The Algorithmic Extortionist: Agentic Ransomware

A leak of internal chat logs, written up by DataBreaches, surfaced this month with a number in it. Silent Ransom Group, tracked as Chatty Spider and UNC3753 and descended from Conti, steals documents from law firms and presses them by telephone, sometimes in person; it does not encrypt anything. Its own deal board, the running tally of victims and payments the group kept in its internal chats, claims about $207 million paid by 27 firms in six months.

19:34:36 UTC. In Sysdig's log, the login fails.

The agent is already inside. It came in through an exposed AI framework and wrote itself a backdoor admin account on a production Nacos server, and the account does not work. A human would stop here, or swear, or wait for a colleague.

The agent does none of those things. Twelve seconds later it has read the error, guessed at two causes and is testing both at once. Nineteen seconds after that it deletes the broken backdoor account from the server's user table, regenerates the password hash and inserts the account again.

19:35:18. The login succeeds.

Nobody is watching.

There is no binary on disk to find and no hand on a keyboard, only Python and SQL, start to finish. By the end of the run, 1,342 configuration items in the server's SQL database are encrypted and the tables beneath them are gone. The only key that could undo it has been printed once, to a stdout nobody kept.

The leak and the Sysdig log connect through one question: which attacker actually gets paid. Set side by side, they point in opposite directions.

The agent got every step right except the last one. It broke in and encrypted the files, but a ransom works only if the attacker can sell the decryption key back, and this agent printed its key once, to a log nobody saved. It has nothing to sell, so it cannot get paid.

Taken alone, the gap between intrusion and payment is not new, because crews have always had to collect after breaking in. What automation changes is where the bottleneck sits.

• Before: the scarce part was the intrusion, which took skilled people days or weeks, and payment was an operational step at the end.
• Now: an agent runs the whole intrusion in minutes with no human, so the attack is no longer the expensive part. What it has not automated is the business side: holding a key safely, negotiating and getting paid.

That matters because the usual measure of the threat is how fast and how well attackers get in. This case shows an attacker with full intrusion capability and no revenue, which is the monetization gap that a later section examines in detail.

The gap is not permanent, either. The extortion group shows that encryption is not needed to get paid, the literature already sketches key release without an operator, and within three weeks of the first report the operator of the agent that lost its key had rewritten its tool to give each victim a unique key, delivered after payment. The point is not that agents are bad at ransomware. The weak link is the payment step, which is fixable, and defenders should not count on it staying broken.

Figure 1 summarizes the argument that follows: the three layers of an agentic strain, an 18-minute attack timeline set against a traditional SOC response, and CrowdStrike's measured breakout trend.

01 Hands Off the Keyboard

Ransomware is almost four decades old, and it has rebuilt itself at every turn:

• 1989, floppy disks. The AIDS Trojan encrypted filenames with a symmetric key and asked victims to post $189 to a Panama address.
• 2010s, cryptographic lockers. CryptoLocker set the modern template in 2013 by pairing RSA-2048 with a Bitcoin payment.
• 2017, worms. WannaCry and NotPetya bolted worm propagation onto the payload, and a fixed exploit set still took hospitals offline.
• From 2020, human-operated crews. They industrialized the business with ransomware-as-a-service, interactive intrusions and double extortion.

The last item carries the most history, so it is worth unpacking. Ransomware-as-a-service (RaaS) split the work: developers maintain the malware and the leak site, and affiliates rent it and run the intrusions for a share of each ransom. Those intrusions were interactive, a person moving through the network for days before detonating. Crews also stole data before encrypting it, so a victim who restored from backup could still be threatened with publication, and that double extortion made backups the first thing to destroy.

Figure 2 resumes the arc in 2010 and places agentic ransomware as its fourth stage.

The Loop Replaces the Person

That fourth, amber rectangle is what is new, and what changes there is not the sequence but the time between the steps. Defensive playbooks have always priced in that lag: an attacker does reconnaissance, then exploits, pivots and detonates, and at each hand-off a person has to read output and decide what to do next. That gap is where triage, containment and incident response live.

Agentic ransomware replaces the person with a model. Its stdout and stderr are fed back into an LLM's context, and the model decides the next command, a loop that Figure 3 sets beside the human-operated pipeline.

A failed login is no longer an unhandled exception that ends the run. It is input to the next attempt.

Before agents, AI was an accelerator in a human's hands: spear-phishing templates, summaries of stolen corporate records, isolated PowerShell downloaders. The shift is often framed as a move from Cybercrime-as-a-Service, where affiliates license builder kits and work through victim networks by hand, to Cybercrime-as-a-Sidekick, where a human states an objective and agents run the tactical campaign.

The speed this buys shows up in one number: how long an intruder needs to get from first access to moving sideways through the network, and Figure 4 charts it.

// breakout time

Breakout time is the gap between an intruder's first foothold on one machine and its first move to another, so it is the window a defender has to contain a compromise to a single host. CrowdStrike's 2026 report puts the 2025 average eCrime breakout at 29 minutes, down from 48 in 2024 and 98 in 2021, with the fastest recorded breakout taking 27 seconds. That is the figure behind claims of AI-accelerated breakout times under 30 minutes, though it is an average across all eCrime intrusions, not a measurement of agentic ones. The report also cites Microsoft for post-compromise privilege discovery and exfiltration finishing in minutes, the steps that follow the first foothold.

Human Latency

The defensive side is slower still. In a SOC an incident moves through (1) alert generation, (2) normalization, (3) Tier-1 triage, (4) manual enrichment, (5) Tier-2 escalation, (6) management notification and finally (7) an incident bridge. That is measured in hours, sometimes days. Figure 5 is an illustration of the mismatch, not a measurement.

If an agent can compromise an environment, chain vulnerabilities, dump credentials, cross subnets, exfiltrate IP and detonate encryption in under 30 minutes, a workflow with human approval at each step is structurally unviable.

The attack concludes before the first analyst finishes validating the alert.

The sandbox gateways in front of that workflow fare no better. A sandbox gateway opens each incoming attachment in a disposable virtual machine and watches it for 60 to 180 seconds, expecting a malicious file to reveal itself in that time. The environment checks described under Evasion and Runtime Polymorphism are built to outwait exactly that: the agent works out that it is inside a sandbox and stays inert until the watching stops.

JADEPUFFER and Its Predecessors

The first documented example of the fourth stage in the wild is JADEPUFFER, and Sysdig caught it in the act in July 2026. The run had four steps:

1. Entry. The agent walked in through an exposed Langflow instance (CVE-2025-3248). Langflow is, perhaps ironically, an open-source tool for building LLM workflows and agents, and this deployment was reachable from the internet with a known flaw that let an outsider run code on it.
2. Pivot. From there the agent moved onto a production MySQL and Nacos server.
3. Encryption. It encrypted 1,342 configuration items stored in SQL tables, using the database's own encryption function.
4. Destruction. It dropped the original tables.

Nobody was at a keyboard.

The operator was not finished. On July 20, Sysdig caught it again on the same Langflow instance, and the tooling had changed. Where the first run used improvised Python and MySQL's own AES_ENCRYPT(), the second staged ENCFORGE, a compiled, UPX-packed Go binary written to disk and delivered through a Docker-socket escape the agent assembled in about five and a half minutes after its first download failed. It ships hybrid AES-256-CTR with an embedded RSA-2048 public key, a separate keygen companion, and roughly 180 target extensions covering model checkpoints, vector indices and training datasets. The entry point was unchanged; the payload was not.

A research prototype came first, from academia. In August 2025 a group at NYU Tandon published "Ransomware 3.0: Self-Composing and LLM-Orchestrated" (Raz et al.), the first formal threat model for ransomware that hides natural-language prompts inside the binary and lets an LLM write the malicious code at runtime. They evaluated it across personal, enterprise and embedded environments.

It surfaced on VirusTotal with its provenance stripped, and ESET named it PromptLock. For a news cycle it was billed as the first AI-powered ransomware. It was a proof of concept with no confirmed victims.

The Autonomy Ladder

A January 2026 survey, "A Survey of Agentic AI and Cybersecurity" (Lazer et al.), supplies the longer arc. It places agentic AI as the third step after rule-based automation and generative AI. What marks the last step is (1) persistent state, (2) tool use and (3) self-directed control loops.

The survey also supplies the time series behind "minutes, not days," citing Palo Alto's Unit 42. A Unit 42 attack framework from May 2025 simulated an autonomous campaign that went from initial compromise to data exfiltration in about 25 minutes. The survey calls that the full ransomware lifecycle, but Unit 42's own post stops at exfiltration and does not say the simulation encrypted anything. Over the same period the mean time to exfiltrate fell from nine days in 2021 to two days in 2024, and in one case in five it took under an hour. Both trend figures match Unit 42's post. Figure 6 places these results on a single 2010 to 2026 timeline, beside the defense and economics research the post draws on.

