AI Tools Used in Ransomware Campaigns to Exploit Vulnerable Systems

A recent report from Gambit Security reveals that threat actors are leveraging AI tools like Claude Code and OpenAI Codex in ransomware operations. These tools have been used to breach internet-exposed VPN appliances, steal LDAP passwords, and exfiltrate SQL databases. The Gentlemen ransomware-as-a-service operation is suspected to be behind these attacks, which have targeted various organizations. The AI-driven methods enable attackers to automate and enhance their capabilities, leading to a significant increase in the scale and efficiency of cyberattacks. The report highlights multiple campaigns where AI has facilitated the harvesting of sensitive information and exploitation of cloud accounts. The current status indicates ongoing threats as attackers continue to refine their techniques using AI technologies.

Key Points: • AI tools like Claude Code and Codex are being weaponized in ransomware campaigns. • The Gentlemen ransomware-as-a-service operation is implicated in these attacks. • Threat actors are automating the exploitation of systems, increasing the scale of attacks.