ANY.RUN Exposes FunkLocker: AI-Generated Ransomware Threatens Global Organizations

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, has released new research on FunkLocker, a ransomware strain developed by the FunkSec group with the aid of artificial intelligence. The findings highlight how AI-assisted coding is shaping the evolution of ransomware while also leaving behind exploitable weaknesses.

𝐀𝐈’𝐬 𝐑𝐨𝐥𝐞 𝐢𝐧 𝐅𝐮𝐧𝐤𝐋𝐨𝐜𝐤𝐞𝐫
FunkLocker exhibits development patterns consistent with AI-generated code snippets combined into a single build, producing rapid variants that range from barely functional to more feature-rich versions containing anti-virtualization checks.

Also Read: CIO Influence Interview with Dilip Bachwani, Chief Technology Officer, Qualys

𝐓𝐞𝐜𝐡𝐧𝐢𝐜𝐚𝐥 𝐇𝐢𝐠𝐡𝐥𝐢𝐠𝐡𝐭𝐬 𝐨𝐟 𝐅𝐮𝐧𝐤𝐋𝐨𝐜𝐤𝐞𝐫
The analysis identifies the following core behaviors that define FunkLocker’s operations:

● 𝐀𝐈-𝐚𝐬𝐬𝐢𝐬𝐭𝐞𝐝 𝐝𝐞𝐯𝐞𝐥𝐨𝐩𝐦𝐞𝐧𝐭: FunkLocker samples contain code patterns consistent with copy-pasted AI snippets, leading to rapid but inconsistent builds.
● 𝐒𝐲𝐬𝐭𝐞𝐦 𝐚𝐛𝐮𝐬𝐞: Legitimate Windows utilities (PowerShell, sc.exe, taskkill.exe, net.exe) are misused to disable defenses and halt applications.
● 𝐋𝐨𝐜𝐚𝐥-𝐨𝐧𝐥𝐲 𝐞𝐧𝐜𝐫𝐲𝐩𝐭𝐢𝐨𝐧: Files are encrypted locally with the .funksec extension, and ransom notes may remain hidden until reboot.
● 𝐖𝐞𝐚𝐤 𝐨𝐩𝐞𝐫𝐚𝐭𝐢𝐨𝐧𝐚𝐥 𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲: Reused Bitcoin wallets and locally derived or hardcoded keys enabled researchers to build a public decryptor.

For full technical details, including mapped MITRE ATT&CK tactics and related IOCs, read the complete FunkLocker analysis and explore its interactive sandbox session on the ANY.RUN blog.

𝐇𝐨𝐰 𝐀𝐍𝐘.𝐑𝐔𝐍 𝐇𝐞𝐥𝐩𝐬 𝐒𝐎𝐂 𝐓𝐞𝐚𝐦𝐬 𝐃𝐞𝐭𝐞𝐜𝐭 𝐅𝐮𝐧𝐤𝐋𝐨𝐜𝐤𝐞𝐫
SOC analysts can use ANY.RUN’s Interactive Sandbox to safely detonate FunkLocker samples and observe malicious behavior in real time. Within seconds, the service reveals the complete execution chain, mapped MITRE ATT&CK techniques, and related IOCs. This rapid visibility enables teams to:

● Detect ransomware activity before encryption completes
● Gather actionable intelligence for faster triage and containment
● Validate recovery plans by testing FunkLocker’s impact in a controlled environment