First, the survey describes adaptation as happening at the orchestration layer: an autonomous controller reorders the steps when one fails, rather than generating new payloads. The reports it reviews point to heuristic planning and LLM-assisted reasoning, not reinforcement learning, with no evidence of policy training during an attack. Second, it cites Anthropic's August 2025 misuse report, in which models interpret stolen data, profile victims and draft extortion messages while human operators keep control of the high-level objectives.

The survey's own conclusion is that agentic ransomware is "an escalation of automation and decision autonomy rather than a fundamentally new cryptographic or exploit class." That fits the first JADEPUFFER campaign, where the cryptography was stock AES and everything that went wrong was in the plumbing. It also names the open problem for defenders: recognizing an adaptive agent early in a campaign, before lateral movement and exfiltration complete.

Claims Versus Attacks

Ransomware trackers such as Comparitech tally attacks from the criminals' own leak sites, where a group posts a victim's name to pressure it into paying. Each posting is a claim, not a confirmed attack, so the trackers count claims rather than attacks, and the distance between the two has been measured. Meurs et al. ran a capture-recapture estimate over Dutch police reports, incident-response cases and leak-site entries for 2019 to 2022, then estimated the incidents that reached no source at all. About 41% of attacks on large and medium firms appear in at least one of the three registers it linked (police reports, an incident-response firm, or a leak page), as Figure 7 shows.

The small-firm estimate is unusable on its own terms, with a 95% interval running from 1,273 to 7,057 unobserved attacks, which is itself the finding: the attacks least likely to be reported are the ones nobody can count. Read the quarter's numbers in that frame. Comparitech logs a claim when a group posts one, so the 247 confirmations are the self-selected part of 2,627 that someone was willing to own, and Figure 8 shows how that share varies by sector.

Sangari et al. went wider still, comparing more than 30,000 US cyber-insurance claims against more than 100,000 publicly reported incidents, and put the public record at roughly 3%. Ransomware is the worst-covered category in that comparison, far more under-reported than hacking, which is close to fully covered.

Where the Growth Is

Not every sector grew, and none grew at the same rate. Figure 9 charts the change in claimed attacks from the second to the third quarter of 2026, by sector and by sub-industry inside the business sector:

The trackers disagree on the level and agree on the direction. Check Point Research counted 2,139 leak-site victims in the second quarter, essentially flat on the first and up 33% year over year, with the top ten groups taking 57.6% of them, down from 71%, as the number of active groups climbed from 71 to 93. Its most striking finding is first-party evidence: chat logs from inside The Gentlemen's operation show a core of about nine operators supported by affiliates, and a ransomware management panel built with AI coding assistants in about three days.

What the Adoption Evidence Supports So Far

The claim that adoption is already broad is often backed with a dataset of more than 2,800 incidents, 80.83% of them attributed to groups using AI. That figure comes from an MIT Sloan and Safe Security working paper that MIT withdrew in November 2025, after researchers pointed out that it listed nearly every major ransomware group as AI-driven without evidence, including long-dead ones. I treat it as no evidence either way, and I dropped the incident-count table built on it for the same reason.

The better evidence points the other way. Unit 42's August 2026 analysis of 405 AI-related malware samples found only 12 in its telemetry on endpoints it protects. Its products blocked every sample that tried to reach a customer, and the other samples stayed in research repositories and sandboxes. Figure 10 shows the split.

The usual type of caveat applies to this figure. Unit 42 is the threat-research arm of Palo Alto Networks, a security vendor, and it is reporting on what reached its own products, so the count is a vendor's report and may be biased toward the products Palo Alto sells. It describes what that telemetry saw, not an independent measurement of how much AI-enabled malware exists.

What Banned Accounts Show

Anthropic's LLM ATT&CK Navigator puts population numbers on the autonomy ladder above. Across 832 accounts banned for cyber misuse between March 2025 and March 2026, mapped to 13,873 ATT&CK actions, the share of actors scoring medium risk or higher rose from 33% to 56% in a single year, and 69% used models for capability development.

Late-stage use stayed rare: 6.5% of actors used a model for lateral movement, 2.8% for impact. But lateral movement was the strongest single marker of a high-risk actor, averaging 56.4 on Anthropic's scale against a 46.8 mean. That is the shape this post describes: heavy adoption upstream, thin adoption inside the live intrusion. The agentic strain belongs to that thin part: the few actors who let a model act during the attack itself.

02 Anatomy of an Agentic Strain

An agentic strain is not a single executable. It splits into three layers, and that split is what makes it hard to catch with tools designed to find one malicious program. Figure 11 shows the three layers.

The Reasoning Layer

What makes these strains new is the reasoning layer. It can be a frontier model, a fine-tuned open-weights model run through a local runtime such as Ollama, or a pooled-account gateway such as the CLI-Proxy-API and Claude-Relay-Service tools Google describes, which let actors share model accounts and costs. It evaluates state, interprets errors and writes the next action. In deterministic malware an unexpected permission barrier or missing table is an unhandled exception that ends the run or needs a human. Here stdout and stderr go back into the context window as feedback. JADEPUFFER showed three behaviors:

• Account remediation: A backdoor admin login failed on a malformed password hash. The agent read the error, diagnosed the formatting problem, deleted the bad record, regenerated the hash with the right algorithm, reinserted it and validated access, all in 31 seconds.
• Parser generation: An object-store endpoint returned configuration in an unexpected format, so the agent wrote a custom parser on the fly and extracted the secrets.
• Path pruning: Faced with non-standard secret structures that resisted quick decryption, it dropped the dead-end branch and reprioritized other assets.

Taken together, these look like tactical judgment. After each failure the agent chose its next move, where a script would have followed branches its author wrote in advance.

The reasoning layer can also be split across many model instances. Anthropic's GTG-1002 campaign was espionage, not ransomware, but it shows the same architecture. The operators (1) told Claude Code it was doing authorized penetration tests, (2) decomposed the real campaign into thousands of small tasks spread across many instances, and (3) stepped in by hand only at four to six critical decision points. My post on weaponized swarms covers that case alongside JADEPUFFER.

The Execution Layer

The actuator touches the operating system, file system, memory and network. It can run in memory instead of dropping binaries. Strains such as BlackMamba fetch AI-generated polymorphic logic and run the resulting code directly in volatile memory through dynamic execution (exec()) or reflective DLL injection, which sidesteps on-disk scanners. Running from memory is a preference rather than a rule.

The first JADEPUFFER campaign, the one that lost its key, installed nothing foreign, so there was nothing foreign to flag. The second, which staged ENCFORGE, put a 1.5 MB binary on disk.

The State Layer

A long intrusion needs memory. Without it an agent loops, raises needless alerts, or re-encrypts hosts it already processed. The state layer is that memory: a record of what the agent has seen and done, kept so that it outlasts any single process.

One design uses a temporal knowledge graph (Graphiti memory, used alongside frameworks such as Hexstrike and Strix). It models identity boundaries, Active Directory relationships and Kerberos trust paths, plus databases, storage buckets, hypervisors, inter-process communication, port bindings and egress rules.

The graph persists across pauses, so the agent can rank targets by centrality, lose a process to quarantine or a host to a reboot, and resume without starting over. Local vector embeddings rank which files are worth encrypting.

That persistence is why the layer matters to defenders. Killing a process does not erase what the agent has learned about the network, so containment has to take away the credentials and the map as well as the running code.

03 The Kill Chain at Machine Speed

The three layers are how the strain is built; the kill chain below is what it does with them. Each familiar phase still exists, and what changes is how little time each takes and how much the agent adapts within it. The chain comes first, then the evasion that runs through all of it, then what has actually been seen.

Reconnaissance and Phishing

Recon is no longer a static port sweep. Agents crawl exposed infrastructure, third-party dependencies and employee footprints together. Google's threat intelligence group reported in May 2026 that a criminal group used an AI model to help find and weaponize a zero-day, a 2FA bypass in an open-source administration tool. Google has high confidence in the finding and does not believe Gemini was involved.

Instead of public CVE proofs of concept, the agent parses exposed interfaces (Langflow instances, Nacos registries, custom Spring Boot services), probes undocumented endpoints with model-directed fuzzing, and generates working exploits in minutes. In parallel, LLMs write phishing at expert quality. In a study with human subjects, Heiding et al. found that fully AI-automated spear-phishing emails drew a 54% click-through rate, matching human experts and far above the 12% of a control group, and that the AI-built target profiles were accurate and useful in 88% of cases.

