Hackers Planned Ransomware with Claude AI, Then Accidentally Leaked Their Secrets

Ransomware operators used commercial AI tools to plan intrusions, track victims and prepare extortion, a new investigation shows.

But those same systems kept detailed logs of the operators’ activity. A publicly accessible server exposed AI chat sessions, stolen credentials, campaign notes and source code, giving researchers a window into the attackers’ workflow.

The exposed files tied the activity to affiliates operating under INC Ransomware and The Gentlemen Ransomware. Among the material were 46 INC encryptor builds prepared for six victims and evidence that an encryptor had executed on a victim’s device.

Researchers cautioned that the records represented organizations at different stages of compromise: some were listed only for reconnaissance, while others showed deeper access or had reached extortion. SOCRadar’s technical report provides the full details.

Analysts from the SOCRadar Threat Research Unit (STRU) discovered the exposed infrastructure in late September 2026. The team found an open server containing AI session data, a shared knowledge base and source code for a framework called Phantom.

Logs, configuration files and credentials on that server pointed to six additional exposed servers. Together, the systems held records of victim activity, tooling, malware and extortion plans.

Hackers use Claude AI to plan ransomware attacks

The operators used OpenCode as an interface to models hosted via OpenRouter. STRU reviewed 8,257 messages across 133 sessions and found the AI assisted with reconnaissance planning, technique selection, command generation, troubleshooting, reviewing stolen data and drafting extortion material.

The report names commercial models including Claude Opus 4.6 and Kimi K3; the findings describe an AI-supported operation and do not mean any single model carried out every task.

Human operators remained involved: the AI was instructed to coordinate actions but wait for human approval, making the setup more like a human-directed assistant than an autonomous operator.

When a model refused a request, operators sometimes reformulated it as an authorized red-team assessment. The records also show use of a “WormGPT” persona prompt; STRU notes this label does not prove a different uncensored model was in use.

The system’s memory proved to be a major weakness. The shared knowledge base tracked victims, credentials and campaign progress, and the chat logs documented how operators planned and adjusted their activity.

SOCRadar’s account records show recorded AI spending of more than $23,920. Because the infrastructure was exposed, those private operational notes became evidence open to investigators.

Edge systems were a key way in

Operator records describe attempts to gain access via internet-facing management and remote-access products. The records report exploitation of FortiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727) and cPanel/WHM (CVE-2026-41940).

Those figures come from the attackers’ own logs and were not independently verified by STRU. For SimpleHelp, the operators’ notes claim 242 affected IP addresses; prior reporting on the SimpleHelp vulnerability explains why flaws in remote-support tools can expose connected customer networks.

CISA has separately warned that ransomware actors have abused CVE-2024-57727 in unpatched SimpleHelp systems and urged organizations to patch vulnerable instances and check for compromise, especially where a service provider’s system connects to customer environments.

The attackers also used stolen or reused credentials to pivot across systems. In one instance a reused password granted access to multiple services, including remote-access tools, servers and backup systems.

Once inside networks, operators searched for credentials and prioritized finance, HR, legal and executive documents. The exposed toolkit included Phantom, Ghost command-and-control software and RevSocks for tunneling traffic.

Investigators found a tool intended to interfere with some security products. The report says operators prepared INC encryptors for Windows and Linux; a planned October 1, 2026 deployment was not confirmed, but a September 30 screenshot did show an encryptor running in a victim environment.

The records indicate that stealing data and threatening to publish it mattered as much as encrypting files. Operators used victim financial and customer information to shape demands and apply pressure, including scripted extortion calls.

This focus on data theft and threats mirrors trends seen in other cases, where extortion has occurred without encryption.

SOCRadar linked the exposed systems to activity associated with both INC and The Gentlemen, but did not find evidence of a formal alliance between the two groups. The researchers said a shared operational environment or a common service provider supporting multiple ransomware partners is a more likely explanation.

The exposed records named 62 organizations; only four appeared publicly listed for extortion, while the remainder were at earlier stages such as reconnaissance or initial access.

For defenders, the case underscores the need to patch exposed edge and remote-access systems, restrict management interfaces, enforce multifactor authentication for remote administration and review accounts and VPN settings for unexpected changes.

Organizations should also protect backups from direct access by compromised accounts and monitor remote-management tools and large outbound transfers.

The core lesson is direct: AI can help criminals coordinate complex campaigns, but poorly secured infrastructure and retained logs can expose the operation behind them.

Indicators of compromise (IoCs):

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal or your SIEM.

Update defenses against new malware as soon as it appears. Integrate threat intelligence feeds with data from large-scale SOCs.