Conversation

Notices

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 28-Aug-2025 04:38:47 JST Kevin Beaumont

   I looked at a 'first generative AI ransomware' article tonight from a vendor, and looked into the actual samples.

   It appears they're not really ransomware, but created by a security vendor as a proof of concept.

   Need to decide if I write this up.

   • Embed this notice
     fuzzyfuzzyfungus (fuzzyfuzzyfungus@cyberplace.social)'s status on Thursday, 28-Aug-2025 06:04:41 JST fuzzyfuzzyfungus

     in reply to

     @GossiTheDog It seems profoundly in character for the 'first generative AI ransomware' to be a PR stunt that doesn't actually work and aligns poorly with the requirements of actual customers for attack tools.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 28-Aug-2025 07:13:30 JST Kevin Beaumont

     in reply to

     It would be great if any of the publications covering it actually bothered to investigate it..

   • Embed this notice
     Jonathan Reiter (张飞) (bees@infosec.exchange)'s status on Thursday, 28-Aug-2025 08:10:10 JST Jonathan Reiter (张飞)

     in reply to

     @GossiTheDog There's so many fucking caveats with this.

     1. It's not the first "polymorphic malware" or even ransomware that uses the LLM to permute things

     2. Detection wise this thing is gigabytes big when it packs model layers with it, so of course the signature is a slam dunk.

     3. It's such a slam dunk ESET has to say, "woah woah woah detection isn't that easy if this payload doesn't come with an LLM and proxies requests". And fair, but also prompts are so fucking big that even if encrypted those new comms should be triggering red flags everywhere.

     4. A design that would be a greater pest would live on the land for its capabilities. Use TruffleHog to grab creds and blend in with local or corporate LLMs. A real test of whether you are truly auditing the traffic behind each key.

   • Embed this notice
     Jordan Biserkov (jbiserkov@mas.to)'s status on Thursday, 28-Aug-2025 17:07:52 JST Jordan Biserkov

     in reply to

     @GossiTheDog
     Off topic: love the icy color scheme! Which app/theme is that?

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Sunday, 07-Sep-2025 17:24:03 JST Kevin Beaumont

     in reply to

     Also, the Trend Micro story about a billion Google accounts being breached is also bullshit - the story is written using GenAI. That one also went global.

     We've reached the point where vendors are just throwing shit at customers and journalists are just single source running it, nothing matters basically.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Sunday, 07-Sep-2025 17:24:06 JST Kevin Beaumont

     in reply to

     As a follow up, The Register did the actual journalism on this and yes - the #PromptLock generative AI ransomware story which went worldwide was bullshit. https://www.theregister.com/2025/09/05/real_story_ai_ransomware_promptlock/

     The CVE-2025-7775 generative AI exploit story also worldwide right now is also bullshit, I don't have the energy to explain why (hint: several of the Netscaler versions shown in the CheckPoint write up aren't even vulnerable).