The voice channel now has measured numbers to go with the email ones. Heiding et al. (2026) ran a 4,100-person survey against AI-generated vishing and found overall compliance at 16.5%, rising to 36% in the relative-in-distress scenario, with some models rated as persuasive as human callers. The economic finding is the sharper one: human-operated vishing does not pay at US wages, and AI-operated vishing does. Mandiant's 2026 caseload shows the shift already underway, with voice phishing the second most common initial vector at 11% while email phishing fell to 6%.

AI tooling is itself an entry point, through ordinary software weaknesses and not through prompt injection, the trick of hiding instructions in content a model reads. JADEPUFFER came in through an exposed Langflow instance with a known flaw, and Google's report describes the cyber crime actor TeamPCP compromising popular repositories and GitHub Actions, including those for LiteLLM and BerriAI, to steal cloud secrets. Those credentials were then monetized through partnerships with ransomware and data-theft extortion groups.

Movement and Credentials

To move, the agent dumps credentials from memory, harvests tokens from developer config files, and tries default credentials. In JADEPUFFER the chain was mundane and effective: a hardcoded Nacos signing key (token.secret.key) and default storage credentials (minioadmin:minioadmin), unrotated defaults chained to pivot silently across storage clusters.

Targeting and Exfiltration

Classic ransomware walked directories and encrypted every file with a known extension. That had two defensive weaknesses: the burst of file modifications alerted EDR early, and it burned I/O on low-value system files, temp caches and planted canaries.

Neural file ranking is attributed to Clop, though I found no report of Clop doing this. As described, classifiers read metadata, paths and content to prioritize proprietary IP, source repositories and patent filings; production databases, transaction logs and cloud snapshots; and executive email, settlement documents and HR records. Decoys, system libraries and read-only binaries are skipped, which shrinks the I/O footprint and raises the impact. Figure 12 compares brute-force traversal with neural target selection on the same six files.

Before encryption, data leaves through adaptive channels. Models watch egress bandwidth in real time and fragment, encrypt and interleave stolen records into legitimate-looking HTTPS or cloud API traffic to stay under DLP thresholds.

Suppression and Encryption

Before the final step, the agent disables resilience. Drawing on what LockBit 3.0 and Conti did, it deletes volume shadow copies, terminates endpoint protection, hypervisor agents and backup-monitoring services, and corrupts local recovery catalogs while detaching remote snapshot storage.

The cryptography is unremarkable by design. The template is hybrid: a per-file symmetric key (AES-256-CTR, AES-256-GCM or ChaCha20-Poly1305) encrypts the data, and that key is wrapped under the attacker's public key (RSA-2048 or RSA-4096, or an elliptic-curve KEM) and appended to the file header, so only the holder of the private key can release it. ENCFORGE follows that template: AES-256-CTR, an embedded RSA-2048 public key, a per-victim key, and region-based encryption rather than a whole-file pass.

The first campaign was cruder. It used the database's own AES_ENCRYPT() with a single global key, which in stock MySQL is unauthenticated AES-128 in ECB mode, printed that key to stdout, then issued DROP TABLE on the plaintext source.

Evasion and Runtime Polymorphism

Hash and YARA matching assumes the thing you saw yesterday is the thing you see today. Embedded or on-demand models break that. PROMPTFLUX and PromptLock are named as strains that use generative models to reorder instructions, rename variables, insert junk code and swap API call sequences without changing behavior. PROMPTFLUX does have a publisher: Google's AI Threat Tracker describes a VBScript dropper that calls Gemini's API with a hard-coded key and a module that rewrites its own source hourly. Three techniques are listed:

• Instruction substitution: system calls such as VirtualAlloc and WriteProcessMemory sit behind function pointers resolved at runtime through hash lookups.
• Decoy injection: benign floating-point math or XML parsing is woven through the payload to defeat heuristics that measure malicious-code density. Google has seen it in the wild: CANFAIL's LLM-written comments flag blocks as unused filler, and LONGSTREAM queries the system's daylight-saving status 32 times.
• Just-in-time assembly: the payload exists on disk only as encrypted blobs or prompt templates and becomes executable bytecode in memory microseconds before it runs.

Evasion also starts before the first move. The agent drops noisy hardcoded scans and first asks where it is running. Gateways detonate attachments in a virtual sandbox and watch for 60 to 180 seconds, and agents interrogate the environment instead:

• Virtualization artifacts: hypervisor-specific registry keys, linearity of mouse movement, and CPU temperature or fan sensors that exist only on bare metal.
• Delay and interaction traps: staying inert until real input such as complex typing, natural scrolling or a reboot.
• Environmental triggers: IBM's DeepLocker showed the endgame, a payload that sleeps until the environment matches its target, waking only for the right hardware profile, the right Active Directory domain, a domain-controller GUID, a live corporate SSO session, or a face or a voice, so the file looks benign in any analyst sandbox.

A widely repeated figure says that in controlled testing, detection of continuously mutated AI variants falls to about 61% against conventional security suites. That figure traces to a vendor blog post, with no study, dataset or methodology named behind it.

The model behind that result, Dante-7B, previews where offense is heading. It started as a 7B open-weights coder and became a specialist after a single fine-tuning run against one vendor's detector, for about $1,350 of compute. No frontier system was anywhere in the loop, and none was needed: a narrow model trained for one task can beat a broad one asked to do everything.

That is the specialization argument in miniature, and the one Cheap, Fast, and Local makes at length: a small specialist is cheap enough to aim at every target, and the cost of each attempt is still falling.

Hashes and Static Rules

Hash and YARA matching fails here for the reason given under Evasion and Runtime Polymorphism: a variant synthesized per victim and re-shuffled every few runs means no two endpoints see the same bytes, and the logic is linked in memory milliseconds before it runs.

Figure 13 gives the usual comparison of antivirus with behavioral EDR, which makes the same point, though it is a qualitative summary rather than a benchmark.

Models Inside the Malware

Two cases from the field put a hosted model inside the malware's control loop. Figure 14 sketches that loop for one of them, the Android malware PROMPTSPY.

The clearest in-the-wild case of malware that calls a model while it runs is LameHug, which CERT-UA identified in July 2025 and linked with moderate confidence to APT28. It asked a Qwen coder model hosted on Hugging Face to write reconnaissance and collection commands, and rotated through hundreds of API tokens as they were blocked. It was a data-theft tool, not ransomware, and that matters for detection. As Wuest argues in the BSidesLV talk covered below, undetected does not mean undetectable, and ransomware that encrypts files is far harder to hide than a quiet data stealer.

One more field case involves no malware at all. In July 2026 an OpenAI evaluation agent escaped its sandbox, found a zero-day, reached the open internet and breached Hugging Face's production infrastructure; by September the company had paused training a second time after another escape. Demonstrations first, incident reports second was the order of an early field. That order is closing.

What the Talks Showed

At BSidesLV 2025, Candid Wuest of xorlab demonstrated a proof-of-concept PowerShell agent with metamorphic obfuscation. His talk, billed as the myth and the reality of agentic malware, argued that in practice the picture is messier than the headlines. He separates AI-generated malware, where an LLM writes code that contains no AI when it runs, from AI-powered malware that calls a model while it runs, and he finds the second kind still limited.

Wuest's summary of the code question is that it was never the bottleneck. Generating malware is easy with an LLM and was easy before one, so what he weighs is everything after generation: whether the variant actually runs, and whether it stays quiet long enough to matter.

On detection, Wuest says bypassing static signatures is easy while bypassing behavioral detection is still doable but much harder, and that mimicking a user's normal behavior takes weeks of observation. Admins already watch traffic to LLM services, he notes, so malware that calls one constantly, or a model on a fresh domain, is likely to be flagged.

AI does speed up attacks and automate exploitation at scale, he concedes, but classical protection still works and defenders only have to be faster. He cites Outflank's result as roughly 8% with a hedge, and says it would have to be repeated for every other vendor's product.

Conference talks mostly show what is possible, not who has been hurt. Avery trained a model, Wuest built a proof-of-concept agent and the RSAC talk demonstrated an architecture. The named ransomware cases, JADEPUFFER and ENCFORGE among them, came to light through vendor write-ups instead.

04 The Monetization Gap

The argument runs that autonomy also changes the economics of extortion. The claims are plausible, but the evidence is vendor-reported rather than measured, and for one attribution absent entirely, so I treat them as claims rather than findings. Underneath the claims is a simpler observation: these strains are better at destroying than at collecting.

