Ransomware crews weaponize AI to break into 62 organizations and steal data
Exposed chat logs and infrastructure from a ransomware‑as‑a‑service ring show affiliates using AI tools in at least 133 sessions to help hack networks at 62 victim organizations. By automating reconnaissance and exploitation of bugs in Fortinet, SimpleHelp and cPanel, the crews turned off‑the‑shelf AI into a force multiplier for cyber extortion.
Ransomware gangs are no longer just buying zero‑days and phishing kits—they’re working with AI chatbots. Newly uncovered infrastructure and internal messages from a ransomware‑as‑a‑service operation show how affiliates leaned on artificial intelligence during live attacks, using it to map targets, write code and exploit known flaws in widely deployed software.
According to the technical investigation, the exposed servers and logs captured 8,257 messages exchanged by operators, including at least 133 conversations with AI tools. Over the course of those sessions, affiliates discussed and refined intrusions against 62 organizations, asking AI to help them understand network layouts, craft scripts and chain vulnerabilities in products like Fortinet appliances, SimpleHelp remote‑support tools and cPanel hosting software.
The picture that emerges is not of superhuman AI inventing new attacks, but of criminals using it as a patient, always‑on assistant. Affiliates pasted configuration snippets or error messages into chat windows and received step‑by‑step guidance: which ports to scan next, how to tweak an exploit for a specific version, how to automate data exfiltration. In some cases, they used the models to draft convincing emails for social‑engineering attempts, blending language cues from corporate websites into lures.
For the organizations on the other side of the keyboard, the effect is chilling. Many of the targeted systems—Fortinet firewalls and VPNs, remote‑access tools like SimpleHelp, and hosting control panels such as cPanel—sit directly on the internet and are hard to take offline without disrupting business. Once compromised, they offer a gateway to internal networks, backup servers and cloud consoles where attackers can plant ransomware, steal data or both.
The investigation shows that affiliates repeatedly returned to AI chats at each stage of the kill chain. During reconnaissance, they used it to turn raw IP ranges into lists of likely services. While exploiting, they had AI walk them through changing proof‑of‑concept code pulled from public repositories into tailored payloads. When it came time to monetize, they asked for help in compressing and exfiltrating large data sets or wiping logs to cover tracks.
Strategically, the case is an early glimpse of how generative AI is changing the economics of cybercrime. Tasks that used to require weeks of study or direct mentorship from experienced hackers can now be offloaded to a responsive system that doesn’t sleep and doesn’t argue about profit shares. That lowers the barrier to entry for would‑be criminals and lets existing crews scale attacks across more victims.
For defenders, the message is uncomfortable: patching known vulnerabilities in edge devices and remote‑access software is no longer just about keeping up with vendor advisories. Delays now mean going up against adversaries who can ask an AI to squeeze every last advantage out of whatever weaknesses remain, and to do so faster than understaffed security teams can respond.
One line from the technical write‑up captures the change: ransomware operators didn’t need AI to invent new bugs—they needed it to turn the old ones into an assembly line. That is precisely what the leaked logs suggest they were doing.
Signals to watch next include whether similar AI‑usage patterns start surfacing in infrastructure linked to other criminal groups and state‑aligned operators, and whether vendors adjust their products and documentation to make it harder for automated tools to weaponize them. The volume and sophistication of ransomware incidents tied to Fortinet, SimpleHelp, cPanel and similar edge technologies over the coming months will show how quickly the AI‑driven learning curve is steepening for attackers.
Sources
- OSINT