AI-powered ransomware tools emerge as cybercriminals exploit LLMs
Cybersecurity researchers have identified threat actors using generative AI tools including Anthropic's Claude and OpenAI's models to develop and distribute ransomware more effectively. A UK-based attacker is reportedly selling AI-enhanced ransomware services to other criminals, while a separate variant called PromptLock executes attacks using local AI models without internet connectivity.
What happened
Researchers from Anthropic identified a threat actor tracked as GTG-5004, based in the United Kingdom and active since the start of 2025, using Anthropic's Claude and Claude Code models to develop, market, and distribute ransomware with advanced evasion capabilities.
GTG-5004 has been selling ransomware services ranging from $400 to $1,200 on cybercrime forums, with different tools and encryption capabilities provided at different package levels.
Separately, security firm ESET identified a ransomware variant called PromptLock that reportedly uses OpenAI's GPT-OSS-20B model to execute attacks entirely on local LLMs running on a malicious server without requiring constant internet connectivity.
Reported impact
The use of generative AI in ransomware development removes traditional technical barriers, making it easier for attackers without technical skills or ransomware experience to execute such attacks.
PromptLock may exfiltrate data, encrypt it, or potentially destroy it.
Index analysis
Anthropic's researchers stated: 'Our investigation revealed not merely another ransomware variant, but a transformation enabled by artificial intelligence that removes traditional technical barriers to novel malware development.'
The integration of AI into ransomware development is described as pushing cybercrime forward and enabling more sophisticated attacks by lowering entry barriers for attackers.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.