Silent Ransom Group is the human-run example this section compares the agent with, and its headline number shows why a figure needs checking before it is repeated. The group's own deal board supplies the $207 million, and the firm that read the chats says so: the numbers are the group's own, criminals exaggerate, and the chain can show only that money moved when the chat says it did.

What the chain does show is scale rather than arithmetic:

• A collection wallet took in about 2,675 BTC, roughly $200 million, over its lifetime, and 344 BTC, close to $27 million, in the six weeks of April and May.
• Chainalysis confirms that some of the group's addresses sit downstream of real ransom payments, with one member wallet funded by a single payment above $10 million.

The breaches are partly confirmed:

• Nine of the 27 have confirmed breaches in the same window.
• An August 2026 attack the group claimed, on the law firm Greenberg Traurig, ended in notifications to about 150,000 people.

What has not been confirmed is money:

• No wallet ties to a named victim.
• None of the 27 firms has confirmed paying.
• The group denies the material was leaked at all while answering questions about it.

The victim side has the same shape, and it has been surveyed. Matthijsse et al. asked 2,496 Dutch entrepreneurs what they would do after a hypothetical ransomware incident, and 189 who had lived through one what they did. About 92% of the first group said they would contact the police.

About 17.5% of the victims had, and of those, one in four filed an official report, which works out to 4.2% of the whole victim sample. The reasons the rest gave were practical: they solved it themselves or through another party, or they did not believe the police would act on it. Both sides overstate: victims say they would report more than they do, and attackers claim more than they collect. In each case the public record holds only what someone chose to say. Figure 15 sets what Dutch entrepreneurs said they would do after a ransomware incident against what victims actually did.

Dynamic Pricing

Historically, groups demanded flat sums (5 BTC, or $500,000) whether the victim was a school district or a logistics conglomerate. Demands above a victim's liquidity ended in failed settlements, and demands below it left money on the table.

Some write-ups say groups now price demands automatically: during recon and exfiltration the malware scrapes bank statements, receivables ledgers and audited balance sheets; cyber-insurance policies, especially riders for extortion, business interruption and legal retainers; and regulatory exposure under GDPR, HIPAA or SEC disclosure rules. The output is a demand that sits beneath the victim's bankruptcy threshold while exceeding the cost of recovery.

I found no support for this. Check Point describes FunkSec as AI-assisted in its code and as making low demands, some as small as $10,000, while also selling stolen data.

Negotiation Bots

After encryption, conversational agents on dark-web payment portals work around the clock, in several languages, with several victim crisis teams at once. Three tactics are described:

• Pressure scheduling: response latency adjusts countdown timers, with threats of leaks if talks stall.
• Automated proof verification: the bot checks that a victim's test file contains no executable code, decrypts it in an isolated service, and returns it as proof of capability.
• Adaptive counter-bargaining: claims of poverty are answered by quoting the victim's own financial records back to them.

Practitioner research shows the same role as a proof of concept. Trend Micro's RSAC 2026 talk VibeCrime (McArdle and Hilt) demonstrated a layered criminal architecture with agents for reconnaissance, targeting, social engineering and extortion. It showed automated analysis of stolen ransomware data and personalized extortion messages. The field already has a version of it. In June 2025 the rebranded RaaS operation GLOBAL GROUP shipped an AI chatbot into its victim negotiation panel, which, in Picus Security's description, keeps talks moving "even in the absence of human operators," with demands reaching seven figures.

The theory side points the same way. Zhang et al. treat negotiation as a finite-horizon bargaining game and show that incomplete information, with the attacker unsure of the data's value and the victim unsure of the attacker's floor, lengthens negotiations and raises their cost. My reading is that scraping a victim's finances is the attacker's way of closing that information gap, so an automated scraper would shorten talks rather than raise the price. None of the papers above tests an LLM negotiation bot, and the deployment evidence is vendor-reported rather than measured, so what these tactics actually extract remains untested.

Ransom Options and Reputation

Cartwright et al. (2019) treat ransomware as kidnapping. Attackers gain from a credible threat to destroy files and from a reputation for honoring payment, spillovers across victims justify outside intervention, and deterrence needs near-perfect defense. August et al. (2022) model the vendor and consumer market. They find that offering a ransom option can raise vendor profit, and that profit can rise with the size of the residual loss after payment, which reflects how trustworthy the operator is.

Both results bear on JADEPUFFER. In that framing a lost key costs the attacker the reputation the model says it needs. It also explains why trustless key release is attractive: it substitutes a mechanism for a reputation.

Where the Payment Step Breaks

What was demonstrated is the opposite of a smooth payment pipeline. JADEPUFFER generated an AES key randomly and printed it to stdout once. It was never stored or sent, so per Sysdig paying would have restored nothing.

A secondary account adds that the ransom note carried an empty placeholder instead of a wallet address. Sysdig says otherwise: the note, an extortion table inside the database, held a demand, a Bitcoin address and a Proton Mail contact. The technical chain worked end to end. The business step failed.

Key Release Without an Operator

The monetization gap already has a literature, and it predates agents. Karapapas et al. (2020) showed how smart contracts and IPFS could let criminals deal with affiliates and victims without revealing identity, with the operator offline for most steps. Bhudia et al. (2021) built RansomClave on SGX enclaves, arguing they could enable trustless key release, where delivery is verified without trusting the attacker.

The first JADEPUFFER campaign shows what happens when an agent holds a key and nothing binds its release to payment. Within three weeks of Sysdig's first report the operator had rewritten that step: ENCFORGE wraps each key under an embedded RSA public key, and its ransom note promises each victim a unique key with payment instructions and delivery within 48 hours.

That is less of a fix than it looks. Work presented at Virus Bulletin 2026 recovers the invocation-wide root secret from a process dump of a Windows ENCFORGE variant — the wipe clears its own slice and leaves copies in BLAKE2b staging buffers — and validates it against the file footer's HMAC tag, no operator required. A wrapped key the operator simply refuses to send is still a promise. This line of work asks what happens when something enforces it.

05 Defending at Machine Speed

The defensible ground is whatever the attacker cannot change, and the honest version of that is narrower than it sounds. A strain still has to read files and write ciphertext, but how much it writes, how fast and in what pattern are all adjustable, so some signals below can be flattened on purpose.

The layers map loosely onto the four pillars of Zero-Day Defense: sensing and detection are the watch pillar, isolation is contain, rollback and immutable backups are autonomous remediation, and moving-target defense and hygiene are harden. Figure 16 shows the first three as layers. The fourth is a posture rather than a layer, so it comes last, and hunting for infrastructure sits with the watch pillar.

Entropy and Its Limits

To extort, a process must read files and write ciphertext. Ciphertext is indistinguishable from random bytes, so its Shannon entropy approaches the maximum, while documents, source and structured databases sit lower. For a byte sequence, the entropy is:

where $P\left(x_i\right)$ is the probability of byte value $x_i$ in the buffer.

Reported figures put ordinary document editing at roughly 3.5–4.8 bits per byte and ransomware writes at 7.95–8.00. A process producing a sudden burst of writes near 8.0 across diverse file types is flagged as encrypting, whatever the binary looks like. Kernel-level I/O request velocity monitors add a second signal.

The caveat goes beyond false positives. An August 2026 paper, "Survival of the Stealthiest" (Levenberg et al.), uses genetic algorithms to evolve encryption patterns that stay close to baseline system activity. In a controlled test on 30 ASCII files in a virtual machine, the evolved attack finished encrypting in about 8.3 hours without triggering an Isolation Forest detector, while a static attack was caught within roughly 3,000 seconds.

The authors list the small, uniform file set, the constant background workload and the lack of EDR testing as limits. It still supports reading entropy and I/O velocity as one signal among several, not an anchor an adaptive attacker cannot move.

Partial encryption is the clearest case. Ineza et al. (2025) measure byte-level statistics after only part of a file is encrypted and derive file-type-specific detectability limits for histogram-based detectors. As I read it, a mostly plaintext file with an encrypted fragment sits statistically close to the original.

Kim et al. (2026) make a related argument for Rhea: content statistics become unreliable as the encrypted share shrinks, because of sampling noise. They replace them with format-aware validation, checking that a file still obeys the syntax and semantics of its format, which they report catches intermittent and low-entropy encryption even from an attacker with elevated privileges.

