Topic starter
02/08/2026 12:28 pm
TL;DR: PromptLock’s runtime code generation lets file discovery, exfiltration, and encryption vary across runs, according to Anomali’s summary of ESET research. Static signatures and single-pass analysis lose coverage when the same sample can unfold differently each time it executes.
Editorial analysis by NHI Mgmt Group, based on content published by Anomali: “Anomali Cyber Watch: PromptLock Ransomware, Blind Eagle, Lovable Website Attacks, and More”.
Key questions
Q: Why does AI-enhanced malware make traditional detection less reliable?
A: Because the malware can be generated or modified to look more legitimate, change faster, and blend into normal software patterns.
Q: How can security teams spot non-deterministic malware behaviour?
A: Look for repeated execution paths that diverge in implementation but converge on the same malicious actions, such as file discovery followed by exfiltration and encryption.
Q: What breaks when ransomware generates its own code at runtime?
A: Static signatures and single-pass analysis lose coverage because the malware can produce different discovery or encryption logic each time it runs.
Practitioner guidance
- Monitor runtime script generation Instrument endpoints and sandboxes to flag malware that requests model output or emits new scripts during execution, especially where behaviour changes between runs.
- Prioritise behaviour-based detections Tune detections to file discovery, exfiltration, and encryption sequences rather than relying on static hashes, strings, or one-off sample indicators.
- Harden access to model APIs Restrict outbound access to local or remote model endpoints from untrusted processes so malware cannot freely call an LLM to generate attack logic.
Bottom line: PromptLock demonstrates that AI-generated malware can vary its runtime logic, which weakens the reliability of static detection methods.
Glossary terms: Non-Deterministic Malware, Runtime Code Generation, Behavioral Detection, Model API Exposure
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:27 pm
Runtime code generation is now a malware resilience technique. PromptLock shows that the defensive problem is no longer limited to a static payload that can be identified once and blocked forever. When the execution logic is partly generated at runtime, the adversary gains a practical way to vary discovery and encryption paths without changing the overall objective. The practitioner conclusion is that malware defence must weight runtime behaviour more heavily than file-based detection.
A question worth separating out:
Q: Why does a ransomware proof of concept still matter to security teams?
A: Proof-of-concepts often show which techniques are becoming practical before they appear at scale. Even if a sample is unfinished, it can validate a method that other actors later refine, so defenders should use it to adjust telemetry, detection logic, and AI security boundaries early.
👉 Read our full editorial: AI-generated ransomware changes the calculus for malware detection