{"id":4732,"date":"2025-09-09T01:12:54","date_gmt":"2025-09-09T01:12:54","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=4732"},"modified":"2025-09-09T01:12:54","modified_gmt":"2025-09-09T01:12:54","slug":"ai-powered-autonomous-ransomware-campaigns-are-coming-say-experts","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=4732","title":{"rendered":"AI powered autonomous ransomware campaigns are coming, say experts"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

The creation of an AI proof of concept that can autonomously build and execute a ransomware attack from scratch shouldn\u2019t alarm CISOs who are prepared, says an expert.<\/p>\n

The defense against such a proposed new tool, said Taylor Grossman<\/a>, director for digital security at the Institute for Security and Technology (IST), is simple: \u201cBoring cyber hygiene practices.\u201d<\/p>\n

\u201cBeing aware of where things are going is certainly helpful,\u201d she said, \u201cbut there\u2019s so much to be done already and a lot of those defensive measures can also help some of this AI-enabled ransomware as well.\u201d<\/p>\n

She was commenting on a furor raised last week when security researchers at New York University published an article<\/a> claiming to have created a prototype of large language model (LLM)-orchestrated ransomware.<\/p>\n

\u201cUnlike conventional malware,\u201d they wrote, \u201cthe prototype only requires natural language prompts embedded in the binary; malicious code is synthesized dynamically by the LLM at runtime, yielding polymorphic variants that adapt to the execution environment. The system performs reconnaissance, payload generation, and personalized extortion, in a closed-loop attack campaign without human involvement.\u201d<\/p>\n

They dubbed this next generation of malware Ransomware 3.0.<\/p>\n

Security provider ESET, which came across traces of their work in the VirusTotal virus scanner, quickly called it \u201cthe first known AI-powered ransomware,\u201d<\/a> before clarifying the NYU discovery is a proof of concept and not in the wild. Nevertheless, a number of IT news outlets picked up the ESET report, treating it as an in the wild attack.<\/p>\n

The NYU research should have been expected. After all, a number of security vendors predicted a while ago that threat actors will try to leverage AI in the creation of malware. For example, just over a year ago, the IST released a report on the implications <\/a> \u2013 pro and con \u2013 of AI in cybersecurity. In June, CSO reported <\/a>that a North Korean-affiliated gang is using AI generated deepfakes in real-time video calls. And last month, Anthropic said it has discovered genAI attacks that didn\u2019t need a human hand.<\/a><\/p>\n

Grossman\u2019s work at IST includes supporting the Ransomware Task Force, which has produced guidance for infosec pros on combating ransomware<\/a>. She avoided describing the NYU proof of concept as alarming. Rather, she suggested, it\u2019s expected.<\/p>\n

So far, it only works in a university lab setting, she pointed out, but she doesn\u2019t doubt a real tool used by a threat actor is coming. She\u2019s more interested today in the fact that such a tool will make it easier for less technically sophisticated people to enter the ransomware game.<\/p>\n

Joseph Steinberg<\/a>, a US-based cybersecurity and AI expert, also wasn\u2019t surprised by the research.<\/p>\n

\u201cWhile the folks at NYU produced a proof of concept,\u201d he said in an email to CSO<\/em>, \u201cit is entirely possible that criminals beat them to it. I have already seen AIs that can do scans, write malware, identify which resources are most valuable, [and more]. It is no surprise that someone found a way to have an AI automate such functions.\u201d<\/p>\n

Grossman advised CISOs to continue implementing security controls under frameworks created by the Centre for Internet Security<\/a> or the US National Institute for Standards and Technology (NIST)<\/a>.<\/p>\n

\u201cWe\u2019re unlikely at this point to see a shift in the ransomware model\u201d from an AI-generated autonomous ransomware attack tool, she said.<\/p>\n

\u201cThis is a good opportunity to remind people that, while the NYU study can be frightening in a lot of facets, there is a lot [defensively] that can be done that organizations aren\u2019t prioritizing. The tools are out there and we need better awareness of what can be done.\u201d<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

The creation of an AI proof of concept that can autonomously build and execute a ransomware attack from scratch shouldn\u2019t alarm CISOs who are prepared, says an expert. The defense against such a proposed new tool, said Taylor Grossman, director for digital security at the Institute for Security and Technology (IST), is simple: \u201cBoring cyber […]<\/p>\n","protected":false},"author":0,"featured_media":4733,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-4732","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/4732"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4732"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/4732\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/4733"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4732"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4732"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4732"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}