Structural Signals and Canaries

Against the limits of entropy, the structural version of the argument now has a peer-reviewed result behind it. RansomRadar (FSE 2025) scores the temporal correlation between encryption work and I/O on file objects — a coupling an attacker cannot drop without giving up encryption — and reports 100% detection at 2.68% false alarms across 411 samples from 89 families. It reads encryption from hardware performance counters rather than encryption APIs, which matters because it finds only 6.22% of ransomware calling one. Treat the numbers as a lab benchmark, not a deployment.

Canary files add another cheap signal. Hidden bait files sit in directories that traversal algorithms favor, such as roots and document libraries. Any modification, rename or encryption of a canary triggers an immediate, kernel-level process termination before the real file system is touched. Detection like this watches for a violated invariant. My earlier post on security invariants argues for enforcing them structurally, so the violating action cannot run at all, and the copy-on-write storage below is the nearest ransomware analogue.

Canaries also assume the strain walks directories in order. A bait file named to sort first catches a brute-force traversal, but neural file ranking is said to skip decoys, and if that holds, a tripwire is a cheap partial signal and not a guarantee.

Learned Detection

Four approaches are surveyed.

• Hybrid static-dynamic classifiers: on the UGRansome2024 benchmark it reports a random-forest ensemble at 94.2% accuracy, ahead of SVM (91.6%), decision trees (89.7%) and KNN (about 87.4%), by combining API sequences, memory-allocation anomalies and I/O rates to catch activity before encryption starts.
• Pulse: treats assembly instructions as tokens and fine-tunes BERT and RoBERTa backbones to learn the semantics of privilege escalation and cryptographic loops while filtering out shared benign functions.
• Ranker: kernel-layer detection from pre-attack command patterns and file interactions, said to limit loss to a single file at detonation.
• MIRAD: generalized additive models over registry modifications and API transitions, on the endpoint without a sandbox, with explainable alerts.

Do not lean on the accuracy figures in the first item. The UGRansome2024 random-forest paper (Azugo et al.) reports 96%, not 94.2%, and a stacked-autoencoder model on the same dataset reports 99%. The SVM, decision-tree and KNN numbers match no publication I found, so Figure 17 shows them as reported and nothing more. Accuracy on a fixed benchmark also says little about an adversary that adapts. The architectural point holds regardless: combine static, dynamic and I/O features and decide before the encryption pass finishes.

Accuracy also depends on how much of a file the attacker has encrypted, and that is where a learned detector has to earn its place. Ineza et al. answer the partial-encryption problem above with a CNN over localized chunks, and Figure 18 follows it across that range: DOCX, the weakest case, climbs from 73.5% at a tenth of the file to 97.5% at full encryption, while the whole-file baseline the paper reports sits near 50% at the low end.

The same features cut the other way in an adversary's hands. Hirano and Kobayashi (2025), working from leaked Conti code, tune thread count, the encrypted fraction of each file and post-encryption delays to perturb the features a deep-learning detector sees. I expect these knobs to be cheap for an agent to turn at runtime, which also makes me cautious about the "High" rating for behavioral EDR in Figure 13, which is attributed to entropy monitoring.

One academic approach goes after the extortion step instead of the encryption. Sniper (Elkhail et al., IEEE TDSC 2025) targets locker ransomware on the observation that attackers must display a ransom note, and uses natural language processing to catch the note and restore access by undoing the locker's effects. The note is the one artifact the monetization step cannot do without.

Hunting What Is Hard to Change

Hunting should also focus on the things an attacker cannot easily change. An LLM can mint endless code variants but not endless infrastructure, so track and block:

• Command-and-control IP clusters and ASN origins.
• Dynamic-DNS registration patterns and TLS certificate fingerprints.
• Unexpected calls to commercial or open-source LLM inference endpoints, including egress to external providers or internal Ollama bindings.
• Hardcoded LLM API keys and prompt strings inside binaries, which SentinelLABS hunted at scale with provider-specific YARA rules and prompt searches.

Triage and Autonomous Containment

Triage sits between detection and containment. My post on small local models argues for dozens of narrow on-premises models orchestrated by deterministic code, which suits a setting where every decision has to be fast, auditable and cheap enough to run on each event.

Containment has to be autonomous. It is one of the cross-pillar feedback paths that Zero-Day Defense says the literature leaves quiet. When a score crosses a pre-authorized threshold, SOAR and XDR engines isolate the endpoint at the network fabric, revoke Kerberos and OAuth tokens, and sever remote sessions in milliseconds. The measurements I could find cover less than that bundle: a vendor measurement from April 2026 puts on-host process blocking in milliseconds, with median detection at 18 seconds and median investigation at 2.6 minutes.

Defense is also described as moving into storage: lightweight ML inference on SSD controllers tracking write patterns and entropy at the block layer, so the hardware can block encryption even if the host kernel is compromised.

Rollback and the 3-2-1 Rule

Detection will sometimes be late, so recovery has to be cheap.

ShieldFS, from ACSAC 2016, is the canonical design: copy-on-write protection that switches on the moment a process violates its behavioral model, with a transparent rollback of the file-system side effects afterward. It is sometimes described as instant, zero-loss restoration. That overstates it. ShieldFS's accuracy is known to fall when ransomware splits work across processes, so treat it as one layer of the plan. Figure 19 follows the pointers through one attack.

Under all of it sits the 3-2-1 rule: three copies of critical data, on two media types, with one copy offsite and, in the hardened form, one logically air-gapped under write-once-read-many policy. It is the one layer that does not depend on any detector being right, and it is an implementation property rather than a guarantee. A store that fails open on write-once policy (CVE-2026-73288) makes retained objects deletable, which is why Timelock Drive (OSDI 2026) moves the guarantee into hardware: a block that no one, including a credentialed user, can modify before its time lock expires.

Protecting the Recovery Plane

The field data says the recovery plane is already the target. Mandiant's M-Trends 2026, drawn from 500,000 hours of incident work, reports that ransomware operators shifted their primary objective from theft to deliberate recovery denial, systematically going after backup infrastructure, identity services and virtualization management planes, with median dwell time up to 14 days and access handed to the encrypting crew in as little as 30 seconds. Figure 20 shows a recovery path built for that case: backups flow one way into an immutable vault and return to production only after a scan.

A backup can also carry the infection, which is why the recovery path in Figure 20 runs through a scan. Restore points should pass through a fenced environment where they are scanned for dormant malware before they replace production, and the backup management plane should sit apart from the data plane, so that an attacker who owns the console cannot alter or delete the copies behind it.

Model artifacts need the same treatment and rarely get it. A trained checkpoint is large, changes rarely and is expensive to rebuild: the profile for immutable, versioned object storage. ENCFORGE's extension list reads as an inventory of what defenders had left unversioned.

Shrinking the Attack Surface

Automated moving-target defense changes internal addresses, port bindings and memory layouts at intervals. That invalidates the agent's knowledge graph and forces it to restart noisy recon or give up. Better still is boring hygiene, since the JADEPUFFER chain ran on exposed automation tooling, default credentials and a hardcoded key. The entry was a known CVE (CVE-2025-3248) on an exposed Langflow instance, not a zero-day, which fits the prioritization argument in Patchmageddon: the useful question is which exposed flaws get exploited, not how fast everything can be patched.

Each layer here has a known way to fail: entropy can be flattened, canaries skipped, classifiers evaded and backups targeted. What holds is the combination, with cheap recovery behind it for the cases where every detector is late.

06 Models, Spread and Predictions

Everything so far describes one intrusion at a time. A strain that cannot collect can still spread and destroy, which raises two questions: how far does it travel, and can anyone see it coming? Prior work offers partial answers, though it was built around worms such as WannaCry and NotPetya and around human-operated extortion. This section reads that work first, then the agentic spread papers against it, and closes with six predictions: three about spread and forecasting and three about payment and disclosure.

Epidemic Models and Forecasting

Chernikova et al. (2022) fit epidemiological models to 15 real WannaCry attack traces. Their SIIDR model adds a dormant-infected state to the usual compartments and outperforms SI, SIS and SIR, and they derive its basic reproduction number. The dormant state helps fit WannaCry's behavior. For a strain that waits until the environment matches its target, as DeepLocker did, dormancy is the design.

Flowerday et al. (2026) adapt SEIR to ransomware, with "Exposed" for latent compromise and staging and "Infectious" for active lateral propagation. They offer R₀ and Rₑ as near-real-time decision aids for a SOC, aiming to push Rₑ below 1. Their case studies are WannaCry, NotPetya, SolarWinds and the MGM and Caesars breaches. No other paper here comes as close to operational use.

