Hackers Use Claude AI to Plan Ransomware Attacks, Then Accidentally Expose Their Secrets

Cybercriminals reportedly used commercial artificial intelligence (AI) tools to plan intrusions, manage victim information, analyze stolen data, and prepare ransomware extortion campaigns. However, a major operational security failure exposed their AI conversations, credentials, internal campaign records, and malware-related source code.

According to the SOCRadar Threat Research Unit (STRU), exposed infrastructure was linked to affiliates operating with INC Ransomware and The Gentlemen ransomware groups. The investigation revealed how attackers incorporated AI into their workflows—and how poorly secured servers left a detailed record of their activities.

The findings included 8,257 AI messages across 133 sessions, seven exposed servers, and 46 INC ransomware encryptor builds reportedly prepared for six victims. Researchers also identified records naming 62 organizations at different stages of targeting or compromise.

Importantly, the records do not establish that every named organization suffered a completed ransomware attack. SOCRadar also cautioned that several claims in the operators’ own records could not be independently verified.

Source: SOCRadar Threat Research Unit investigation

Hackers Use Claude AI to Plan Ransomware Attacks

The investigation found that operators used OpenCode as an AI workbench connected to commercial models through OpenRouter. The models named in the report included Claude Opus 4.6 and Kimi K3.

The AI-assisted workflow supported reconnaissance planning, command generation, technical troubleshooting, analysis of collected information, and preparation of extortion communications.

However, the investigation does not demonstrate that Claude independently conducted the attacks. Human operators remained involved in directing activities and approving actions. The evidence points to a human-directed operation supported by AI rather than a fully autonomous ransomware campaign.

Researchers also discovered a “WormGPT” persona prompt. According to SOCRadar, this was a prompting label and not proof that the operators were using a separate uncensored AI model.

Figure : SOCRadar’s diagram illustrating the AI-assisted workflow, including the operator, OpenCode, AI services, knowledge base, and tool integrations.

Exposed AI Conversations Revealed the Operators’ Workflow

SOCRadar reported discovering an exposed server containing AI session data, a shared knowledge base, configuration files, credentials, and source code associated with a framework called Phantom.

The initial discovery led researchers to six additional servers after they examined configuration files, logs, and credentials. In total, the investigation identified seven exposed systems.

The knowledge base tracked victim information, credentials, and campaign progress. Although this information helped operators organize their activities, its exposure gave researchers insight into their methods and operational structure.

SOCRadar also reported that recorded AI spending exceeded $23,920, demonstrating the extent to which commercial AI services had been incorporated into the operation.

INC Ransomware Builds Were Prepared for Multiple Victims

One of the investigation’s most significant findings was the discovery of 46 INC ransomware encryptor builds reportedly prepared for six victims. The builds covered Windows and Linux environments.

The exposed records also included evidence of an encryptor running in a victim environment. However, the researchers did not confirm whether the planned October 1, 2026 deployment against the identified targets was completed.

The investigation linked the infrastructure to affiliates operating with both INC Ransomware and The Gentlemen. Nevertheless, SOCRadar did not establish that the two groups had a formal alliance. The evidence was more consistent with the possibility of shared operational infrastructure or a service provider supporting multiple ransomware partners.

How the Exposed Infrastructure Connected Operators and Victims

The first image supplied with this article illustrates the infrastructure described in the investigation. It connects operator access and exposed servers with tools, victim environments, data theft, and extortion activity.

Figure  : SOCRadar’s overview of exposed infrastructure associated with INC and The Gentlemen ransomware operations.

The records named 62 organizations, but their reported status varied. Some appeared in reconnaissance records, while others were associated with deeper network access, encryption-related activity, or extortion. These categories should not be treated as proof that every organization was successfully attacked.

Vulnerabilities in Remote-Access Systems Were a Key Concern

According to the operators’ records reviewed by SOCRadar, the activity involved internet-facing management and remote-access systems, including FortiClient EMS, SimpleHelp, and cPanel/WHM.

The report associated the activity with the following vulnerabilities:

• CVE-2026-35616: A vulnerability affecting FortiClient EMS.
• CVE-2024-57727: A path-traversal vulnerability affecting vulnerable SimpleHelp versions.
• CVE-2026-41940: An authentication vulnerability affecting cPanel and WHM.

The exploitation figures came from the operators’ own records and were not independently verified by SOCRadar in every instance.

The SimpleHelp vulnerability is especially relevant to managed service providers. CISA has warned that ransomware actors exploited CVE-2024-57727 in unpatched SimpleHelp systems, potentially exposing connected customer environments.

Organizations should review the CISA advisory on SimpleHelp exploitation and follow the applicable vendor guidance.

The incident highlights why internet-facing management systems require timely patching, restricted administrative access, and continuous monitoring. A compromised service-provider account can create risks that extend beyond a single network.

Data Theft and Extortion Remained Central to the Campaign

The exposed records described activity involving sensitive business information, including finance, human resources, legal, and executive files.

The operators reportedly used victim information to prepare extortion communications and plan pressure tactics. This illustrates how ransomware incidents can involve both system disruption and threats to disclose stolen information.

The investigation also identified tools associated with command and control, network tunnelling, and data movement. Their presence reinforces the importance of monitoring suspicious remote-access activity, unusual outbound transfers, and unexpected changes to security configurations.

The presence of a tool or a record in the exposed infrastructure does not, by itself, prove that it was successfully used against every named organization.

How Organizations Can Defend Against AI-Assisted Ransomware

Security teams should focus on established defensive controls that reduce the likelihood and impact of ransomware incidents.

Recommended security measures include:

1. Patch exposed systems: Review vendor advisories and apply supported security updates to remote-access, management, VPN, and web-hosting systems.
2. Secure administrator accounts: Enforce multifactor authentication, restrict privileged access, and investigate unexpected account creation or configuration changes.
3. Audit remote-management tools: Review remote sessions, access permissions, and third-party connections, particularly where service providers can reach customer networks.
4. Reduce credential reuse: Use unique passwords and appropriate privileged-access management. Rotate credentials when compromise is suspected.
5. Protect backups: Keep isolated or immutable backup copies where appropriate, and regularly test recovery procedures.
6. Monitor data transfers: Investigate unusual outbound traffic, unexpected remote-management agents, and suspicious access to sensitive files.
7. Prepare an incident-response plan: Define procedures for evidence preservation, containment, recovery, legal review, and communications if a ransomware incident occurs.

Organizations can also review the indicators of compromise (IoCs) in SOCRadar’s original report and use them for defensive threat hunting. Indicators should be validated against current threat intelligence before being used in detection or blocking rules.

What This Investigation Means for Cybersecurity

The SOCRadar investigation demonstrates that commercial AI tools can support the planning and coordination of criminal operations. It does not establish that AI acted independently or that Claude alone was responsible for the reported activity.

The exposure also highlights a fundamental security lesson: sophisticated tools cannot compensate for poor operational security. Publicly accessible servers, exposed credentials, retained AI session logs, and unprotected knowledge bases can reveal valuable information about an operation.

For defenders, the priorities remain clear: patch vulnerable systems, secure administrator credentials, restrict remote access, monitor suspicious activity, and maintain reliable backups.

Read the original research: INC and The Gentlemen Ransomware: Exposed AI Infrastructure — SOCRadar

Disclaimer: This article summarizes reported cybersecurity research for informational and defensive purposes. Claims derived from operators’ own records may be unverified. Consult the original report for technical details and the complete indicators of compromise.