Topic starter
02/08/2026 12:28 pm
TL;DR: PromptLock is the first known ransomware to use large language model output to generate Lua for file discovery, exfiltration, and encryption, introducing non-determinism that complicates detection, according to Anomali’s summary of ESET research. Static signatures lose value when execution paths can vary on each run.
Editorial analysis by NHI Mgmt Group, based on content published by Anomali: “Anomali Cyber Watch: PromptLock Ransomware, Blind Eagle, Lovable Website Attacks, and More”.
Key questions
Q: What breaks when ransomware generates its own code at runtime?
A: Static signatures and single-pass analysis lose coverage because the malware can produce different discovery or encryption logic each time it runs.
Q: Why does AI-enhanced malware make traditional detection less reliable?
A: Because the malware can be generated or modified to look more legitimate, change faster, and blend into normal software patterns.
Q: How can security teams spot non-deterministic malware behaviour?
A: Look for repeated execution paths that diverge in implementation but converge on the same malicious actions, such as file discovery followed by exfiltration and encryption.
Practitioner guidance
- Monitor runtime script generation Instrument endpoints and sandboxes to flag malware that requests model output or emits new scripts during execution, especially where behaviour changes between runs.
- Prioritise behaviour-based detections Tune detections to file discovery, exfiltration, and encryption sequences rather than relying on static hashes, strings, or one-off sample indicators.
- Harden access to model APIs Restrict outbound access to local or remote model endpoints from untrusted processes so malware cannot freely call an LLM to generate attack logic.
Bottom line: PromptLock demonstrates that AI-generated malware can vary its runtime logic, which weakens the reliability of static detection methods.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:27 pm
Runtime code generation is now a malware resilience technique. PromptLock shows that the defensive problem is no longer limited to a static payload that can be identified once and blocked forever. When the execution logic is partly generated at runtime, the adversary gains a practical way to vary discovery and encryption paths without changing the overall objective. The practitioner conclusion is that malware defence must weight runtime behaviour more heavily than file-based detection.
A question worth separating out:
Q: Why does a ransomware proof of concept still matter to security teams?
A: Proof-of-concepts often show which techniques are becoming practical before they appear at scale. Even if a sample is unfinished, it can validate a method that other actors later refine, so defenders should use it to adjust telemetry, detection logic, and AI security boundaries early.
👉 Read our full editorial: AI-generated ransomware changes the calculus for malware detection