Inside FunkSec: Kaspersky explores the evolution of AI-powered ransomware with password-gated capabilities

Kaspersky experts revealed the inner workings of FunkSec — a ransomware group that illustrates the future of mass cybercrime: AI-powered, multifunctional, highly adaptive and operating on volume with ransoms as low as $10,000 to maximize profits.
Kaspersky’s Global Research and Analysis Team (GReAT) constantly monitors the ransomware threat landscape, where attacks continue to rise. According to the company’s latest State of Ransomware report, the share of users affected by ransomware attacks worldwide increased to 0.44% from 2023 to 2024, up by 0.02 percentage points. While this percentage may appear modest compared to other cyber threats, it reflects the fact that attackers typically prioritize high-value targets rather than mass distribution, making each incident potentially devastating. Within this evolving landscape, FunkSec has emerged as a particularly concerning threat.
Active for less than a year since its emergence in late 2024, FunkSec has quickly surpassed many established actors by targeting government, technology, finance and education sectors. What sets FunkSec apart is its sophisticated technical architecture and AI-assisted development. The group packages full-scale encryption and aggressive data exfiltration into a single Rust-based executable, capable of disabling over 50 processes on victim machines and equipped with self-cleanup features to evade defenses. Beyond its core ransomware functionality, FunkSec has expanded its toolkit to include a password generator and a basic DDoS tool — both showing clear signs of code synthesis using large language models (LLMs).
FunkSec’s approach reflects the evolving landscape of mass cybercrime, combining advanced tools and tactics. Kaspersky’s GReAT experts highlight the key features that define their operations:
Password-Controlled Functionality
GReAT experts discovered that FunkSec ransomware features a unique password-based mechanism that controls its operation modes. Without a password, the malware performs basic file encryption, while providing a password activates a more aggressive data exfiltration process in addition to encryption to steal sensitive data.
FunkSec packs full-scale encryption, local exfiltration and self-cleanup into a single Rust binary—without a side-loader or a companion script. That level of consolidation is uncommon and gives affiliates a plug-and-play tool they can deploy almost anywhere.
Use of AI in development
Code analysis shows that FunkSec is actively using generative artificial intelligence to create its tools. Many parts of the code seem to be automatically generated rather than manually written. Signs of this generic placeholder comments (such as “placeholder for actual check”) and technical inconsistencies, like commands for different operating systems that don’t align properly. Additionally, the presence of declared but unused functions—such as modules included upfront but never utilized — reflects how large language models combine multiple code snippets without pruning redundant elements.
“More and more, we see cybercriminals leveraging AI to develop malicious tools. Generative AI lowers barriers and accelerates malware creation, enabling cybercriminals to adapt their tactics faster. By reducing the entry threshold, AI allows even less experienced attackers to quickly develop sophisticated malware at scale,” comments Marc Rivero, Lead Security Researcher at Kaspersky’s GReAT.
High-volume, low-ransom strategy
FunkSec demands unusually low ransom payments, sometimes as little as $10,000, and pairs this with the sale of stolen data at discounted prices to third parties. This strategy appears designed to enable a high volume of attacks, helping the group quickly establish its reputation within the cybercriminal underground. Unlike traditional ransomware groups that seek million-dollar ransoms, FunkSec employs a high-frequency, low-cost model — further underscoring its use of AI to streamline and scale operations.
Expands beyond ransomware
FunkSec has expanded its capabilities beyond the ransomware binary. Its dark leak site (DLS) hosts additional tools, including a Python-based password generator designed to support brute-force and password-spraying attacks, as well as a basic DDoS tool.
Advanced evasion
FunkSec employs advanced evasion techniques to avoid detection and complicate forensic analysis. The ransomware is capable of stopping over 50 processes and services to ensure thorough encryption of targeted files. Additionally, it includes a fallback mechanism to execute certain commands even if the user launching FunkSec lacks sufficient privileges.
Kaspersky’s products detect this threat as HEUR:Trojan-Ransom.Win64.Generic.
To stay protected from ransomware attacks, Kaspersky experts recommend organizations follow these best practices to safeguard from ransomware:
• Enable ransomware protection for all endpoints. There is a free Kaspersky Anti-Ransomware Tool for Business that shields computers and servers from ransomware and other types of malware, prevents exploits and is compatible with already installed security solutions.
• Always keep software updated on all the devices you use to prevent attackers from exploiting vulnerabilities and infiltrating your network.
• Focus your defense strategy on detecting lateral movements and data exfiltration to the internet. Pay special attention to outgoing traffic to detect cybercriminals’ connections to your network. Set up offline backups that intruders cannot tamper with. Make sure you can access them quickly when needed or in an emergency.
• Install anti-APT and EDR solutions, enabling capabilities for advanced threat discovery and detection, investigation and timely remediation of incidents. Provide your SOC team with access to the latest threat intelligence and regularly upskill them with professional training. All of the above is available within Kaspersky Expert Security framework.
• Use the latest Threat Intelligence information to stay aware of the actual Tactics, Techniques, and Procedures (TTPs) used by threat actors.
• To protect the company against a wide range of threats, use solutions from Kaspersky Next product line that provide real-time protection, threat visibility, investigation and response capabilities of EDR and XDR for organizations of any size and industry. Depending on your current needs and available resources, you can choose the most relevant product tier and easily migrate to another one if your cybersecurity requirements are changing.

