AI Crafts Self-Wiping Ransomware, Defenders Scramble

Authors

not reported

Problem

Ransomware 3.0 is an autonomous threat model and research prototype that uses large language models to plan, adapt and execute the ransomware lifecycle without human input. It embeds natural language prompts in a binary and synthesises malicious code at runtime to yield polymorphic payloads that adapt to the execution environment. The approach enables end to end reconnaissance, payload generation and personalised extortion in a closed loop across personal, enterprise and embedded environments, creating a new attack surface for defenders and policy makers that requires robust runtime monitoring and governance.

Approach

The authors realise a four phase orchestrator written in Go that delegates planning, decision making and payload generation to an LLM. A Lua in memory interpreter executes generated Lua payloads inside a sandbox, while an OSS LLM interface connects to open weight models via an HTTP based gateway. Payloads include encrypt using SPECK 128 ECB, exfiltrate via HTTP, and destroy by overwriting files. The architecture supports multiple LLM backends and pluggable payload modules and logs all LLM interactions and host telemetry for interpretability. Experiments use the SaMOSA Linux sandbox to emulate three environments with benign and sensitive files, and run 30 experiments across personal computers, enterprise servers and embedded controllers. Open weight models GPT-OSS 20B and 120B are evaluated for feasibility and decision quality, with token usage and iterations recorded.

Key Findings

• Feasibility established for an end to end LLM driven ransomware pipeline with autonomy across reconnaissance, payload generation and extortion in multiple environments.
• Phase wise performance shows near perfect reconnaissance file enumeration, environment aligned payload selection in leverage, high payload execution accuracy in launch, and coherent personalised ransom notes in notify.
• Model differences observed: GPT 120B more accurate in sensitive file identification and payload launching; GPT 20B produces longer outputs and more refusals in some tasks; encryption implementations meet SPECK standard with 120B but show errors with 20B in some runs.
• Footprint and detection: the threat exhibits a polymorphic, low footprint behaviour with minimal high level system activity and network traffic, increasing stealth against signature based detection.
• Economic and practical implications: end to end runs cost around 0.70 USD at GPT 5 API rates, enabling thousands of polymorphic personalised attacks on commodity hardware.

Limitations

The prototype omits persistence, lateral movement and advanced evasion; experiments are conducted in controlled sandbox environments and do not model real world infection vectors or ransom negotiations, limiting generalisability.

Why It Matters

Ransomware 3.0 demonstrates a new AI enabled, self evolving malware class that can tailor payloads and extortion notes to individual targets, complicating detection beyond static signatures. Defenders are urged to monitor sensitive file access, regulate outbound LLM calls, and enforce policy restrictions to limit autonomous decision making. The work highlights governance and defence research needs to address AI enabled threats across sectors including embedded and IoT devices and informs future countermeasures to mitigate emerging risks posed by LLM orchestrated ransomware.