How AI-Powered Ransomware Rewrites Itself

Google’s Threat Intelligence Group found experimental malware called PromptFlux that asks an AI model to rewrite its own code and slip past detection. Google described the sample as still in development, which Axios reports as an early sign of AI-enabled malware.

Your detection assumes a threat keeps a recognizable shape, and self-rewriting code breaks that assumption. The weakness sits in the model your tools depend on. That behavior defines AI-powered ransomware as code that changes shape faster than a signature can name it.

This article covers how the speed-up happens, why your security operations center falls behind, and what changes when enforcement takes over as the control point.

How AI Accelerates Ransomware Attacks

AI-powered ransomware speeds up the stages of an attack, with the first being initial access. Large language models cut the cost and the language barrier of social engineering.

Writing a convincing phishing message once took an operator a day. A model now writes ransomware in seconds, in fluent prose built from public data. Attackers send phishing messages at scale, and each one looks handwritten for its target. The perimeter no longer gives defenders the time they used to count on.

The second stage of the attack is exploit discovery. AI shortens the work of turning a newly disclosed flaw into a working exploit. That speed narrows the window between disclosure and attack. When an attacker has a working exploit before any patch exists, a defense that works by recognizing threats has nothing to recognize, and the attacker is already ahead of you.

In a joint advisory, CISA, the FBI, and the NSA reported that attackers first hit most of 2023’s top routinely exploited vulnerabilities as zero-days against enterprise networks. Any control you run that depends on prior knowledge of a threat begins each of these attacks behind. AI-powered ransomware widens the attacker’s head start. Self-rewriting code is the third way AI speeds up an attack.

Machine-Speed Ransomware Outpaces the SOC

Encryption finishes in minutes. Your triage, escalation, and containment run at human speed, on the order of hours. That gap between machine-speed attack and human-speed response is the whole problem, and more staff or better tools do not remove it.

Newer ransomware variants make that gap wider on purpose. In a November 2025 update, CISA and its partners reported an Akira ransomware variant built for faster encryption and designed to block system recovery.

By the time an analyst confirms the first alert, AI-powered ransomware has already done what it came to do. A control that waits for a person to decide is too slow for an attack that moves at this speed. Your security operations center still has a job, but it cannot be the last line against machine-speed encryption.

The financial cost is a matter of public record. The FBI’s Internet Crime Complaint Center logged 20.877 billion dollars in total reported losses in 2025, a 26% rise from 2024, and separately named ransomware among the highest reported cyber threats targeting critical infrastructure that year.

Recovery is your usual answer to that cost. A standard backup restores your last snapshot and loses everything created after it. RPO-Zero Recovery closes that data-loss window instead of leaving you with damage to undo later.

Self-Mutating Malware Defeats Conventional Defenses

Each control you run assumes a threat holds still long enough for a tool to catch it. Self-rewriting AI-powered ransomware removes that assumption, and this is how it defeats each layer:

• Static signatures: A signature describes a variant that already exists. It takes longer to write and distribute than the malware takes to rewrite itself, so the signature arrives after the code it describes has changed. You are always one version behind.
• Behavioral detection: Your behavioral models need a stretch of observed activity before a baseline forms. When the code re-architects before that baseline settles, the model never gets its sample, and every rewrite forces the model to begin again. Anomaly scoring needs a stable pattern that never appears.
• Hash-based controls: Your allow-lists and deny-lists key on a stable hash. Every rewrite produces a new hash, so the control treats a known threat as a new file each time it appears. There is nothing durable to match against.
• Memory scanning: Your scan runs on a fixed schedule. When the payload changes faster than the scan cycle, the scan reads a version the malware has already replaced. The finding describes a state that has already passed.
• Living-off-the-land techniques: PowerShell, WMI, and native admin tools in your environment are signed and expected, so there is often nothing for you to flag until damage is underway. Attackers use trusted software to make an unwanted change. The action is harmful even though every tool in the chain is trusted.

Each of these controls must recognize the threat before it can act, and self-rewriting code prevents that.

How Known-Good Enforcement Stops Ransomware

Self-rewriting code can change its own shape, but it still has to change your system to cause harm. Encryption is a change, and disabling a backup service is a change. Shutting down a security agent is a change. Each one is a change enforcement can evaluate before it takes effect.

Mimic runs at Ring 0, the kernel layer, and checks every change on your systems before it executes. When AI-powered ransomware tries to encrypt your files, disable your backups, or shut down your security agent, Mimic blocks the I/O transaction.

The rate of mutation does not matter, and neither does the novelty of the variant. The only question is whether the change matches Known Good. If the change is not Known Good, Mimic does not let it execute.

As a security architect, you will ask what counts as Known Good. Enforcement measures each change against a Known Good DNA model of your environment and its approved changes. The decision rests on a comparison with Known Good rather than a guess about the code’s intent. The model describes what normal change looks like in your environment.

That comparison runs inside the Controlled Execution Layer, at the kernel level, where the malware has to act to do harm. Known-Good Enforcement rules on the change itself. The model does not need to recognize the threat; it evaluates each change against Known Good, whatever code produced that change.

The Threat Patterns Mimic Covers

The same known-good decision applies across the threats you face. Three patterns show the range.

Self-Mutating Malware

The code rewrites itself on a short cycle. Enforcement stays mutation-agnostic, so the shape of the AI-powered ransomware never enters the decision, and the attempted change is all that matters.

The technique reaches well past any single sample, since any attacker with access to a capable model can build a rewrite loop. That reach is why Google’s findings matter beyond PromptFlux itself. Mimic frames how to stop AI-powered ransomware around that one decision point.

Living-off-the-Land

PowerShell, WMI, and other legitimate admin tools do real work in your environment every day. Mimic governs those tools at the kernel layer, so they keep serving approved tasks and cannot push through an unwanted change.

Enforcement looks at the change itself, so your normal operations keep running. You can keep your existing tools and workflow in place.

Agentic AI

Autonomous agents act on valid credentials at thousands of actions per second, faster than your team can review. The same enforcement model applies to an agent and to a person, and Mimic delivers that agent coverage as AI Shield.

An agent moving faster than your reviewers still cannot push a change that fails the known-good check. Approved actions run, Mimic blocks the rest, and Mimic logs every decision. The scope widens from ransomware to any unwanted change, from any source, which is where enterprise risk is already heading.

Where Mimic Fits: Not EDR, Not Backup

Three layers each handle an unwanted change differently. Detection tells you the change happened, and backup and recovery help you undo the change.

Enforcement is different. It stops the change from happening at all, and is the layer in your stack that is missing. You will still need detection and recovery tools to work alongside enforcement to secure your system against AI-powered ransomware.

Enforcement works differently: it stops the change before it ever executes, not after. That is the layer most security stacks are missing. Detection and recovery still matter, but they only answer what already went wrong, after it went wrong. Against AI-generated ransomware, you need something that answers the other question too.

Mimic sits beneath the tools you already run and works alongside them. It is not EDR, FIM, a backup, or BCDR tool, and not a feature added to one of those products.

Mimic adds the one control your existing stack leaves open: the decision that happens before a change runs. The value is the timing, as Mimic has maintained a 99.999 percent (five nines) reliability record across every protected environment, with zero successful ransomware executions.

Defend Yourself Against Self-Rewriting Ransomware

Attacks now adapt faster than you can respond by hand. The steady advantage is a control point that decides whether a change is Known Good and stops everything else, regardless of how the code looks. Google’s self-rewriting sample shows where the threat is heading, and the practical response is to make your environment enforce Known Good.