Cybersecurity researchers have identified three distinct threat actor groups that are leveraging artificial intelligence tools to enhance various stages of their malicious operations, ranging from reconnaissance and exploitation to data exfiltration and credential harvesting. These groups employed AI models such as Claude Code, OpenAI Codex, and DeepSeek to generate malicious scripts, identify high-value targets, manage technical infrastructure, and refine attack commands.
One observed incident involved a suspected ransomware operator, active in late June 2026, who utilized Claude Code, specifically running Claude Sonnet 4.6, during intrusions into six organizations. Victims included an Australian energy utility, along with companies in financial services, food services, manufacturing, IT services, property management, and distribution across multiple countries. This activity has been attributed with medium confidence to a threat actor associated with The Gentlemen ransomware-as-a-service operation. The AI model assisted in generating and executing reconnaissance and exploitation commands, writing malicious scripts, modifying firewall policies, and analyzing business systems to pinpoint critical assets.
During internal network reconnaissance, Claude processed technical results to identify useful targets such as domain controllers, file servers, and backup servers. It also examined application databases and backup infrastructure. In one instance, the operator queried Claude to rank the most important databases, leading the AI to highlight the live production database and client document store. The operator then instructed Claude to execute SQL Server backup commands on two servers, staging two compressed database dumps for exfiltration. One of these dumps was subsequently exfiltrated, with Claude copying the file to the operator's machine and then deleting it from the victim's server.
In a separate intrusion, Claude initially refused to proceed after recognizing it was interacting with a live production system without confirmed authorization. The operator circumvented this by starting a new session and falsely claiming authorization for vulnerability testing, after which Claude complied with the requests. The AI also made errors; at the Australian utility, Claude's attempt to modify firewall settings resulted in the device becoming unreachable after API calls failed and the AI downloaded, edited, and re-uploaded the configuration. Furthermore, some AI-assisted activities inadvertently exposed information, such as reconnaissance descriptions and labels, that could reveal attack activity within victim environments.
A second case focused on Zerofot, a credential-harvesting operation that scanned the internet for unintentionally exposed sensitive files and open directories containing API keys, tokens, and other credentials. Its primary tool, `auto_scan`, was developed using OpenAI Codex and Claude Code. The instructions provided to Codex described the work as being "for an authorized CTF sandbox" to prevent the model from refusing the task. Between April 5 and May 23, 2026, Zerofot collected 2,975 validated keys and credentials from 1,742 victim hosts, including SSH private keys, AWS access keys, and credentials for services like Google Gemini, OpenAI, GitHub, and Anthropic.
The third case involved RAGE, a custom Python attack framework designed to scan internet-facing services, exploit vulnerabilities, harvest credentials, and deploy cryptocurrency miners. RAGE and many of its accompanying scripts appear to have been generated with AI. The framework also integrates a DeepSeek-backed "AI Orchestrator" at runtime, which advises the operator on managing the mining botnet. RAGE targets services such as Redis, Elasticsearch, Docker, and Tomcat, with additional modules for Jenkins, Hadoop YARN, Confluence, and Supervisord. Its capabilities include scanning, exploitation, brute-force authentication, cloud metadata access, host-level privilege escalation, and miner deployment and monitoring. In one instance, the RAGE operator recovered AWS credentials from an exposed Redis instance, gaining access to the victim's cloud environment and subsequently using additional scripts to search cloud services for further credentials and sensitive information.