:

Related Posts

The domain of deception: Attackers deploy spyware under the guise of legal threats

Thndr Recognized by World Economic Forum as 2025Technology Pioneer The only Egyptian and North African company among the 2025

British Council’s Deep Dialogues Brings Together Delegates from Egypt, Tunisia and Saudi Arabia in Cardiff

Commvault Convenes Egypt’s Cybersecurity Leaders at SHIFT Cairo

Dubai Launches Landmark Initiative Further Enabling First-Time Homeownership

Noise-Free Conversations and Lush Soundscapes: Meet the HUAWEI FreeBuds 6

Raya Electronics Expands Strategic Partnership with Lenovo and Microsoft

Chestertons Unites Global Network in London to Reinforce Cross-Border Real Estate Momentum

آخر الأخبار
الطقس غدا.. شديد الحرارة وشبورة ورطوبة مرتفعة وزير الإسكان: ما فيش طرد لأى مواطن مصرى من قاطنى وحدات الإيجار القديم كاسبرسكي تحذر من تطور برمجيات الفدية المدعومة بالذكاء الاصطناعي Inside FunkSec: Kaspersky explores the evolution of AI-powered ransomware with password-gated capabi... الكرملين: ترامب وبوتين أجريا نقاشا مفصلا عن إيران والشرق الأوسط مصر ترفض رفض قاطع لاستمرار سياسة إثيوبيا في فرض الأمر الواقع من خلال إجراءات أحادية تتعلق بنهر النيل وزير السياحة يبحث مع أحد الشركات الصينية الرائدة في مجال البواخر السياحية سبل تطوير منتج السياحة الن... 5 وزراء ومحافظ مطروح يفتتحون فرع سلسة "جملة ماركت" بالمدينة التراثية بالعلمين الجديدة اتصال هاتفي بين وزير الخارجية والهجرة ونظيره السورى قرار جمهورى بتعيين أحمد سعد الشاذلي مستشاراً لرئيس الجمهورية للشئون المالية البترول تؤكد التزام شركة أديس المالكة للبارج بسرعة صرف التعويضات لأسر المتوفين والمفقودين والمصابين رئيس الوزراء يتابع مع وزير البترول مستجدات تقدم الأعمال الخاصة بتجهيز وربط وحدات التغييز المشاط: تطوير 34 جهاز مدينة في إطار مشروع تطوير وميكنة خدمات المواطنين بأجهزة المدن العمرانية الجديد... وزير الزراعة يتفقد أعمال حصر وتصنيف الأراضي الصحراوية بمنطقة "العميد" على محور وادي النطرون ـ العلمي... مصر تجدد دعمها لاستقرار الصومال خلال مشاركتها في الاجتماع الوزاري الافتراضي لمجلس السلم والأمن التاب... أسوان تنضم رسميًا إلى منظومة التأمين الصحي الشامل.. خطوة جديدة نحو تغطية صحية شاملة لكل المصريين نائب وزير الصحة يتفقد مستشفى حلوان العام ومركز أطلس.. ويوصي بإجراءات عاجلة لتقليل زمن انتظار المواطن... وزيرا الإسكان والزراعة يتفقدان محطة التجارب البحثية لتحلية مياه البحر حذر في أسواق الذهب وترقب بيانات الوظائف الأمريكية «الغرف العربية»: العالم يواجه فجوة تمويلية تقدر بنحو 4.2 تريليون دولار لتحقيق أهداف التنمية المستدام...