Notifications
Clear all
Topic starter
02/08/2026 12:28 pm
TL;DR: PromptLock is the first known ransomware to use large language model output to generate Lua for file discovery, exfiltration, and encryption, introducing non-determinism that complicates detection, according to Anomali’s summary of ESET research. Static signatures lose value when execution paths can vary on each run.
NHIMG editorial — based on content published by Anomali: Anomali Cyber Watch covering PromptLock ransomware, Blind Eagle, and related cyber activity
Questions worth separating out
Q: How should security teams defend against ransomware that changes its code at runtime?
A: Focus on behaviour, not just samples.
Q: Why do valid tokens and service accounts matter more than malware signatures?
A: Because trusted credentials let attackers operate as if they belong inside the environment.
Q: What do security teams get wrong about malvertising-led phishing?
A: Teams often treat malvertising as a web-advertising issue rather than an identity threat.
Practitioner guidance
- Harden behavioural ransomware detections Prioritise detections for unusual file enumeration, mass rename or encryption patterns, and script generation activity that does not match normal admin or backup workflows.
- Inventory and classify trusted non-human credentials Build a complete inventory of OAuth tokens, API keys, service accounts, and integration secrets that can authenticate into SaaS, cloud, and email systems.
- Reduce delivery trust in email and web channels Strengthen email authentication, attachment handling, and URL inspection so phishing and hosted lure pages cannot rely on default trust.
What's in the full analysis
Anomali's full post covers the operational detail this post intentionally leaves for the source:
- Analyst commentary on why AI-generated malware changes the defender’s detection model.
- Source-specific breakdown of PromptLock’s Lua generation, cipher use, and unfinished features.
- Campaign details on Blind Eagle’s infrastructure, regional targeting, and delivery mechanics.
- Proofpoint’s observations on Lovable abuse, including how attackers scale phishing pages and credential theft.
👉 Read Anomali's summary of PromptLock ransomware, Blind Eagle, and related cyber activity →
AI-generated ransomware and the detection gap defenders face?
Explore further
02/08/2026 1:27 pm
AI-generated malware creates detection drift: When malware logic is generated at runtime, defenders lose confidence in the repeatability that many detection stacks still assume. The issue is not only code obfuscation, but the possibility that each run produces slightly different file handling and encryption behaviour. That raises the bar for endpoint analytics, sandboxing, and threat hunting. Practitioners should expect more attack tooling that behaves like a moving target rather than a fixed sample.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
A question worth separating out:
Q: What should teams do when cloud tokens or integrations are suspected to be compromised?
A: Revoke the token or integration immediately, then trace what systems it could reach and what data it could access. Rotate related secrets, disable unnecessary scopes, and validate backups or keys were not altered. Treat the token as a compromised identity, not a simple configuration issue.
👉 Read our full editorial: AI-generated ransomware changes the calculus for malware detection
