Hackers Use Claude AI to Plan Ransomware Attacks, Then Accidentally Expose Their Secrets

Ransomware operators used commercial AI tools to help plan intrusions, manage victim information and prepare extortion, according to a new investigation.

But the systems they relied on also kept detailed records of their work. A publicly accessible server exposed AI chat sessions, stolen credentials, campaign notes and source code, giving researchers a view into the operators’ workflow.

The exposed files linked the activity to affiliates operating with INC Ransomware and The Gentlemen Ransomware. They included 46 INC encryptor builds prepared for six victims and evidence that an encryptor had run on a victim’s computer.

The researchers cautioned that the records showed organizations at different stages: some were only listed for reconnaissance, while others had deeper access or had reached extortion. SOCRadar’s technical report describes the findings in detail.

Analysts from the SOCRadar Threat Research Unit (STRU) identified the exposed infrastructure in late September 2026. The team found one open server containing AI session data, a shared knowledge base and code for a framework called Phantom.

Logs, configuration files and credentials on that server led researchers to six more exposed servers. Together, the systems held records of victim activity, tools, malware and extortion plans.

Hackers Use Claude AI to Plan Ransomware Attacks

The operators used OpenCode as an interface to models hosted through OpenRouter. STRU reviewed 8,257 messages across 133 sessions and found that the AI helped plan reconnaissance, select techniques, generate commands, troubleshoot tools, review stolen data and draft extortion material.

Claude Opus 4.6 and Kimi K3 were among the commercial models named in the report; the findings describe an AI-supported operation, not proof that Claude alone carried out every task.

Human operators remained involved. The AI was told to coordinate actions and wait for approval, making the setup closer to a human-directed assistant than an independent system.

When a model refused a request, an operator sometimes rewrote it as an authorized red-team assessment. The operators also used a “WormGPT” persona prompt, but STRU says this was a prompt label, not evidence that they were using a separate uncensored model.

The system’s memory became a major weakness. Its knowledge base tracked victims, credentials and campaign progress, while the chat logs showed how operators planned and adjusted their work.

Recorded AI spending exceeded $23,920, according to SOCRadar’s account records. The exposure turned those private work notes into evidence that investigators could examine.

Edge systems were a key way in

Operator records describe attempts to gain access through internet-facing management and remote-access products. They report exploitation of FortiClient EMS flaw CVE-2026-35616, SimpleHelp flaw CVE-2024-57727 and cPanel/WHM flaw CVE-2026-41940.

These figures come from the operators’ own records and were not independently verified by STRU. For SimpleHelp, the records claim 242 affected IP addresses; the earlier SimpleHelp vulnerability report explains why flaws in remote support tools can put connected customer networks at risk.

CISA has separately warned that ransomware actors have exploited CVE-2024-57727 in unpatched SimpleHelp systems. The agency urged organizations to update vulnerable instances and check for signs of compromise, including where a service provider’s system connects to customer environments.

Attackers in the SOCRadar investigation also reportedly used stolen or reused credentials to move between systems. In one case, a reused password opened access to multiple services, including remote access, servers and backup tools.

After getting inside, the operators searched networks, gathered credentials and focused on finance, human resources, legal and executive files. The exposed toolkit included Phantom, Ghost command-and-control software and RevSocks, which can tunnel traffic.

Researchers also found a tool designed to interfere with some security products. The report says the operators prepared INC encryptors for Windows and Linux, but the planned October 1, 2026 deployment against those targets was not confirmed. A September 30 screenshot did show an encryptor running in a victim environment.

The records suggest that stealing data and threatening to publish it could matter as much as encrypting files. Operators used victim financial and customer information to shape demands and plan pressure, including scripted calls.

This broader shift toward data theft and threats is also seen in other cases; Cybersecurity News has reported on ransomware extortion without encryption.

SOCRadar linked the exposed systems to activity involving both INC and The Gentlemen, but did not conclude that the two groups had a formal alliance.

The researchers considered a shared operational environment or service provider supporting different ransomware partners a more likely explanation.

Their records named 62 organizations, but only four were publicly listed for extortion; others were at earlier stages, including reconnaissance or initial access.

For defenders, the case highlights the need to patch exposed edge and remote-access systems, restrict management interfaces, use multifactor authentication for remote administration and review accounts and VPN settings for unexpected changes.

Organizations should also protect backups from direct access by compromised accounts and monitor remote-management tools and large outbound transfers.

The incident’s central lesson is straightforward: AI can help criminals coordinate complex work, but poorly secured infrastructure and retained logs can expose the operation behind it.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Use Claude AI to Plan Ransomware Attacks, Then Accidentally Expose Their Secrets appeared first on Cyber Security News.