Malware is now using LLMs to sort victims by financial value before attacking

Attackers have always sought to maximize efficiency. What's changed is that large language models now make it economically rational for threat actors to use AI to triage, profile, and prioritize targets before committing resources to an attack. Understanding this pattern requires looking at how automated targeting has evolved, why LLMs became relevant to the process, and what the asymmetry means for security defenders. History of automated victim selection Cybercriminals have long used automation to scan networks, identify vulnerable systems, and flag targets worth pursuing. Early malware relied on simple rules: port scanning for open services, checking for unpatched software versions, or testing default credentials. As networks scaled, manual targeting became impossible. Attackers needed algorithms to do the work at scale. This created a separation of concerns. Reconnaissance tools found potential victims. Then a human attacker (or a second layer of automation) would decide which were worth exploiting. For decades, that second step remained crude. It often relied on known databases of corporate networks, DNS records that indicated company size, or basic heuristics like "any Fortune 500 company is worth attacking." What LLMs bring to targeting Large language models are pattern-matching engines trained on vast text data. They excel at extracting meaning from unstructured information and ranking it by relevance to a query. In the context of victim selection, this is useful. An LLM can ingest public data about a company, employee rosters, financial reports, regulatory filings, job postings, press releases, and security disclosures. It can then synthesize that information to estimate financial value, operational criticality, or likelihood of paying a ransom. The model doesn't need to "understand" in a human sense. It simply learns statistical associations. Companies that mention specific technologies in their systems, list particular subsidiaries, or operate in regulated industries correlate with higher-value targets in the training data. An LLM can surface those patterns faster than a human analyst. Why this matters for attackers The traditional cost of targeting is time and human labor. A skilled threat actor who spends weeks researching a single target can be quite selective. But most cybercriminals operate at volume, relying on spray-and-pray techniques or buying victim lists from brokers. In that world, waste is expected. You send malware to many potential targets knowing most will fail. LLMs lower the cost of intelligent triage. Rather than paying humans to research targets or buying expensive third-party intelligence, an attacker can use an LLM to do rapid, large-scale profiling. This shifts the economics. It becomes cheaper to be selective. An attacker can now filter a list of ten thousand potential victims down to the hundred most likely to yield high returns before deploying the actual malware. The asymmetry pr