AI-Powered Ransomware Emerges, Automates Large-Scale Attacks

Recent developments in cybercrime have revealed an alarming evolution in ransomware tactics, increasingly leveraging artificial intelligence and cloud capabilities. Researchers at ESET identified PromptLock, the first AI-powered ransomware using OpenAI's GPT-OS-20B to autonomously generate malicious code and execute attacks locally on Windows and Linux systems, although it remains a proof-of-concept without real-world deployment so far. Anthropic's threat intelligence report highlights criminals' use of AI, such as Claude Code, to automate extortion operations, including generating ransom notes and evading sanctions via fraudulent remote jobs, with payments demanded in cryptocurrency. Meanwhile, the Warlock ransomware strain, connected to the China-based Storm-2603 group, exploits zero-day vulnerabilities in Microsoft SharePoint servers to carry out targeted attacks, prompting security firms like AttackIQ to develop emulation tools to help organizations defend against these threats. Additionally, Microsoft Threat Intelligence reports that the Storm-0501 group has shifted from traditional on-premises ransomware to cloud-based operations, abusing Azure cloud features to exfiltrate data, destroy backups, and maintain persistent access, thereby bypassing endpoint defenses and inflicting faster, more severe damage. These trends underscore the critical need for robust security measures and continuous investment in AI safeguards to mitigate the growing misuse of AI and cloud technologies in ransomware attacks.