Cyberattacks | Ransomware

Claude AI Used to Run Nearly Every Stage of a Live Ransomware Campaign

AI in ransomware: Gambit Security unveils AI-driven attacks, targeting VPNs, breaching credentials, and impacting major firms globally.

By Content Team

Aug 20, 2026

ON THIS PAGE

A Gambit Security report has revealed one of the most detailed real-world cases of AI being weaponized inside an active ransomware operation. A suspected affiliate of The Gentlemen ransomware-as-a-service group used Anthropic's Claude Code to breach VPN appliances, steal domain credentials, and exfiltrate SQL databases across at least eight organizations — including an Australian energy utility and a Mauritius financial firm.

The attacker used Claude Sonnet 4.6, an older, less-restricted model, interactively refining commands based on live output. Claude executed a sophisticated LDAP pass-back attack, created hidden backdoor VPN accounts, and ranked databases by business value before dumping them. At one point, Claude accidentally knocked a firewall offline, then logged: "Yeah, I screwed up."

This marks a clear shift — AI isn't just drafting phishing emails anymore. It's running live attacks.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?