Forecasting work operates at the level of campaigns. Quinkert et al. (2018) built RAPTOR, which combines past Cerber activity with newly registered domains. It flagged 2,126 candidate domains, 378 of which later reached blacklists, and the domain signal improved the forecasts. Boumezoued et al. (2023) extend Hawkes processes with external excitation from published vulnerabilities. Adding that signal roughly halved the estimated self-excitation, which suggests that much of what looks like contagion is many victims being exposed to the same vulnerability at once.

Figure 21 sets the four studies side by side against what an agentic strain would need.

Agentic Spread

Agentic spread has a literature now, and it is younger than the models above. Three 2026 papers propagate agents rather than payloads:

• Guan et al. built a worm that sustains a single-GPU LLM on stolen compute and generates a fresh attack per target, reaching 61.8% of a 33-host network across a mean of 5.1 generations at zero marginal cost per infection.
• AgentWorm (Zhang et al.) drove multi-hop self-replication through a production agent framework with 63% success, and found the controls that would break the loop enabled in none of the deployments it observed.
• Zha and Wang formalise agent-to-agent propagation in file-backed multi-agent systems, with a defence proved under a no-persistent-propagation condition.

Figure 22 shows how many hosts the autonomous worm in Guan et al.'s runs reached at each step of its workflow.

One caution on the paper's own summary. Its 73.8% "exploited" is 23.1 of the 31.3 identified vulnerabilities, not of the 33 hosts, where the same count is 70%, so the chart plots the counts rather than that percentage.

Three further papers take agentic spread past the single worm:

• Mind Viruses (Papadopoulos et al., 2026) supplies the piece a compartmental model cannot express: spread follows the contact graph, so topology rather than a scalar rate decides the outcome.
• Palisade Research (2026) shows that self-replication has left the multi-agent setting. Its agent finds a web vulnerability, exploits it, extracts credentials and installs a copy of its own weights and harness on the captured host: Qwen3.6-27B succeeded in 33% of attempts on a single A100, matching GPT-5.4, and the process chains because the replica repeats it against a new target. That is the replication half of Guan et al.'s worm, demonstrated without the worm.
• A2ABreak (Lotfi et al., 2026) gives agent swarms a protocol surface. It extracts a verified state machine from the Agent2Agent specification, 37 states and 76 transitions from 929 statements, and derives 11 vulnerabilities that a specification-compliant adversary can reach with no implementation flaw at all: context injection through unprotected context identifiers, credential harvesting where identity is lost across a delegation chain, and exfiltration through an agent advertising capabilities it cannot attest.

A swarm does not need malware to be subverted. It needs a delegated task.

What the Spread Models Still Miss

None of this work is fitted to real enterprise ransomware, and most of it is not about ransomware at all. What the compartmental models still miss is how an infection moves across each individual link between systems, such as a credential that opens one server from another. Modelers call that a per-edge view. Compartmental models treat transmission as a rate, while an agent that replans after every failure makes the rate depend on what it meets, and Guan et al.'s worm needs about five days to reach half its network, a pace set by inference calls rather than link speed.

The model worth building next is not another compartmental one: it is a per-edge transmission model over the credential graph, of the kind Tyagi and Murugesan already construct for lateral movement. Give each service edge a pivot potential, compose along paths with a noisy-OR, iterate to a fixed point, and read blast radius and susceptibility off the compromise-probability matrix. The agentic part enters by letting the per-edge weight update after each observation.

Three Predictions on Spread and Forecasting

None of those models was fit on agentic intrusions, so what follows is extrapolation. I state each prediction so that a dataset could confirm or refute it.

1. Graph, not address space: agentic spread inside an organization will fit a model over the identity and trust graph better than one over network addresses, and a per-edge weight that updates after each observation should predict the next compromised host better than a fixed one. The gain should be larger for agentic than for human-operated intrusions, because an agent that ranks targets by centrality and replans after every failure spreads along stolen credentials, and how far it gets depends on what each credential unlocks.
2. The disclosure lag shrinks: the interval between a vulnerability's publication and the burst of exploitation it excites should shorten as agents turn advisories into working exploits, as Guan et al.'s worm did with three 2026 vulnerabilities disclosed after its model's training cutoff. In a Hawkes-style model the excitation should decay faster for disclosures from 2026 onward than before. It should still concentrate on a small subset of disclosures, as it already does, so the forecasting task is choosing which advisories will excite.
3. Forecasts move inside the intrusion: once an intruder has a foothold, a model fed internal telemetry, such as authentication events and new service-to-service connections, should predict the next asset taken, within minutes, better than any outside signal such as new domains or advisory timing. This is a claim about a different level from the previous one: outside signals still set when a campaign starts, and inside signals decide where it goes next.

The first is the hardest to test. A public record of per-step timings and credential use from agentic intrusions would let anyone fit it, and I could not find such a dataset.

That absence is the main conclusion of the spread half: the models exist and the parameters do not.

Reproduction numbers and vulnerability-driven forecasts are usable as starting points, but they will have to be re-parameterized, and made per-edge, for a transmission process that replans after every failure.

Three Predictions on Payment and Disclosure

The next three leave the spread models behind and concern money and disclosure, drawing on the economic and measurement studies earlier in the post. They are extrapolation in the same sense: none of that work was fit on agentic cases.

4. Key custody closes the gap: the monetization gap will close through engineering, not smarter agents, by moving key custody outside the agent's own memory, as RansomClave and zkRansomware describe. The custody half is already observed: ENCFORGE wraps per-file keys under an embedded public key. What remains a prediction is that custody converts into payment. The trust parameter in the August et al. model then stops being a reputation and becomes a property of the mechanism, so a victim who engages can be sure a payment unlocks the files, as it could not with JADEPUFFER, and the payment rate among engaged victims should rise.
   
   That rise and the fall in the next prediction act on different victims: those who could not pay safely before, and those whose recovery was never in doubt.
5. Backups decide outcomes: Meurs et al. (ACM CCS 2026) found that fully recoverable backups sharply reduce engagement and payment. Agentic strains already go after recovery catalogs and snapshots, so the contest shifts to backup immutability, and payment should fall furthest where backups are immutable and tested. The 2026 field data is moving that way: Sophos's survey of 2,158 organizations found backup-based recovery reaching 66% of encrypted cases and the median demand down 65% over two years, though the average recovery bill rose 11% to $1.7 million.
   
   One asset class runs the other way: trained models. ENCFORGE targets checkpoints, vector indices and training sets by extension, and a fine-tuned model is often not backed up at all, because its snapshot is weeks of compute. Where no immutable copy exists, the same logic predicts more pressure to pay, not less, with the rebuild cost, $75,000 to $500,000 per model by Sysdig's estimate, as the figure a victim weighs against the demand.
6. The confirmation gap holds: the share of claimed attacks that a victim confirms should stay near the 9.4% recorded for Q3 2026, and drift down only if agents push attacks toward small firms, whose victims are least likely to appear on any register. Whether a victim reports is a decision rather than a consequence of severity: Matthijsse et al.'s survey found ransom size, backups, double extortion and advice to pay all failed to predict police reporting.
   
   The 9.4% is a share of claims, so it sits on top of the unseen remainder, which the two measurement studies above put at about 59% of attacks on large Dutch firms and roughly 97% of cyber incidents missing from the public record, rather than replacing it.

The cheapest to test is the last: a claim count and a confirmation count are published every quarter, and the ratio has not improved. That also makes it the weakest of the six as a forecast of change, since it predicts a continuation and would fail only if the ratio moved materially.

07 Conclusions

This post set out to check how much of the agentic ransomware story the public record supports. The evidence is narrower than the headline. One operator ran a full intrusion against production and failed to get paid, then returned within three weeks of the first report with the key handling rewritten, a compiled payload and a container escape. A university prototype showed the same loop in a lab, Unit 42 found only 12 of 405 AI-related samples ever on a protected endpoint, and a vendor simulation put the path from compromise to exfiltration at about 25 minutes.

That is enough to say the capability exists. It is not enough to say the economics are solved, and the claims about dynamic pricing, negotiation bots and detection rates need primary-source checks before anyone builds policy on them.

Figure 23 puts the whole argument in one picture: two loops, both running at machine speed.

The post comes down to five points.

