Threat Actors Use Claude AI to Plan Ransomware, Accidentally Leak Data

Key Takeaways

• Ransomware operators leveraged commercial AI tools, including Claude Opus 4.6 and Kimi K3, to plan and execute attacks.
• A misconfigured server exposed extensive operational data, including AI chat sessions, stolen credentials, victim information, and malware builds.
• The exposed data is linked to affiliates of INC Ransomware and The Gentlemen Ransomware, detailing operations against at least 62 organizations.
• Operators exploited vulnerabilities in internet-facing systems like FortiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727), and cPanel/WHM (CVE-2026-41940).

Ransomware Gangs Exposed After AI-Assisted Operations Leak Data

Ransomware groups have been found utilizing commercial artificial intelligence platforms to orchestrate their attack campaigns, manage victim data, and craft extortion demands. However, this reliance on AI-driven systems inadvertently led to a significant operational security lapse, as detailed records of their activities were publicly exposed.

A publicly accessible server contained a trove of sensitive information, including AI chat logs, compromised credentials, detailed campaign notes, and source code for their tools. This exposure provided cybersecurity researchers with an unprecedented look into the inner workings and methodologies of these threat actors.

The leaked files directly implicated affiliates associated with both INC Ransomware and The Gentlemen Ransomware operations. Among the exposed data were 46 distinct INC encryptor builds, tailored for six specific victims, alongside conclusive evidence that an encryptor had already been deployed on a victim’s network.

Researchers cautioned that the records encompassed organizations at various stages of compromise, from initial reconnaissance targets to those already facing extortion. A comprehensive technical report from SOCRadar provides an in-depth analysis of these findings.

The compromised infrastructure was first identified in late September 2026 by Analysts from the SOCRadar Threat Research Unit (STRU). Their initial discovery centered on an open server hosting AI session data, a shared knowledge base, and the codebase for a framework dubbed “Phantom.”

Further investigation, spurred by logs, configuration files, and credentials found on the initial server, uncovered six additional exposed servers. Collectively, these systems stored a vast amount of data pertaining to victim activities, malicious tools, malware samples, and detailed plans for extortion.

Hackers Leverage Claude AI for Attack Planning

The threat actors employed OpenCode as an interface to interact with various AI models hosted via OpenRouter. STRU’s review of 8,257 messages across 133 sessions revealed that AI played a crucial role in multiple stages of their operations. This included planning reconnaissance efforts, selecting attack techniques, generating command-line instructions, troubleshooting tools, reviewing stolen data, and even drafting extortion communications.

Commercial models such as Claude Opus 4.6 and Kimi K3 were specifically mentioned in the report. It is important to note that the findings indicate an AI-supported operation where human operators maintained oversight, rather than a fully autonomous AI system executing every task independently.

Human involvement remained integral to the operations. The AI was often instructed to coordinate actions and await human approval, positioning it more as a sophisticated assistant under human direction than an autonomous entity. When an AI model declined a request, operators sometimes rephrased it as an authorized “red-team assessment” to bypass content filters. While operators also used a “WormGPT” persona prompt, STRU clarified this was merely a label for a prompt, not an indication of a separate, uncensored AI model being utilized.

Ironically, the system’s extensive memory became its critical vulnerability. The internal knowledge base meticulously tracked victims, credentials, and campaign progress, while the chat logs provided a chronological record of the operators’ planning and adjustments. According to SOCRadar’s account records, the recorded AI spending surpassed $23,920. This significant operational expenditure ultimately transformed into incriminating evidence for investigators.

Edge Systems: A Primary Entry Vector

The operators’ internal records detailed their attempts to gain unauthorized access through internet-facing management and remote-access solutions. These logs explicitly mentioned the exploitation of vulnerabilities in FortiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727), and cPanel/WHM (CVE-2026-41940).

These vulnerability exploitation claims originate directly from the threat actors’ own records and have not been independently verified by STRU. In the case of SimpleHelp, the records claimed 242 affected IP addresses, underscoring how flaws in remote support tools can jeopardize connected customer networks. CISA has previously issued warnings regarding ransomware actors exploiting CVE-2024-57727 in unpatched SimpleHelp systems, urging organizations to apply updates and investigate for signs of compromise, especially where service providers’ systems interact with customer environments.

The SOCRadar investigation also revealed that attackers frequently leveraged stolen or recycled credentials to move laterally across systems. One instance highlighted a single reused password granting access to multiple critical services, including remote access, servers, and backup tools.

Once inside a network, the operators conducted extensive reconnaissance, harvested additional credentials, and specifically targeted financial, human resources, legal, and executive documents. Their exposed toolkit included the Phantom framework, Ghost command-and-control software, and RevSocks, a tool capable of tunneling traffic. Researchers also discovered a tool designed to disrupt specific security products. The report indicated that INC encryptors were prepared for both Windows and Linux environments, with a planned deployment date of October 1, 2026, though this was not confirmed. However, a screenshot from September 30 did show an encryptor actively running within a victim’s environment.

The records also suggested that data exfiltration and the threat of publication were as significant as file encryption. Operators used stolen financial and customer data to tailor ransom demands and plan pressure tactics, including scripted phone calls. This emphasis on data theft and extortion without encryption aligns with a broader trend observed in other ransomware incidents.

SOCRadar connected the exposed systems to activities involving both INC and The Gentlemen ransomware groups, but did not conclude that a formal alliance existed between them. A more probable explanation, according to researchers, was a shared operational environment or a common service provider supporting different ransomware affiliates. While their records named 62 organizations, only four were publicly listed for extortion, with others still in earlier stages such as reconnaissance or initial access.

What You Should Do

• Patch and Update: Immediately apply patches for known vulnerabilities, especially those affecting internet-facing edge devices and remote-access systems (e.g., FortiClient EMS, SimpleHelp, cPanel/WHM).
• Restrict Access: Limit direct exposure of management interfaces to the internet. Implement strict network segmentation.
• Implement MFA: Enforce multi-factor authentication (MFA) for all remote administration tools, VPNs, and critical accounts.
• Audit Accounts: Regularly review user accounts and VPN settings for any unexpected changes or suspicious activity.
• Secure Backups: Ensure backups are isolated and protected from direct access by potentially compromised accounts. Implement immutable backups where possible.
• Monitor Network Traffic: Continuously monitor remote management tools and significant outbound data transfers for anomalous behavior.
• Employee Training: Educate employees on phishing, social engineering tactics, and the importance of strong, unique passwords.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.