General News
Firm Explores the Evolution of AI-powered Ransomware with Password-gated Capabilities
Kaspersky experts have revealed the inner workings of FunkSec — a ransomware group that illustrates the future of mass cybercrime: AI-powered, multifunctional, highly adaptive and operating on volume with ransoms as low as $10,000 to maximise profits.
Kaspersky’s Global Research and Analysis Team (GReAT) constantly monitors the ransomware threat landscape, where attacks continue to rise. According to the company’s latest State of Ransomware report, the share of users affected by ransomware attacks worldwide increased to 0.44% from 2023 to 2024, up by 0.02 percentage points.
While this percentage may appear modest compared to other cyber threats, it reflects the fact that attackers typically prioritise high-value targets rather than mass distribution, making each incident potentially devastating. Within this evolving landscape, FunkSec has emerged as a particularly concerning threat.
Active for less than a year since its emergence in late 2024, FunkSec has quickly surpassed many established actors by targeting government, technology, finance and education sectors. What sets FunkSec apart is its sophisticated technical architecture and AI-assisted development.
The group packages full-scale encryption and aggressive data exfiltration into a single Rust-based executable, capable of disabling over 50 processes on victim machines and equipped with self-cleanup features to evade defenses.
Beyond its core ransomware functionality, FunkSec has expanded its toolkit to include a password generator and a basic DDoS tool — both showing clear signs of code synthesis using large language models (LLMs).
FunkSec’s approach reflects the evolving landscape of mass cybercrime, combining advanced tools and tactics. Kaspersky’s GReAT experts highlight the key features that define their operations:
Password-Controlled functionality
GReAT experts discovered that FunkSec ransomware features a unique password-based mechanism that controls its operation modes. Without a password, the malware performs basic file encryption, while providing a password activates a more aggressive data exfiltration process in addition to encryption to steal sensitive data.
FunkSec packs full-scale encryption, local exfiltration and self-cleanup into a single Rust binary—without a side-loader or a companion script. That level of consolidation is uncommon and gives affiliates a plug-and-play tool they can deploy almost anywhere.
Use of AI in development
Code analysis shows that FunkSec is actively using generative artificial intelligence to create its tools. Many parts of the code seem to be automatically generated rather than manually written. Signs of this generic placeholder comments (such as “placeholder for actual check”) and technical inconsistencies, like commands for different operating systems that don’t align properly. Additionally, the presence of declared but unused functions—such as modules included upfront but never utilised — reflects how large language models combine multiple code snippets without pruning redundant elements.
“More and more, we see cybercriminals leveraging AI to develop malicious tools. Generative AI lowers barriers and accelerates malware creation, enabling cybercriminals to adapt their tactics faster.
By reducing the entry threshold, AI allows even less experienced attackers to quickly develop sophisticated malware at scale,” comments Marc Rivero, Lead Security Researcher at Kaspersky’s GReAT.
High-volume, low-ransom strategy
FunkSec demands unusually low ransom payments, sometimes as little as $10,000, and pairs this with the sale of stolen data at discounted prices to third parties. This strategy appears designed to enable a high volume of attacks, helping the group quickly establish its reputation within the cybercriminal underground. Unlike traditional ransomware groups that seek million-dollar ransoms, FunkSec employs a high-frequency, low-cost model — further underscoring its use of AI to streamline and scale operations.
Expands beyond ransomware
FunkSec has expanded its capabilities beyond the ransomware binary. Its dark leak site (DLS) hosts additional tools, including a Python-based password generator designed to support brute-force and password-spraying attacks, as well as a basic DDoS tool.
Advanced evasion
FunkSec employs advanced evasion techniques to avoid detection and complicate forensic analysis. The ransomware is capable of stopping over 50 processes and services to ensure thorough encryption of targeted files. Additionally, it includes a fallback mechanism to execute certain commands even if the user launching FunkSec lacks sufficient privileges.
National Identity Management Commission (NIMC), has explained why kidnappers and terrorists are not always traceable despite the country’s expanding digital identity infrastructure.