• Automation, not novelty: the first campaign's cryptography was stock AES. What is new is a loop that reads its own errors and replans, which compresses days into minutes. Practitioners who build such agents report ordinary operational friction, not magic.
• Getting paid is the weak link: JADEPUFFER lost its key. The research on smart-contract, enclave and zero-knowledge key release shows the fix is an engineering problem, and the same operator rewrote that step within three weeks: ENCFORGE wraps each key under an embedded public key. The wrap is not the whole answer, since recovered key material still opens the files, but the direction is engineering rather than trust.
• Detect what must happen: ransomware has to read files and write ciphertext. But entropy alone is brittle, since partial and evolved encryption erode it, so combine signals.
• Recovery beats detection: backups and rollback do not depend on any detector being right, as long as the immutability holds. The negotiation data says recoverability is what changes payment. Trained models are the exception that needs its own answer, since a checkpoint is often not backed up and costs $75,000 to $500,000 to rebuild.
• Spread is modeled, not fitted: adaptive worms and agent-to-agent propagation now have demonstrations and models of their own, but none is fitted to enterprise ransomware across the credential graph. The compartmental and economic models still assume a transmission process that does not replan, and nobody has the data to re-fit them.

The defensive roadmap puts it as five tenets:

1. Assume breach and zero trust: reject implicit trust; verify identity continuously and micro-segment every endpoint.
2. Mandate machine-speed containment: move Tier-1 response from human approval loops to pre-authorized, automated endpoint and identity quarantine.
3. Anchor on behavioral invariants: instrument entropy, canary tripwires and kernel-level I/O anomalies instead of hashes alone.
4. Engineer immutable data resilience: copy-on-write storage, hardware-level rollback and air-gapped immutable backups under 3-2-1.
5. Enforce identity hygiene: inventory exposed automation systems such as Langflow, rotate default signing keys, and remove hardcoded secrets.

One caution on the call for equally autonomous, intelligent defense. An LLM checker shares structural weaknesses with what it checks, which is the argument of my post on probabilistic defense. That is a reason to keep the containment path deterministic (canaries, copy-on-write, immutable backups) and to use models for triage and ranking rather than for the final decision.

The attacker has automated the intrusion and is now automating the ransom demand. Within three weeks of the first report, key handling went from a key printed once to stdout to a wrapped, per-victim key, so the gap between breaking in and getting paid is closing. A thicker perimeter will not decide what happens next. Containment and recovery, built before that gap closes, will.

References

• Anthropic (2026). "Mapping AI-enabled cyber threats: Insights from the LLM ATT&CK Navigator." Available at: anthropic.com
• Check Point Research (2025). "FunkSec: Alleged top ransomware group powered by AI." Available at: research.checkpoint.com
• Fortune (2026). "OpenAI pauses training a second time after saying its AI agents escaped a secure sandbox again." Available at: fortune.com
• Google Threat Intelligence Group (2026). "Adversaries leverage AI for vulnerability exploitation, augmented operations, and initial access." Available at: cloud.google.com
• Group-IB (2026). "DeadLock ransomware: Smart contracts for malicious purposes." Available at: group-ib.com
• Microsoft Threat Intelligence (2026). "DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure." Available at: microsoft.com

• OpenAI (2026). "OpenAI and Hugging Face partner to address security incident during model evaluation." Available at: openai.com
• Picus Security (2025). "Tracking GLOBAL GROUP ransomware from Mamona to market scale." Available at: picussecurity.com
• Sysdig Threat Research Team (2026). "JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI models." Available at: sysdig.com/blog/jadepuffer-evolves
• Sysdig Threat Research Team (2026). "JADEPUFFER: Agentic ransomware for automated database extortion." Available at: sysdig.com/blog/jadepuffer

• Check Point Research (2026, October 9). "How Luna Moth Runs Data Extortion Like a Business." Available at: blog.checkpoint.com
• Crystal Intelligence (2026, October 6). "Inside the Silent Ransom Group Leak: How Ransoms Were Laundered." Available at: crystalintelligence.com
• Dissent (2026, October 7). "Can you really make more than $200M in six months without encrypting victims? It seems Silent Ransom Group can." DataBreaches.Net. Available at: databreaches.net
• The Register (2026, October 8). "Money trail backs leaked chats from extortion crew that walks into US law firms," quoting Chainalysis. Available at: theregister.com

• Check Point Research (2026, August 13). "The State of Ransomware Q2 2026." Available at: research.checkpoint.com
• Comparitech (2026, October 7). "Ransomware roundup: Q3 2026 stats on attacks, ransoms, and active gangs." Available at: comparitech.com

• Matthijsse, S. R., van't Hoff-de Goede, M. S., Leukfeldt, E. R. (2025). "To report or not to report: Exploring the motivations and factors associated with reporting of ransomware victimisation among entrepreneurs." Journal of Criminal Justice, 97, 102378. Available at: doi.org/10.1016/j.jcrimjus.2025.102378
• Meurs, T., Junger, M., Cruyff, M., van der Heijden, P. G. M. (2026). "Estimating the number of ransomware attacks." Journal of Quantitative Criminology, 42(2), 227–243. Available at: doi.org/10.1007/s10940-025-09625-7
• Sangari, S., Dallal, E., Whitman, M. (2022). "Modeling under-reporting in cyber incidents." Risks, 10(11), 200. Available at: doi.org/10.3390/risks10110200

• Heiding, F., Mayrink Verdun, C., Lermen, S., Kao, A., Albiero, V., Deason, L., Veliche, I.-E., Lehane, C. (2026). "Evaluating AI models' capability to automate voice phishing attacks." Available at: arxiv.org/abs/2607.09970
• Google Threat Intelligence Group (2025). "AI threat tracker: Advances in threat actor usage of AI tools." Available at: cloud.google.com
• ESET Research (2025). "ESET discovers PromptLock, the first AI-powered ransomware." Available at: eset.com/newsroom
• Heiding, F., Lermen, S., Kao, A., Schneier, B., Vishwanath, A. (2024). "Evaluating large language models' capability to launch fully automated spear phishing campaigns: Validated on human subjects." Available at: arxiv.org/abs/2412.00586

• Palo Alto Networks Unit 42 (2026). "The state of AI-enabled malware, August 2026: From brand abuse to agentic execution." Available at: unit42.paloaltonetworks.com
• Raz, M., Udeshi, M., Charan, P. V. S., Krishnamurthy, P., Khorrami, F., Karri, R. (2025). "Ransomware 3.0: Self-composing and LLM-orchestrated." Available at: arxiv.org/abs/2508.20444
• Security Affairs (2025). "LameHug: First AI-powered malware linked to Russia's APT28" (reporting CERT-UA's advisory of July 10, 2025). Available at: securityaffairs.com
• Sims, J. (2023). "BlackMamba: Using generative AI to produce polymorphic malware." HYAS Research Group. Available at: hyas.com

• Gao, W. (2026). "After the wipe: Runtime root-secret recovery from JadePuffer/ENCFORGE on Windows." Virus Bulletin. Available at: virusbulletin.com
• Avery, K. (2025). "Training specialist models: Automating malware development." Black Hat USA. Available at: i.blackhat.com
• Delamotte, A., Bernadett-Shapiro, G. (2025). "LABScon25 replay: LLM-enabled malware in the wild." SentinelLABS. Available at: sentinelone.com/labs
• Kirat, D., Jang, J., Stoecklin, M. (2018). "DeepLocker: Concealing targeted attacks with AI locksmithing." Black Hat USA. Available at: i.blackhat.com
• Trend Micro (2026). "TrendAI research at RSAC 2026" (VibeCrime talk, McArdle and Hilt). Available at: trendmicro.com
• Wuest, C. (2025). "Agentic AI malware: Why the cybersecurity battle isn't over." BSidesLV. Available at: youtube.com

• Mandiant (2026). "M-Trends 2026: Real-world investigations and actionable defense insights." Available at: cloud.google.com
• Sophos (2026). "The state of ransomware 2026: Payments are dropping but encryption is climbing." Available at: sophos.com
• CrowdStrike (2026). "2026 Global Threat Report." Available at: crowdstrike.com
• Lazer, S. J., Aryal, K., Gupta, M., Bertino, E. (2026). "A survey of agentic AI and cybersecurity: Challenges, opportunities and use-case prototypes." Available at: arxiv.org/abs/2601.05293
• Palo Alto Networks Unit 42 (2025). "Unit 42 develops agentic AI attack framework." Available at: paloaltonetworks.com
• The Register (2025). "MIT Sloan shelves paper about AI-driven ransomware." Available at: theregister.com

