LLMs are Accelerating the Ransomware Lifecycle to Gain Speed, Volume, and Multilingual Reach

The report outlines how ransomware crews increasingly use large language models—particularly self-hosted ones like Ollama—to accelerate every stage of extortion operations, from phishing and data triage to tooling and negotiation, while sidestepping provider guardrails. It highlights AI-assisted RaaS offerings and early “prompts-as-code” tools (e.g., PromptLock, MalTerminal) that embed LLM prompts and keys into workflows to generate or adapt payload components. Researchers observe no radically new malware, but significant gains in speed, scale, and multilingual reach that lower barriers to entry and industrialize ransomware operations.