aiqbench analysis
This investigation highlights how ransomware groups are increasingly leveraging commercial LLMs like Claude Opus 4.6 to automate complex stages of cyberattacks, from reconnaissance to drafting extortion materials. While the AI acted as a human-directed assistant rather than an autonomous actor, the operators' reliance on public servers inadvertently exposed their entire workflow, including stolen credentials and malware source code. The incident underscores the dual-use risk of generative AI in criminal ecosystems and the critical need for secure deployment practices even among malicious actors.
Hackers Use Claude AI to Plan Ransomware Attacks, Then Accidentally Expose Their Secrets
Ransomware operators used commercial AI tools to help plan intrusions, manage victim information and prepare extortion, according to a new investigation. But the systems they relied on also kept detailed records of their work. A publicly accessible server exposed AI chat sessions, stolen credentials, campaign notes and source code, giving researchers a view into the […] The post Hackers Use Claude AI to Plan Ransomware Attacks, Then Accidentally Expose Their Secrets appeared first on Cyber Security News.
Ransomware operators used commercial AI tools to help plan intrusions, manage victim information and prepare extortion, according to a new investigation. But the systems they relied on also kept detailed records of their work. A publicly accessible server exposed AI chat sessions, stolen credentials, campaign notes and source code, giving researchers a view into the operators’ workflow. The exposed files linked the activity to affiliates operating with INC Ransomware and The Gentlemen Ransomware. They included 46 INC encryptor builds prepared for six victims and evidence that an encryptor had run on…
Excerpt shown under the publisher's RSS terms · 91 words · full text and figures are on the publisher's site
Related coverage
How to prepare for a cyber insurance assessment: What underwriters check and how to qualify
Proton Blog · Oct 16, 2026
A Two-Minute Microsoft Teams Call Could End With Your Network Encrypted With Ransomware
Cybersecurity News · Jul 30, 2026
Ransomware Hackers Pose as Recovery Firm and Demand Up to $60,000
Cybersecurity News · Aug 19, 2026
AI Agents Now Run Ransomware Attacks End-to-End Without Human Operators
Cybersecurity News · Sep 18, 2026