Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

Bleeping Computer

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

PromptLock, a proof-of-concept AI-powered ransomware, leverages Lua scripts generated from hard-coded prompts to perform malicious activities across Windows, Linux, and macOS. Written in Go, it communicates with a locally hosted LLM through the Ollama API. The malware scans the filesystem, identifies sensitive information, and uses SPECK 128-bit encryption in ECB mode to encrypt files. It dynamically generates ransom notes and adapts its behavior based on the infected machine type. PromptLock's cross-platform compatibility and AI-driven script generation make it a significant concern for cybersecurity professionals, highlighting the need for advanced defensive strategies against evolving AI-powered threats.

PromptLock represents a novel proof-of-concept ransomware that integrates artificial intelligence capabilities to enhance its malicious operations. Developed in the Go programming language, PromptLock targets multiple operating systems including Windows, Linux, and macOS, demonstrating cross-platform compatibility which broadens its potential attack surface. The ransomware leverages Lua scripts that are dynamically generated from hard-coded prompts by communicating with a locally hosted large language model (LLM) via the Ollama API. This AI-driven script generation allows the malware to adapt its behavior based on the infected system's environment, increasing its stealth and effectiveness. 

The malware conducts comprehensive filesystem scanning to identify sensitive information and selectively encrypts files using the SPECK 128-bit encryption algorithm in ECB mode. While SPECK is a lightweight cipher, its use in ECB mode is generally discouraged due to pattern leakage; however, the AI-driven adaptability and dynamic ransom note generation compensate by complicating detection and response efforts. PromptLock also dynamically generates ransom notes tailored to the infected machine, potentially improving the likelihood of ransom payment by providing contextually relevant instructions. The malware employs various tactics and techniques mapped to MITRE ATT&CK IDs such as T1033 (System Owner/User Discovery), T1547 (Boot or Logon Autostart Execution), T1204.002 (User Execution: Malicious File), and T1486 (Data Encrypted for Impact), indicating a sophisticated multi-stage attack lifecycle.

Despite being a proof-of-concept and not currently observed in the wild, PromptLock highlights the emerging trend of AI-powered malware that can autonomously generate and execute malicious scripts, posing a significant challenge for traditional signature-based detection systems. The use of a locally hosted LLM reduces reliance on external command and control infrastructure, potentially evading network-based detection. This threat underscores the necessity for cybersecurity defenses to evolve in response to AI-enhanced adversarial techniques.

Detailed information about The First AI-Powered Ransomware & How It Works. Get real-time updates, technical details, and mitigation strategies.

The First AI-Powered Ransomware & How It Works - Live Threat Intelligence - Threat Radar | OffSeq.com

The First AI-Powered Ransomware & How It Works

Threats Tagged 'lua scripts'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'lua scripts'

Lead Pen Test Professional