Ransomware 3.0: Self-Composing and LLM-Orchestrated Article Swipe

MAKE IMPACT

Md Raz , Meet Udeshi , P. V. Sai Charan , P. Krishnamurthy , Farshad Khorrami , Ramesh Karri · YOU? · · 2025 · Open Access · · DOI: https://doi.org/10.48550/arxiv.2508.20444

Using automated reasoning, code synthesis, and contextual decision-making, we introduce a new threat that exploits large language models (LLMs) to autonomously plan, adapt, and execute the ransomware attack lifecycle. Ransomware 3.0 represents the first threat model and research prototype of LLM-orchestrated ransomware. Unlike conventional malware, the prototype only requires natural language prompts embedded in the binary; malicious code is synthesized dynamically by the LLM at runtime, yielding polymorphic variants that adapt to the execution environment. The system performs reconnaissance, payload generation, and personalized extortion, in a closed-loop attack campaign without human involvement. We evaluate this threat across personal, enterprise, and embedded environments using a phase-centric methodology that measures quantitative fidelity and qualitative coherence in each attack phase. We show that open source LLMs can generate functional ransomware components and sustain closed-loop execution across diverse environments. Finally, we present behavioral signals and multi-level telemetry of Ransomware 3.0 through a case study to motivate future development of better defenses and policy enforcements to address novel AI-enabled ransomware attacks.

Type

preprint

Language

en

Landing Page

http://arxiv.org/abs/2508.20444

PDF

https://arxiv.org/pdf/2508.20444

OA Status

green

OpenAlex ID

https://openalex.org/W4414448279

Raw OpenAlex JSON

OpenAlex ID

https://openalex.org/W4414448279

Canonical identifier for this work in OpenAlex

DOI

https://doi.org/10.48550/arxiv.2508.20444

Digital Object Identifier

Title

Ransomware 3.0: Self-Composing and LLM-Orchestrated

Work title

Type

preprint

OpenAlex work type

Language

en

Primary language

Publication year

2025

Year of publication

Publication date

2025-08-28

Full publication date if available

Authors

Md Raz, Meet Udeshi, P. V. Sai Charan, P. Krishnamurthy, Farshad Khorrami, Ramesh Karri

List of authors in order

Landing page

https://arxiv.org/abs/2508.20444

Publisher landing page

PDF URL

https://arxiv.org/pdf/2508.20444

Direct link to full text PDF

Open access

Yes

Whether a free full text is available

OA status

green

Open access status per OpenAlex

OA URL

https://arxiv.org/pdf/2508.20444

Direct OA link when available

Cited by

0

Total citation count in OpenAlex

Full payload