Threat · curated 12 Aug 2026
AI Meets Ransomware : Open‑Weight AI Models Fueling Ransomware Evolution
First reported sonicwall.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
PromptLock demonstrates how open-weight LLMs can turn malware into a dynamic code generator that evades signature and behavioral detection, forcing defenders to hunt LLM prompt-execution and Ollama communication patterns.
SonicWall Capture Labs analyzed PromptLock, a ransomware sample that ships hardcoded natural-language prompts instead of precompiled routines, calling OpenAI's gpt-oss:20b model via an Ollama-compatible API to generate Lua scripts at runtime for file enumeration, target classification, SPECK-based encryption, and ransom-note creation. Because code is generated dynamically per infection, both static signatures and behavioral detection are undermined, pushing defenders toward monitoring LLM interaction patterns and Ollama network traffic.
Summary
SonicWall Capture Labs analyzed PromptLock, a ransomware sample discovered roughly a year prior to publication that shifts much of its malicious functionality from static binary code to dynamically generated code. Instead of embedding ransomware logic, it carries hardcoded natural-language prompts that are sent to a Large Language Model at runtime.[0]
PromptLock leverages OpenAI's gpt-oss:20b open-weight model through an Ollama-compatible API to generate Lua scripts for discrete attack stages — file enumeration, system classification, file-value assessment, SPECK-based encryption, and ransom-note creation — with generated scripts executed directly in memory. Only one machine in an environment needs to host the LLM while other devices act as lightweight clients.[0]
Because the code is generated anew at runtime, both the code and, in some cases, execution behaviour can vary across infections, undermining signature-based and behavioural detection and pushing defenders toward detecting LLM interaction patterns, prompt execution workflows, and Ollama endpoint communications.[0]
Attack chain
- File enumeration: On execution the malware prompts the LLM to generate Lua code that recursively enumerates the file system and identifies files containing potentially valuable or sensitive data.[0]
- System classification and triage: The malware prompts the model for contextual decision-making, classifying the target system (personal computer, server, or industrial controller) and evaluating the potential value of discovered files.[0]
- Exfiltration: Files identified as valuable are uploaded to the attacker's infrastructure for exfiltration before being securely erased from the host.[0]
- Encryption: Files selected for encryption are processed with LLM-generated Lua code implementing the lightweight 128-bit SPECK block cipher.[0]
- Extortion: The malware prompts the model, acting as a cybersecurity expert, to automatically generate a professional-looking ransom note for the victim.[0]
How it works
PromptLock inverts the conventional ransomware model: rather than embedding malicious routines in the binary, it stores a collection of hardcoded natural-language prompts that instruct an LLM to act as a code-generation assistant, producing Lua scripts for each attack stage that are executed directly in memory.[0]
It communicates with OpenAI's gpt-oss:20b model via an Ollama-compatible API. The design minimizes the malicious logic in the binary and reduces endpoint compute requirements, because only a single machine needs to host the LLM while other devices consume generated output as lightweight clients.[0]
The generated encryption routine implements the 128-bit SPECK block cipher in Lua to encrypt targeted files, and a separate prompt produces the ransom note. Runtime code generation causes the executed code — and sometimes its behaviour — to differ across infections, degrading static signatures and behavioural analysis.[0]
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| file-hash | E24FE0DD0BF8D3943D9C4282F172746AF6B0787539B371E6626BDB86605CCD70 | SHA256 hash published by SonicWall Capture Labs for the analyzed PromptLock ransomware sample.[0] |
| cve | gpt-oss:20b via Ollama-compatible API | Not a CVE, but a hunting signal: the malware relies on communication with a local or remote Ollama endpoint serving the gpt-oss:20b model to generate its attack scripts.[0] |
Key takeaways
- PromptLock demonstrates a shift from static, precompiled ransomware logic to runtime LLM-generated code, using open-weight models such as gpt-oss:20b through an Ollama-compatible API.[0]
- Delegating attack stages — enumeration, triage, exfiltration, SPECK encryption, and ransom-note generation — to an LLM produces polymorphic behaviour that weakens signature and behavioural detection, so defenders should hunt for LLM/Ollama interaction patterns.[0]
Defensive actions
- Focus detection on LLM interaction patterns, prompt execution workflows, and network communications with local or remote Ollama endpoints rather than relying solely on conventional malware signatures.: PromptLock generates new code at runtime, so both the code and its execution behaviour may differ across infections, reducing the effectiveness of static signatures and complicating behavioural analysis.[0]
- Use SonicWall Capture ATP with RTDMI and the Capture Client endpoint solution, which the vendor states detects this threat.: The vendor reports these products detect the PromptLock sample.[0]