NIMC explanation pointed to a simple but significant gap in the system.
Abisoye Coker-Odusote, director-general of the agency said that: “A lot of the time, you find out the kidnappers use the phones of the people they have abducted, which means how do you trace them because they are not using their own phones?” she said.
Coker-Odusote spoke during an appearance on Channels Television, where she was asked to explain why criminals remain difficult to trace despite the mandatory NIN-SIM linkage policy.
She said criminals frequently frustrate investigations by using mobile phones belonging to their victims, instead of their own registered lines.
“We already know the NIN is the foundational identity for the security architecture, but a lot of the time, you find out the kidnappers use the phones of the people they have abducted. Which means, how do you trace them because they are not using their own phones?” she said.
She also suggested that some criminal elements involved in kidnapping operations may not even be captured in Nigeria’s identity database.
“There is a theory that it may be possible that these kidnappers are not Nigerians and are brought into the country 48 or 72 hours before a kidnapping takes place specifically for that purpose. I’m not insinuating anything, but if that were the case, they naturally would not be captured in our database,” she added.
The comments have revived questions about whether expectations placed on the NIN-SIM linkage have exceeded what the system was designed to deliver.
The NIN-SIM linkage exercise was introduced by the Nigerian Communications Commission (NCC) in collaboration with NIMC to strengthen identity management, eliminate anonymous SIM ownership and support national security.
Over the years, the exercise resulted in millions of subscribers linking their SIM cards with their National Identification Numbers, while telecom operators also deactivated millions of lines that failed to comply with regulatory directives.
Earlier, the NCC maintained that the policy was aimed at improving the integrity of Nigeria’s SIM registration database, strengthening identity verification and supporting security agencies in criminal investigations.
The regulator also described the exercise as an important component of the country’s digital economy and national security framework.
Telecommunications operators have consistently maintained that while they play a critical role in implementing the NIN-SIM linkage policy, they are not responsible for tracking criminals.
Quest Merchant Bank recently hosted the second edition of the Great Place to Work® Nigeria Study Mission, reaffirming its commitment to fostering a high-performance workplace culture and advancing people-centric leadership practices.
The Study Mission serves as a collaborative learning platform that brings together Great Place to Work® Certified organizations to exchange insights, share best practices, and strengthen workplace cultures.
The event welcomed Human Resources leaders and representatives from FITC, Princeps Credit Systems, Tonic Technologies and Esentry Limited for an engaging and insightful session focused on building thriving workplace cultures, promoting continuous learning, and advancing employee-centric practices that drive organizational success.
Speaking at the event, Tolulope Dayo-Peters, Head of People Management, emphasized the importance of continuous learning and collaboration in building sustainable workplace cultures.
“We are delighted to host the second edition of the Great Place to Work® Nigeria Study Mission. At Quest Merchant Bank, we believe building a great workplace is an ongoing journey rooted in trust, purposeful leadership, and a genuine commitment to our people.
“We are pleased to share the practices that have shaped our culture and look forward to more opportunities to learn and collaborate with like-minded organizations.”
Also speaking at the event, Afolabi Olorode, Acting Managing Director/CEO, Quest Merchant Bank Limited, highlighted the critical role workplace culture plays in driving long-term business success.
“We recognize that a strong workplace culture is fundamental to sustainable business success. Creating an environment where our people are empowered to grow, innovate, and perform at their best enables us to consistently deliver value to our clients and stakeholders. We are proud to support initiatives like the Great Place to Work® Nigeria Study Mission that encourage organizations to learn from one another and collectively raise the standard of workplace excellence in Nigeria.”
The Study Mission reinforced the importance of collaboration among organizations committed to creating exceptional employee experiences.
By providing a platform for open dialogue, peer learning, and the exchange of practical ideas, the initiative enabled participants to explore innovative approaches to employee engagement, organizational culture, leadership development, and talent management while strengthening a growing community of employers dedicated to workplace excellence.
