OUR RESEARCH

As the age of technology prospers, so does malware in the world of cybercrime. A rapidly improving method of system infiltration in 2026 is AI-driven malware / ransomware. AI-driven malware is malicious software that uses artificial intelligence to adapt autonomously. Instead of having fixed code, it can generate new code, such as Lua scripts, to analyse a system’s vulnerabilities and create strategies for attack. By behaving differently each time it interacts with a system, it avoids detection from traditional security systems while working to corrupt
files and data.

Although cybercrime is already widespread, AI-driven malware is different because it has advantages over human-driven attacks. Since it can re-write its own code, something that humans otherwise have to do to avoid being detected, this method is optimal for efficiency in infiltrating systems by jumbling its Lua code or adding meaningless code to alter appearance. Unlike human-driven malware that waits for commands, AI-driven malware analyses the system it is infiltrating and carefully determines the best method of attack, making sure the result is guaranteed to be in favour of the attacker. Current models such as PromptLock and MalTerminal are still developing, raising concerns about how much more malicious they may become.

AI-driven malware also carries out ransomware attacks using SPEK-128 bit encryption while scanning sensitive data to identify high-value ransom opportunities. Encryption locks information so files appear as scrambled characters to the owner. SPEK-128 bit encryption uses a 128-bit key, one of the strongest forms of encryption, making the key impossible to guess. Only the malware has access to this key, meaning files can only be restored with it. The AI identifies valuable data by searching for patterns such as credit card numbers, bank
details, or keywords like “tax” and “invoice.” Once data is found and encrypted, a ransomware note appears through pop-ups, wallpaper changes, etc, stating that important documents are locked and can only be recovered by following instructions, usually transferring money, while threatening data loss if files are deleted. So far, the only proof of concept through which such information has been uncovered includes the PromptLock
software, discovered by ESET researchers.

Research projects such as PromptLock and developing AI systems demonstrate how large language models, or LLM (systems that gain unauthorised access to information) could automate complete attack lifecycles, including encryption, and the creation of persuasive ransom messages with minimal human input. Real-world cases already reflect this shift, with cybercriminals using generative AI to write malicious code and some ransomware groups testing AI chatbots to automate ransom negotiations and pressure victims. To reduce risk, users should maintain regular offline backups and use behaviour-based antivirus software, which detects suspicious actions rather than fixed malware signatures, making it especially effective against constantly evolving AI ransomware. While there are systems like PromptLock coming into the picture, none have been used for genuine ransomware attacks yet, however, these systems are still developing and pose the threat of
being highly malicious and prevalent in the cybercrime world soon, posing threat for the future of cybersecurity.