Threats Tagged 'promptlock'

This research explores the challenges posed by LLM-enabled malware, which can generate malicious logic at runtime. The study identifies characteristics of such malware, including embedded API keys and specific prompt structures. Notable cases like PromptLock and APT28's LameHug are examined. The researchers developed hunting strategies based on API key detection and prompt analysis, leading to the discovery of new samples, including 'MalTerminal'. The implications for defenders are discussed, highlighting both the adaptability and potential brittleness of LLM-enabled malware. The research also uncovered various offensive tools leveraging LLMs for operational capabilities.

MediumMalwareGermanyFranceUnited Kingdom+5#promptlock#rkor#llm-enabled malware

PromptLock, a proof-of-concept AI-powered ransomware, leverages Lua scripts generated from hard-coded prompts to perform malicious activities across Windows, Linux, and macOS. Written in Go, it communicates with a locally hosted LLM through the Ollama API. The malware scans the filesystem, identifies sensitive information, and uses SPECK 128-bit encryption in ECB mode to encrypt files. It dynamically generates ransom notes and adapts its behavior based on the infected machine type. PromptLock's cross-platform compatibility and AI-driven script generation make it a significant concern for cybersecurity professionals, highlighting the need for advanced defensive strategies against evolving AI-powered threats.

MediumMalwareGermanyFranceUnited Kingdom+5#proof-of-concept#speck encryption#filesystem scanning

This report emphasizes the importance of community in the cybersecurity profession, reflecting on experiences at Black Hat USA 2025 and DEF CON 33. It highlights the value of these events for learning and networking, but also acknowledges their high costs and potential inaccessibility for many. The author encourages readers to seek out alternative, more accessible opportunities for engagement in the infosec community, such as local conferences, student clubs, and online resources. The report also touches on recent cybersecurity news, including a surge in ransomware attacks in Japan and warnings about exploited vulnerabilities. It underscores the constant evolution of cyber threats and the need for ongoing vigilance and education in the field.

MediumMalwareGermanyFranceUnited Kingdom+4#education#promptlock#networking