How AI-Powered Ransomware Rewrites Itself

Google's Threat Intelligence Group found PromptFlux, an experimental dropper that prompts a large language model to rewrite its own source code to evade antivirus software. Google says the code is still in development and can't yet compromise a victim's network (Google Threat Intelligence Group). ESET found PromptLock, which it called the first known AI-powered ransomware, a proof of concept that generates its malicious scripts on the fly with a locally run model (ESET Research).

Updated 22 October 2026.

Your detection assumes a threat keeps a recognizable shape, and self-rewriting code breaks that assumption. The weakness sits in the model your tools depend on. That behavior defines AI-powered ransomware as code that changes shape faster than a signature can name it.

This article covers how the speed-up happens, why your security operations center falls behind and what changes when enforcement becomes the control point.

How AI Accelerates Ransomware Attacks

AI-powered ransomware speeds up the stages of an attack, with the first being initial access. Large language models cut the cost and the language barrier of social engineering.

ENISA reports that by early 2025, AI-supported phishing reportedly made up more than 80 percent of observed social engineering activity worldwide (ENISA Threat Landscape 2025). Attackers send phishing messages at scale, and each one can read as if it were written for its target. The perimeter no longer gives defenders the time they used to count on.

The second stage is exploit discovery. The NCSC assesses that the time between disclosure and exploitation has shrunk to days and that AI will "almost certainly" reduce it further (NCSC, Impact of AI on cyber threat from now to 2027). When an attacker has a working exploit before any patch exists, a defense that works by recognizing threats has nothing to recognize.

In a joint advisory, CISA, the FBI, the NSA and partner agencies reported that most of 2023's top routinely exploited vulnerabilities were first exploited as zero-days. Any control that depends on prior knowledge of a threat starts each of these attacks behind. Self-rewriting code is the third way AI speeds up an attack.

Machine-Speed Ransomware Outpaces the SOC

Ransomware works at machine speed. Triage, escalation and containment run at human speed. That gap between machine-speed attack and human-speed response is the problem, and more staff or better tools don't remove it.

Ransomware operators also go after recovery. In its November 2025 update on Akira, CISA and its partners reported that Akira's encryptor uses PowerShell to delete Volume Shadow Copy Service copies on Windows systems, to inhibit system recovery (CISA, Akira advisory; MITRE ATT&CK T1490).

By the time an analyst confirms the first alert, AI-powered ransomware has already done what it came to do. A control that waits for a person to decide is too slow for an attack that moves at this speed. Your security operations center still has a job, but it can't be the last line against machine-speed encryption.

The cost is a matter of public record. The FBI's Internet Crime Complaint Center counted $20.877 billion in total reported losses in 2025, up 26 percent from 2024, and named ransomware among the highest reported cyber threats targeting critical infrastructure (FBI IC3, 2025 Internet Crime Report).

Recovery is the usual answer to that cost, and a standard backup restores the last snapshot and loses everything after it. For protected critical applications, Mimic blocks the unauthorized change before it reaches the data, so there's no window of data loss to clean up. Where a restore is still needed, Mimic creates a restore point the moment it detects the change. RPO-Zero recovery explains the posture.

Self-Mutating Malware Defeats Conventional Defenses

Each control you run assumes a threat holds still long enough for a tool to catch it. Self-rewriting AI-powered ransomware removes that assumption, and this is how it defeats each layer:

• Static signatures: A signature describes a variant that already exists. It takes longer to write and distribute than the malware takes to rewrite itself, so the signature arrives after the code it describes has changed. You are always one version behind.
• Behavioral detection: Behavioral models need observed activity before a baseline forms. Code that keeps changing gives them less to learn from, and each rewrite can reset what they've seen.
• Hash-based controls: Your allow-lists and deny-lists key on a stable hash. Every rewrite produces a new hash, so the control treats a known threat as a new file each time it appears. There is nothing durable to match against.
• Memory scanning: A scan that runs on a schedule reads whatever version is present at that moment. When the payload changes between scans, the finding can describe a state that has already passed.
• Living-off-the-land techniques: PowerShell, WMI and native admin tools in your environment are signed and expected, so there is often nothing for you to flag until damage is underway. Attackers use trusted software to make an unwanted change. The action is harmful even though every tool in the chain is trusted.

Each of these controls must recognize the threat before it can act, and self-rewriting code prevents that.

How Known-Good Enforcement Stops Ransomware

Self-rewriting code can change its own shape, but it still has to change your system to cause harm. Encryption is a change, and disabling a backup service is a change. Shutting down a security agent is a change. Each one is a change enforcement can evaluate before it takes effect.

Mimic enforces at the kernel and checks each change to a protected system before it executes. When AI-powered ransomware tries to encrypt your files or disable your backups, that change doesn't run.

The rate of mutation does not matter, and neither does the novelty of the variant. The question is whether the change matches Known Good. If the change is not Known Good, Mimic does not let it execute.

As a security architect, you'll ask what counts as known good. Mimic profiles each protected system in its approved operating state: its files, processes, registry keys and services. Enforcement compares each change with that profile rather than guessing at the code's intent.

That comparison runs inside the Controlled Execution Layer, at the kernel level, where the malware has to act to do harm. Known-Good Enforcement rules on the change itself. The model does not need to recognize the threat; it evaluates each change against Known Good, whatever code produced that change. Read the kernel-level enforcement guide for how that decision is made before a change runs and how it differs from detection tools.

The Threat Patterns Mimic Covers

The same known-good decision applies across the threats you face. Three patterns show the range.

Self-Mutating Malware

The code rewrites itself on a short cycle. Enforcement stays mutation-agnostic, so the shape of the AI-powered ransomware never enters the decision, and the attempted change is all that matters.

The technique reaches well past any single sample, since any attacker with access to a capable model can build a rewrite loop. That reach is why Google’s findings matter beyond PromptFlux itself. Mimic frames how to stop AI-powered ransomware around that one decision point.

Living-off-the-Land

PowerShell, WMI and other legitimate admin tools do real work in your environment every day. Mimic governs those tools at the kernel layer, so they keep serving approved tasks and cannot push through an unwanted change.

Enforcement looks at the change itself, so your normal operations keep running. You can keep your existing tools and workflow in place.

Agentic AI

Autonomous agents act on valid credentials, often faster than your team can review. The same enforcement model applies to an agent and to a person, and Mimic delivers that agent coverage as Mimic AI Guardrails. For the discipline around it, see agentic AI governance.

An agent moving faster than your reviewers still cannot push a change that fails the known-good check. Approved actions run, Mimic blocks the rest and Mimic logs every decision. The scope widens from ransomware to any unwanted change, from any source, which is where enterprise risk is already heading.

Where Mimic Fits: Not EDR, Not Backup

Three layers each handle an unwanted change differently. Detection tells you the change happened, and backup and recovery help you undo the change.

Enforcement is different. It stops the change from happening at all. You still need detection and recovery tools alongside it to secure your systems against AI-powered ransomware.

Mimic works alongside the tools you already run. It isn't EDR, FIM, backup or a BCDR tool, and it isn't a feature added to one of them.

Mimic adds the control your existing stack leaves open: the decision that happens before a change runs.

Defend Yourself Against Self-Rewriting Ransomware

Attacks now adapt faster than you can respond by hand. The steady advantage is a control point that decides whether a change is Known Good and stops everything else, regardless of how the code looks. Google’s self-rewriting sample and ESET's proof of concept show where the threat is heading, and the practical response is to make your environment enforce Known Good.