Ransomware crews used AI chatbots to plan attacks, then leaked their own files

Ransomware criminals used commercial AI tools to help plan break-ins, then left their chat records and files on servers anyone could reach. Researchers at SOCRadar read 8,257 AI messages across 133 sessions. Ransomware is malware that locks a victim's files so the attackers can demand payment.

What the researchers found

SOCRadar's threat research team found the exposed systems in late September 2026. One open server held AI session data, a shared knowledge base and code for a framework called Phantom. Logs and credentials on it led to six more exposed servers. The files linked the activity to affiliates working with INC Ransomware and The Gentlemen Ransomware.

How the AI was used

The operators used a tool called OpenCode to reach AI models hosted through OpenRouter. The AI helped plan reconnaissance, pick techniques, write commands, fix tools, review stolen data and draft extortion messages. Claude Opus 4.6 and Kimi K3 were among the models named. The report says this was an AI-supported operation, not proof that Claude alone did every task.

Humans stayed in charge. The AI was told to wait for approval before acting. When a model refused a request, an operator sometimes reworded it as an authorized red-team test, which is a security check run with permission. Recorded AI spending exceeded $23,920.

How they got in

The operators' own records describe attacks on internet-facing management and remote-access products. They name flaws in FortiClient EMS, SimpleHelp and cPanel/WHM. SOCRadar did not independently verify these claims. CISA has separately warned that ransomware actors exploited the SimpleHelp flaw in unpatched systems. In one case, a reused password opened remote access, servers and backup tools.

How far it went

The records named 62 organizations, but only four were publicly listed for extortion. Others were still at early stages. Investigators found 46 INC encryptor builds prepared for six victims. A September 30 screenshot showed an encryptor running in one victim's environment. A planned October 1 deployment against other targets was not confirmed.

What to do

• Install updates on remote-access and internet-facing tools quickly.
• Turn on two-step login for admin and remote accounts.
• Never reuse passwords across remote access, servers and backups.
• Keep backups out of reach of everyday accounts.
• Watch remote-management tools and large outbound data transfers.

What is not known

SOCRadar did not conclude that INC and The Gentlemen are formally allied. It considers a shared environment or a common service provider more likely. The exploit claims also remain unverified.