on VirusTotal on Aug. 25, with the research detailed by Anton Cherepanov and Peter Strycek.
  • Local or tunneled access to an Ollama server can avoid provider logging, and AI‑generated variability may complicate IoC‑based detection.
  • The code is written in Go, includes unfinished destruction functionality, and a sample ransom note even lists a Bitcoin address linked to Satoshi Nakamoto.