LLM-Powered MalTerminal Malware Uses OpenAI GPT-4 to Create Ransomware Code

GBHackers on Security reports on MalTerminal, a Windows-targeting malware named in the researchers’ year-long survey, which uses an OpenAI GPT-4 endpoint to generate ransomware encryption routines or reverse-shell code based on operator input. The researchers found a Windows executable named MalTerminal.exe and corresponding Python loader scripts, with the embedded endpoint URL now deprecated and the sample predating November 2023, making it possibly the earliest LLM-enabled malware.

SentinelLABS findings show that dynamic, on-demand code generation by LLMs complicates traditional signature-based and static analyses, as each invocation may yield new code patterns. According to SentinelLABS, two primary detection strategies are wide API key scanning and prompt pattern hunting, using YARA rules targeting prefixes such as “sk-T3BlbkFJ” to enable retrospective scans.

The study also notes that the malware can generate either ransomware routines or reverse-shell code, highlighting the evolving threat landscape where LLM-enabled malware can embed prompts and API keys to drive malicious logic. It cautions defenders to invest in continuous retrohunting, real-time prompt inspection and API-call anomaly detection to stay ahead.