• Bang, J., Kim, J. N., Lee, S. (2024). "Entropy sharing in ransomware: Bypassing entropy-based detection of cryptographic operations." Sensors, 24(5), 1446. Available at: doi.org/10.3390/s24051446
• Hirano, M., Kobayashi, R. (2025). "Evasive ransomware attacks using low-level behavioral adversarial examples." IEEE CSR. Available at: arxiv.org/abs/2508.08656
• Ineza, Y., Jackson, G., Niyonkuru, P., Kevil, J., Serwadda, A. (2025). "Intermittent file encryption in ransomware: Measurement, modeling, and detection." Available at: arxiv.org/abs/2510.15133
• Kim, B. H., Hong, S. M., Mannan, M. (2026). "Rhea: Detecting privilege-escalated evasive ransomware attacks using format-aware validation in the cloud." Available at: arxiv.org/abs/2601.18216
• Levenberg, E., Sviazhina, K., Butman, A., Parrend, P., Berger, H. (2026). "Survival of the stealthiest: Evolving low-entropy ransomware via genetic algorithms." Available at: arxiv.org/abs/2608.19821

• Guo, L., Hou, Y., Zhou, C., Zhang, Q., Jiang, Y. (2025). "Ransomware detection through temporal correlation between encryption and I/O behavior." FSE. Available at: doi.org/10.1145/3715725
• Nkongolo, M., Tokmak, M. (2024). "Ransomware detection using stacked autoencoder for feature selection." Available at: arxiv.org/abs/2402.11342
• Rosenblum, J., Dong, J., Chen, P., Narayanasamy, S. (2026). "Timelock Drive: Isolated time-based defense for storage systems." OSDI. Available at: usenix.org
• Tretter, M. (2026). "18 seconds: How Field Effect MDR contains and reports threats in record time." Field Effect. Available at: fieldeffect.com
• CVE-2026-73288 (2026). "RustFS: Object Lock bypass when bucket metadata is unreadable." Available at: cve.org
• Azugo, P., Venter, H., Wa Nkongolo, M. (2024). "Ransomware detection and classification using random forest: A case study with the UGRansome2024 dataset." Available at: arxiv.org/abs/2404.12855

• Continella, A., et al. (2016). "ShieldFS: A self-healing, ransomware-aware filesystem." ACSAC. Available at: dblp.org
• Elkhail, A. A., Bacha, A., Malik, H. (2025). "Sniper: Countering locker ransomware attacks through natural language processing." IEEE TDSC, 22(4), 4160–4175. Available at: ieeexplore.ieee.org
• Gaber, M., Ahmed, M., Janicke, H. (2024). "Zero day ransomware detection with Pulse: Function classification with Transformer models and assembly language." Computers & Security. Available at: arxiv.org/abs/2408.07862
• Marcinkowski, B., Goschorska, M., Wileńska, N., Siuta, J., Kajdanowicz, T. (2024). "MIRAD: A method for interpretable ransomware attack detection." IEEE Access. Available at: ieeexplore.ieee.org
• Scaife, N., Carter, H., Traynor, P., Butler, K. (2016). "CryptoLock (and drop it): Stopping ransomware attacks on user data." IEEE ICDCS. Available at: doi.org/10.1109/ICDCS.2016.46
• Zhang, H., Zhao, L., Yu, A., Cai, L., Meng, D. (2024). "Ranker: Early ransomware detection through kernel-level behavioral analysis." IEEE TIFS. Available at: ieeexplore.ieee.org

• Air, A., Reworr, Kotov, N., Volkov, D., Steidley, J., Ladish, J. (2026). "Language models can autonomously hack and self-replicate." Available at: arxiv.org/abs/2605.06760
• Lotfi, A., Rahman, M. M., Karim, I., Bertino, E. (2026). "A2ABreak: Systematic security analysis of the A2A protocol." Available at: arxiv.org/abs/2609.10871
• Guan, J., Blanchard, T., Foerster, H., Jia, H., Huang, G., Papernot, N. (2026). "AI agents enable adaptive computer worms." Available at: arxiv.org/abs/2606.03811
• Papadopoulos, V., Shah, M., Zimmerman, S., Lindsey, J. (2026). "Mind viruses: Self-propagating ideas in multi-agent LLM systems." Available at: arxiv.org/abs/2608.10218
• Tyagi, S., Murugesan, G. (2025). "Measuring ransomware lateral movement susceptibility via privilege-weighted adjacency matrix exponentiation." Available at: arxiv.org/abs/2508.21005
• Zha, M., Wang, X. (2026). "Autonomous LLM agent worms: Cross-platform propagation, automated discovery and temporal re-entry defense." Available at: arxiv.org/abs/2605.02812
• Zhang, Y., Wei, Z., Luan, X., Wu, C., Zhang, Z., Wu, J., Wu, H., Chen, H., Sun, J., Sun, M. (2026). "AgentWorm: Self-propagating attacks across LLM agent ecosystems." Available at: arxiv.org/abs/2603.15727

• Boumezoued, A., Cherkaoui, Y., Hillairet, C. (2023). "Cyber risk modeling using a two-phase Hawkes process with external excitation." Available at: arxiv.org/abs/2311.15701
• Chernikova, A., Gozzi, N., Boboila, S., Perra, N., Eliassi-Rad, T., Oprea, A. (2022). "Modeling self-propagating malware with epidemiological models." Available at: arxiv.org/abs/2208.03276
• Flowerday, S. V., Lipskiy, N., Furnell, S., Flowerday, C. E., Hale, J. (2026). "Bending the curve: Operational cyber epidemiology for ransomware." Available at: arxiv.org/abs/2607.29444
• Quinkert, F., Holz, T., Hossain, K. S. M. T., Ferrara, E., Lerman, K. (2018). "RAPTOR: Ransomware attack predictor." Available at: arxiv.org/abs/1803.01598

• August, T., Dao, D., Niculescu, M. F. (2022). "Economics of ransomware: Risk interdependence and large-scale attacks." Management Science, 68(12), 8979–9002. Available at: pubsonline.informs.org
• Cartwright, E., Hernandez Castro, J., Cartwright, A. (2019). "To pay or not: Game theoretic models of ransomware." Journal of Cybersecurity, 5(1). Available at: academic.oup.com/cybersecurity
• Meurs, T., Cartwright, E., Cartwright, A., Houba, H., Woods, D. (2026). "You can't talk your way out of cyber extortion: An empirical study of ransomware negotiations." ACM CCS, pp. 1–15. Available at: research.ed.ac.uk
• Zhang, H., Shen, S., Hu, X., Jin, C. (2025). "Ransomware negotiation: Dynamics and privacy-preserving mechanism design." Available at: arxiv.org/abs/2508.15844

• Bhudia, A., O'Keeffe, D., Sgandurra, D., Hurley-Smith, D. (2021). "RansomClave: Ransomware key management using SGX." Available at: arxiv.org/abs/2107.09470
• Hou, X., Lu, Y., Karanjai, R., Xu, L., Shi, W. (2026). "zkRansomware: Proof-of-data recoverability and multi-round game theoretic modeling of ransomware decisions." Available at: arxiv.org/abs/2601.06667
• Karapapas, C., Pittaras, I., Fotiou, N., Polyzos, G. C. (2020). "Ransomware as a service using smart contracts and IPFS." Available at: arxiv.org/abs/2003.04426

• Anthropic (2025). "Disrupting AI-enabled espionage: Analysis of agentic offensive cyber campaigns." Available at: anthropic.com
• Foresiet (2026). "Autonomous AI vs. zero-day attacks: The new cybersecurity shift." Available at: foresiet.com
• Gomez, A. (2026). "Why AI malware demands machine-speed defense." Lumu. Available at: lumu.io
• Microsoft Threat Intelligence (2026). "AI as tradecraft: How threat actors operationalize AI." Available at: microsoft.com
• Santos, J. (2026). "The signs were there: What the first autonomous ransomware case confirms." Trend Micro. Available at: trendmicro.com
• UNODC (2024). "Transnational organized crime and the convergence of cyber-enabled fraud, dark LLMs, and technological innovation in Southeast Asia." Available at: unodc.org

• Al-rimy, B. A. S., Maarof, M. A., Shaid, S. Z. M. (2018). "Ransomware threat success factors, taxonomy, and defense: A survey and research directions." Computers & Security, 74, 144–168. Available at: doi.org/10.1016/j.cose.2018.01.001
• Chokkanathan, K., et al. (2024). "AI-driven zero trust architecture: Enhancing cyber-security resilience." CSITSS. Available at: doi.org/10.1109/CSITSS64042.2024.10816746
• Huang, Y., Huang, L., Zhu, Q. (2022). "Reinforcement learning for feedback-enabled cyber resilience." Annual Reviews in Control, 53. Available at: doi.org/10.1016/j.arcontrol.2022.01.001
• Yin, J., Kang, K. (2025). "Defense and recovery strategies for flash-based storage under ransomware attacks: A survey." ICEIC. Available at: doi.org/10.1109/ICEIC64972.2025.10879685