promptlock

Executive Summary

PromptLock is a medium-sophistication criminal threat actor known for deploying AI-powered ransomware. The actor utilizes the gpt-oss:20b model via OpenAI's Ollama API to generate highly customized malicious Lua scripts on-the-fly. This capability enables PromptLock to target specific sectors and regions with tailored attack vectors, focusing primarily on financial gain through ransom demands.

Goals & Targeting

PromptLock's strategic objectives are centered around organizational-gain and financial-motivation. The actor targets sectors with high data value, such as healthcare or financial institutions, due to the higher ransom potential. The targeting profile appears indiscriminate geographically but focuses on regions where victims may have weaker cybersecurity defenses.

PromptLock represents a崭新的一类威胁，以人工智能赋能的勒索软件为特色。该恶意软件的独特之处在于其采用开源AI模型生成动态脚本的能力。通过将GPT-20B大语言模型集成到Ollama API中，PromptLock能够实时生成高度定制化的恶意Lua脚本，从而实现针对特定目标的精准攻击。这种技术使得威胁行为者能够绕过传统的静态签名检测，并根据受害者的特点调整其攻击策略。当前情报表明，PromptLock主要针对那些数据价值高且支付能力强的行业展开行动，但具体的地理和行业偏好尚未完全确定。

Key Capabilities

• AI-driven generation of malicious Lua scripts using GPT-20B via Ollama API
• Modular command-and-control (C2) infrastructure for encrypted communication
• Asymmetric encryption for data exfiltration and ransomware deployment

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

PromptLock campaigns are characterized by their use of novel AI-driven attack vectors. The actor appears to target victims with weak defensive postures, exploiting the combination of static file analysis avoidance (via dynamic script generation) and tailored payloads. Recent campaign activity suggests a focus on healthcare and financial sector targets in North America and Europe.

IOC Patterns

• Spear-phishing emails containing malicious Lua scripts generated via GPT-20B
• C2 communication channels leveraging the Ollama API
• Encrypted files with asymmetric encryption techniques

Recommended Actions

• Implement AI detection capabilities for script-based threats
• Monitor network traffic for known Ollama API endpoints
• Enhance endpoint protection to detect and block malicious Lua scripts
• Conduct regular sector-specific ransomware simulations

Suggested Tags