Ransomware Operators Leverage Claude AI, Accidentally Expose Operations
A publicly accessible server has exposed detailed chat logs, credentials, and source code used by ransomware operators, revealing their workflow and links to INC Ransomware and The Gentlemen Ransomware.
Ransomware operators have been found to be using commercial AI models, such as Claude Opus and Kimi K3, to assist in planning attacks, managing victim data, and drafting extortion demands. This sophisticated use of AI was uncovered when a publicly accessible server inadvertently exposed extensive records of these operations, including AI chat sessions, stolen credentials, campaign notes, and source code.
The exposed data, identified by SOCRadar's Threat Research Unit (STRU) in late September 2026, provided researchers with an unprecedented look into the attackers' workflow. The findings linked the activity to affiliates operating with both the INC Ransomware and The Gentlemen Ransomware groups. The records detailed 46 INC encryptor builds prepared for six victims and provided evidence that an encryptor had been deployed on at least one victim's computer, indicating that organizations were at various stages of attack, from reconnaissance to active exploitation and extortion.
Operators utilized OpenCode as an interface to access AI models through OpenRouter. STRU analyzed over 8,000 messages across 133 sessions, confirming that the AI was instrumental in reconnaissance, technique selection, command generation, tool troubleshooting, stolen data review, and the drafting of extortion materials. While Claude Opus and Kimi K3 were specifically mentioned, the report clarifies that this represents an AI-assisted operation rather than AI acting autonomously for every task.
Human oversight remained a critical component of these operations, with operators instructing the AI to coordinate actions and await approval, functioning more like a human-directed assistant. When an AI model refused a request, operators would sometimes rephrase it as an authorized red-team assessment. The use of a "WormGPT" persona was also noted, though STRU identified this as a prompt label rather than evidence of a separate, uncensored model being used.
The AI system's retained memory proved to be a significant vulnerability. Its knowledge base meticulously tracked victims, credentials, and campaign progress, while the chat logs offered a clear view of how operators planned and adapted their tactics. The recorded AI spending exceeded $23,920, according to SOCRadar's account records, turning what was intended to be private operational data into actionable evidence for investigators.
Internet-facing management and remote-access products were identified as key entry points for these attackers. Their records indicate exploitation of vulnerabilities including CVE-2026-35616 (FortiClient EMS), CVE-2024-57727 (SimpleHelp), and CVE-2026-41940 (cPanel/WHM). The SimpleHelp vulnerability, in particular, has been flagged by CISA for active exploitation in the wild, underscoring the risks associated with unpatched remote support tools.
Beyond exploiting vulnerabilities, the operators also leveraged stolen or reused credentials to move laterally across systems. In one instance, a single reused password granted access to multiple services, including remote access tools, servers, and backup systems. The exposed toolkit included the Phantom command-and-control software and RevSocks for traffic tunneling, as well as a tool designed to evade security products. While encryptors for Windows and Linux were prepared, the planned October 1, 2026 deployment was not confirmed, though a screenshot from September 30 showed an encryptor active in a victim environment.
The operators placed significant emphasis on data theft and extortion, using stolen financial and customer information to shape their demands and apply pressure, including scripted calls. This trend aligns with broader observations of ransomware groups prioritizing data exfiltration over encryption. SOCRadar linked the exposed systems to both INC and The Gentlemen groups, suggesting a shared operational environment or service provider rather than a formal alliance. The incident serves as a stark reminder for defenders to patch edge systems, restrict management interfaces, enforce MFA, and diligently monitor remote access tools and data transfers.