FunkLocker
FunkLocker is a ransomware strain associated with the FunkSec ransomware group. Reporting describes it as a new strain that resurfaced with the group and exhibits signs of being developed with artificial intelligence or generative AI; it is cited alongside SparkCat as an early example of AI-built or AI-enabled malware. Available content indicates ransomware behavior, including creation of files with the .funksec extension, which is used in detection logic to identify FunkLocker activity. The provided material does not specify initial infection vector, targeted industries, operating systems, or additional technical indicators beyond the .funksec file extension and its association with the FunkSec group.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"FunkLocker: ANY.RUN looks at FunkLocker, an attempt by the FunkSec ransomware group to use AI to developer a new ransomware strain."
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware strain developed by FunkSec, with some versions showing AI-generated code and advanced features such as anti-VM checks and process termination.
Ransomware strain referenced as being developed/used by the FunkSec ransomware group.
FunkLocker is a ransomware family that creates files with the .funksec extension as part of its encryption process.
Cited as an early example of AI-based malware demonstrating the practical threat posed by AI-assisted malicious code.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.