In the recent tech world, a surprising yet alarming find emerged from the Visual Studio Marketplace—a ransomware extension utilizing generative AI. Identified as susvsex, the extension, published by an entity known as suspublisher18, was brought to light by Secure Annex founder John Tuckner in a recent blog post.

Let’s break it down. Susvsex was upfront about its malicious capabilities right in its description. It’s loaded with oversized, verbose comments along with coding that’s somewhat sloppy, traits often seen in AI-generated content. When installed, this extension jumps into action by encrypting files within a specific directory and then archives them into a ZIP file meant for an attacker’s server. However, it’s more a test run than a fully-fledged ransomware tool, as it targets non-sensitive directories.

Curiously, inside this code lie a decryption key and two decryptors suspected to have been created by AI. Even more intriguing, this extension communicates with a private GitHub repository to fetch updates and execute commands, sending results back via a requirements.txt file. With a pre-set GitHub Personal Access Token (PAT), Tuckner managed to execute inputs on the index.html file and gain access to the developer’s GitHub log, hinting at a user based in Baku, Azerbaijan.

Though not a major threat now, susvsex’s presence on the marketplace raises eyebrows about oversight and highlights the clever, if unsettling, ways cybercriminals are using AI in malware like “ransomvibing.” Thankfully, as of Friday, this extension has been removed from the marketplace.

For a deeper dive into preventing such threats, don’t miss out on our detailed guide on cybersecurity for organizations.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.