AI-Powered Ransomware: The Next Wave of Cybercrime

Ransomware attacks have been on the rise in recent years, affecting businesses of all sizes and industries. According to a report by Cybersecurity Ventures, ransomware is expected to cost the global economy $265 billion by 2031, up from $20 billion in 2021.

Cyber security is a never-ending battle against new and smarter malware. Security experts have to find and fix the malware before it spreads.

But that’s not enough, because AI makes malware more adaptable and dangerous. It can change itself and avoid or disable controls. It can also learn from the victims data and target their most important and valuable assets.

In this blog post, I will share with you some real-world examples of AI-powered ransomware, and some tips on how to protect yourself from them.

Examples of AI-Powered Ransomware

Here are some of the examples of AI-powered ransomware that have been reported or proposed by researchers and experts. They show how AI can help ransomware attackers to launch more effective and devastating attacks, and how difficult it is to defend against them.

• DeepLocker: This is a ransomware that was developed by IBM researchers as a proof-of-concept to demonstrate the potential of AI-powered ransomware. DeepLocker uses AI to hide its malicious payload in benign applications, such as video conferencing software. It then uses facial recognition, voice recognition, or geolocation to identify and target specific victims. Once it recognizes its intended victim, it activates the ransomware and encrypts the data.
• GhostEngine: This is a ransomware that was spotted by researchers from Elastic Security Labs and Antiy in May 2024. GhostEngine uses AI to evade detection and removal by security solutions. It loads vulnerable drivers from Avast and IOBit to terminate and delete the security agent binary. It also disables specific Windows event logs that record process creation and service registration. It then downloads and installs XMRig, a legitimate application for mining monero, and configures it to send the coins to an attacker-controlled wallet.
• RansomAI: This is a ransomware that was proposed by researchers from the University of Padua and the University of Trento as a theoretical model of AI-powered ransomware. RansomAI uses AI to perform stealthy encryption of data. It uses a reinforcement learning agent to select the files to encrypt based on their importance and the likelihood of being detected. It also uses an anomaly detection system to monitor the system behavior and avoid triggering alarms.
• REvil: This is a ransomware that was known to use AI to identify vulnerabilities in systems, and their successful attack on Irish Health Service heavily depended on the use of AI. REvil uses AI to automate the process of scanning and exploiting the network, and to encrypt the data with a unique key for each victim. REvil also uses AI to generate personalized ransom notes and to negotiate the ransom amount with the victims.
• Bonus: Cybercriminals are taking advantage of Google's search AI to trick the algorithm to point people to fake websites loaded with malware.

These URLs can lead to malicious websites that redirect to fraudulent giveaways, tech support scams, and spam subscriptions. This is what happened recently, as reported by SC Magazine.

The article explains how Google’s new Search Generative Experience (SGE) functionality, which uses AI to generate new content and links based on user queries, was exploited by cybercriminals to promote their malware and scams. The article also provides some tips on how to avoid falling for these fake URLs, such as checking the domain name, the SSL certificate, and the content quality.

How to Protect Yourself from Ransomware and AI Threats

To enhance your cyber security and resilience, you need to use next generation tools and best practices to protect yourself from ransomware and AI threats.

Here are 10 tips to protect yourself from AI Ransomware:

1. Use Extended detection and response (XDR): This is a tool that combines data and analytics from multiple sources, such as endpoints, networks, clouds, and applications, to detect and respond to cyber threats in real time. XDR can help you identify and stop ransomware attacks before they cause damage.
2. Use Software composition analysis (SCA): This is a tool that scans your software code and components for vulnerabilities and dependencies. SCA can help you prevent ransomware attacks that exploit software flaws and bugs.
3. Use Secure access service edge (SASE): This is a tool that integrates network and security services into a single cloud-based platform. SASE can help you protect your data and users from ransomware attacks, regardless of where they are located or what device they use.
4. Use Runtime application self-protection (RASP): This is a tool that monitors and protects your applications from malicious inputs and behaviors. RASP can help you block ransomware attacks that try to compromise your applications and data.
5. Backup your data regularly and store it in a secure location, such as an external hard drive or a cloud service. This way, you can restore your data in case of a ransomware attack. Bonus tip: You may want a backup server too as you will need somewhere to load your backups if you are locked out of the network.
6. Educate your employees and users about the risks and signs of ransomware attacks, such as suspicious emails, links, and attachments. Teach them how to avoid clicking on them with phishing simulations and how to report them to the security team.
7. Update your software and systems regularly with the latest patches and security updates. This can help you fix any vulnerabilities and bugs that ransomware attackers can exploit.
8. Use strong passwords and multi-factor authentication for your accounts and devices. This can help you prevent unauthorized access and compromise of your data and systems.
9. Invest in cyber insurance that covers ransomware attacks. This can help you recover from the financial and reputational losses caused by a ransomware attack. Even with the best controls, breaches can happen due to zero day exploits and the human element.
10. At the C3 Cyber Summit last week, Dennis Underwood, a former DOD cryptography specialist, spoke to us about the troubling trend of how AI is being used as a tool to augment ransomware. His company, CyberCrucible, stops rogue processes in case your MDR is disabled or a hacker is able to login as an administrator. It uses rogue process prevention (RPP) to detect and stop attempts to encrypt data and prevent the attack entirely. Unlike traditional cybersecurity solutions, RPP provides automatic, run-time protection without the need for additional cloud or response components, and it stops attacks in milliseconds.
11. Cyber Insurance if all else fails. Nowadays cyber insurance is much more affordable and comes with free services and discounts for many of the controls above. Talk to your cyber insurance agent about how to better protect your business.

The tools we've used in the past are not obsolete, but its important to use a combination of controls and failsafes to thwart cybercriminals and make your business a hard target.

If you want to learn more about ransomware and AI, and how to protect yourself from them, please contact me. I would love to hear from you and answer your questions. Be sure to subscribe to this newsletter or follow me to keep up with cybersecurity and cyber insurance news and tips.

Resources:

14 steps to secure your network

Scan your domain for vulnerabilities with a free cyber check up

Email [email protected] for a free incident response template for your company.

Don't forget to subscribe to the newsletter. :)

#ciso #cto #cybersecurity #infosec #security #datasecurity #networksecurity #cybercrime #hacking #malware #ransomware #firewall #internetsecurity #dataprotection #cyberattack #cyberdefense #cyberthreats #cyberawareness #onlinesecurity #secure #cybersafety #cyberprotection #cyberinsurance #hackernews #AI