Hosting the Great Place to Work® Nigeria Study Mission further strengthens Quest Merchant Bank’s position as a thought leader in workplace culture and talent management.
It also enhances the Bank’s employer brand and demonstrates its unwavering commitment to creating an environment where employees can grow, innovate, and achieve their full potential.
Quest Merchant Bank remains committed to championing initiatives that promote learning, innovation, and people-centric leadership. Through strategic partnerships and knowledge-sharing platforms such as the Great Place to Work® Nigeria Study Mission, the Bank continues to contribute to the advancement of exceptional workplace cultures and the future of work across Nigeria’s corporate landscape.
Nigeria Hydrological Service Agency (NIHSA) has warned of possible floods in parts of Adamawa, Bauchi, Edo, Imo, Enugu, Akwa Ibom, Cross River, Kaduna, Plateau, Niger, Benue, and Borno states within the next seven days.
According to information posted on NIHSA X handle, the Agency announced medium flood advisory in force for the next 7 days across Adamawa, Bauchi, and 11 other States.
“Localised inundation is forecast along the main channel; named communities below sit on the projected footprint. Stations: Saminara on the Karam river, Waya Dam Site on the Waya river, Amber on the Amber river.
“Adamawa; Lemsa, Lamurde, Numan Exposure: 147 comm. 49 schis 40 hith 6 mkts17 relig. Bauchi-Bauchi, Ningi, Shira. Exposure: 4 comm. Kaduna; Chikun, Giwa, Igabi, Jaba, Jema’a, Kachia, Kaura, Kauru, +6 more. Exposure: 1 comm.
“Borno-Gubio, Mobbar. Exposure: 680 comm. 8 schls 6 hith 5 mkts 21 relig. Edo-Akoko-Ed, EtsakoEa, EtsakoWe, Ikpoba-Okha, Orhionmw, OviaNort, OviaSo.. Exposure: 3 comm.
“Imo-Aboh-Mba, Oguta, Ohaji/Eg, Okigwe, Owerri North, Owerri West. Exposure: 3 comm. 7 more states affected and severity LGAs”.
NIHSA advised people in the affected areas to “do NOT cross flooded roads, bridges, or fast-moving water on foot or by vehicle.
“Clear drainage channels and river-mouth blockages; avoid building or living in the floodplain and move people, livestock and valuables from the floodplain to pre-identified higher ground,” NIHSA stated.
NBC Scraps Annual Digital Access Fee on DSO
Surge in Fibre Cuts Hobbles Service Provisioning
Why Bandits, Kidnappers are Hard to Trace despite NIN-SIM Linkage – FG
First Securities Brokers Empowers Nigerians to Trade in the Stock Market with the Launch of FirstInvest App
Quest Merchant Bank Hosts Great Place to Work® Nigeria Study Mission
NRC, Ponzi Scheme Collapses Resulting Loss of Billions of Naira
Nigeria Launches FreeTV Nationwide
NASENI Moves to Digitize CCB’s 5m Assets Declaration and Operations
Lebara Nigeria Launches Lebara Play, Africa’s First Telecom-Owned Micro-Drama Platform
CANAL+ Partners Samsung to Pre-Load DStv Stream on New Samsung TVs In Nigeria, Other African Countries
Telecom2 days agoMTN Nigeria Slashes Cost of Broadband Internet Router, Unwraps New Data Bundles for Low-Budget Users
E-Financial2 days agoNigerians Accumulate $59Bn in Cryptocurrency Assets —FDC
General News2 days agoNearpays, Nigerian Fintech Becomes First African Startup to Win UN’s AI for Good Innovation Factory
E-Financial2 days agoFlutterwave Partners Xoom on Transfers into Nigeria
News2 days agoDataPro Upgrades Dangote Cement’s Credit Rating to AA+
Telecom2 days agoNokia’s 14 Years of Mobile-Phone Supremacy Ended in an Afternoon
General News2 days agoLASG Signs PPP Concession Agreements to Advance Digital Services, Others
General News2 days agoFintech Brands Should Communicate Right in a VUCA Economy