Ransomware at Machine Speed: How GenAI Shrinks the Path after Initial Access

Technical Analysis

More Effective Social Engineering Ruses

Historically, most attackers’ social engineering game has been stifled by their inauthenticity. While there are many instances of intelligence-informed attackers crafting very believable ruses, these have been rare. The vast majority of ransomware actors used volume as their strategy for initially landing on a target system. This is why most user education campaigns have focused on spotting typos, non-native-speaking grammar mistakes, and other mostly obvious weaknesses in phishing emails and sites.

However, AI has unmistakably leveled the playing field, giving attackers the capability to blend into the wave of legitimate email like never before. This, in turn, gives them a much higher chance of tricking a victim into clicking the link, downloading the file, or otherwise falling into the trap that’s been laid.

Attackers can now use any of the public-facing GenAI platforms to create email messages, websites, and other assets that are polished, natively-built in the target’s language, and crafted to maximize success. As discussed in a previous blog, phishing emails are often used to trick a user into using a Remote Monitoring and Management (RMM) tool at the attacker’s behest, which then gives them full access to the victim’s system as well as potentially their wider environment.

Faster Discovery of Valuable Materials…To Steal

GenAI technologies are also well suited to examine massive amounts of data for the purposes of classification or content searching. Once an attacker has access to the victim’s system, GenAI can therefore be used to search all materials to which a victim’s system has access, seeking the most valuable or sensitive data for theft or encryption during the next phase of the attack.

This approach gives the attacker an incredibly fast method of identifying and acquiring the most damaging data, which then maximizes the likelihood the victim’s organization will pay the ransom to retrieve or prevent the disclosure of the encrypted/stolen data. Although this occurs after the initial access, it is still a form of reconnaissance. Speed is of the essence and GenAI makes the process even faster than it could be automated with traditional attacker scripts and playbooks.

Speedy Creation and Iteration of Bespoke Scripts

File and network signatures are perhaps one of the most well-established indicators in the security world. From the earliest days of antivirus to more modern implementations of fuzzy hashing and traffic fingerprinting, practically every security program uses signatures in some capacity. While this used to be effective, attackers can now rapidly vary their malware and scripts, resulting in corresponding variance of their signatures. This allows attackers to evade traditional detection mechanisms making it much harder to spot their activity based on those signatures alone.

Attackers using GenAI-built scripts and other malware also no longer need to rely on common tools that defenders are aware of and actively hunting for. Bespoke tooling was once the exclusive domain of well-funded threat actors, but the wide availability of GenAI tools opens those floodgates of potential for any threat actor with the motivation and a free (or stolen) LLM account. In the same vein, custom tools are no longer a clear indicator of an advanced threat actor. Garden variety ransomware operators become harder to differentiate from the larger and more resourced groups, significantly hindering threat actor identification.