AI tools are being used by cyber attackers to write malicious code, build tools that harvest credentials, search compromised networks, identify valuable business information, manage technical infrastructure and generate commands during intrusions.
Gambit Security researchers examined three unrelated threat actors that show how AI can support different stages of a cyberattack. Across the cases, attackers used AI to create scripts and exploitation tools, identify high-value business information, perform IT and DevOps tasks, and generate and refine commands during active intrusions.
Ransomware operator uses Claude Code
The first case involved a suspected ransomware operator who used Claude Code during intrusions into six organizations in late June 2026. The same operator was linked to two earlier compromises.
The victims included an Australian energy utility and companies in financial services, food services, manufacturing, IT services, property management and distribution across several countries. The activity was attributed with medium confidence to a threat actor using The Gentlemen ransomware-as-a-service operation.
The attacker used Claude Code, running Claude Sonnet 4.6, to generate and execute reconnaissance and exploitation commands, write malicious scripts, modify firewall policies and analyze business systems to identify those most relevant to the operation.
During internal network reconnaissance, Claude processed technical results and identified useful targets, including domain controllers, file servers and backup servers. It examined application databases and backup infrastructure.
At one victim, the operator asked which databases mattered most. Claude ranked them and pointed to the live production database and client document store. The operator had access to the systems, while the AI helped determine which information was most relevant to the business.
At the operator’s request, Claude ran SQL Server backup commands on two servers and staged two compressed database dumps for exfiltration. The attacker exfiltrated one of the dumps, with Claude copying the file to the operator’s machine and then deleting it from the victim’s server.
In another intrusion, Claude refused to continue after recognizing that it was interacting with a live production system belonging to an organization without confirmed authorization. The operator started a new session, claimed to have authorization to test the target for vulnerabilities and repeated the request. Claude then complied.
Firewall outage (Source: Gambit Security)
The AI also made mistakes. At the Australian utility, Claude attempted to modify firewall settings. After API calls failed, it downloaded the device configuration, edited it and uploaded the modified configuration. The firewall subsequently became unreachable.
Other AI-assisted activity exposed revealing information in victim environments, including descriptions of reconnaissance and labels that could give away attack activity.
AI helps build a credential-harvesting operation
The second case focused on Zerofot, a credential-harvesting operation that searched the internet for unintentionally exposed sensitive files and open directories containing API keys, tokens and other credentials.
Its main tool, auto_scan
, searched for potentially sensitive files exposed online. It could also process targets generated by internet-wide scans. When it found accessible files or directory listings, it downloaded the material and searched it for credentials associated with AI providers, cloud services, servers and SaaS platforms. The scanner then validated candidate credentials against the corresponding services
The operator built auto_scan
with OpenAI Codex and Claude Code. Instructions given to Codex described the work as being “for an authorized CTF sandbox” so the model would not refuse the task.
Between April 5 and May 23, 2026, Zerofot collected 2,975 validated keys and credentials from 1,742 victim hosts. The haul included SSH private keys, AWS access keys and credentials for services including Google Gemini, OpenAI, GitHub and Anthropic.
AI-generated framework deploys cryptominers
The third case examined RAGE, a custom Python attack framework designed to scan internet-facing services, exploit vulnerable deployments, harvest credentials and deploy cryptocurrency miners.
RAGE and many accompanying scripts appear to have been generated with AI. The framework also integrates an LLM at runtime through a DeepSeek-backed “AI Orchestrator” that advises its operator on running the mining botnet.
It targets services including Redis, Elasticsearch, Docker and Tomcat, with additional modules targeting Jenkins, Hadoop YARN, Confluence and Supervisord. Its capabilities include scanning, exploitation, brute-force authentication, cloud metadata access, host-level privilege escalation, miner deployment and monitoring.
In one case, the RAGE operator recovered AWS credentials from an exposed Redis instance. The credentials provided access to the victim’s cloud environment, after which the attackers used additional scripts to search cloud services for credentials and other sensitive information.