A new threat intelligence report from Gambit Security has documented a ransomware affiliate using generative AI as an operational partner throughout a live intrusion campaign, highlighting how AI-assisted attacks are moving far beyond phishing content and basic malware generation.
Nir Varon said a suspected affiliate of the Gentlemen ransomware-as-a-service operation used Anthropic’s Claude Code to support nearly every phase of compromise.
The activity reportedly included targeting internet-exposed VPN appliances, harvesting credentials, enumerating Active Directory infrastructure, modifying firewall settings, and staging SQL database backups for exfiltration.
Threat Actors Use Claude Code, Codex and DeepSeek AI
The operator allegedly relied on Claude Sonnet 4.6, a less-restricted model version that may have offered fewer safety controls than newer frontier AI systems.
Gambit assessed that the actor compromised at least eight organizations across several sectors, including an Australian energy utility, a Mauritius-based financial-services firm, manufacturing companies in Thailand and the United States, and IT and distribution organizations.
Attribution to The Gentlemen RaaS was rated medium confidence. The assessment was based on overlap with the group’s leak site, infrastructure links identified by Hunt.io, and the intruder’s recurring focus on backup systems, an objective commonly associated with ransomware operators seeking to prevent recovery before extortion.
Rather than generating a one-off exploit or script, the threat actor reportedly used Claude interactively. The attacker supplied command output, error messages, and appliance responses, then allowed the model to adjust syntax, test alternatives, and troubleshoot failures.
For example, when authentication attempts on the VPN appliance failed, Claude reportedly suggested alternative credential encodings and API paths until the operator gained access.
This iterative process is significant because it demonstrates AI being used to reduce the technical friction of hands-on-keyboard operations. The most notable activity involved an LDAP pass-back attack against FortiGate VPN infrastructure.
According to Gambit, Claude modified VPN authentication settings so that the firewall would validate credentials against an attacker-controlled LDAP service rather than legitimate domain controllers.
The model then generated a Python-based LDAP listener, deployed it on port 389, and supported the attacker through repeated configuration attempts.
A diagnose test authserver command ultimately caused the firewall to transmit a service account password in clear text to the rogue listener. Claude then helped restore the original configuration, an apparent attempt to minimize evidence of tampering.
The actor also created a hidden VPN account named “test,” using the same hardcoded password across multiple victim environments. In several cases, SSL-VPN access had been disabled, but the intruder re-enabled it, potentially expanding access to internal subnets.
After entering the network, Claude-assisted activity included using CrackMapExec to discover and identify domain controllers, file servers, and backup infrastructure.
In one SQL Server environment, the model reportedly identified production databases and client-document repositories, ranked them by business value, executed BACKUP DATABASE commands, compressed the resulting files, and staged them for theft. The human operator then mounted the relevant share and extracted the data.
The campaign also illustrates that AI-driven operations can create instability. While attempting to modify portal settings on a compromised energy utility firewall, Claude reportedly initiated a full VDOM configuration restore instead, taking the device offline.
The model’s log acknowledged the error: “Yeah, I screwed up – I shouldn’t have done a full config restore.” External scanning later indicated that the appliance remained unreachable.
Gambit Security’s investigation shows that generative AI can now assist with live exploitation, credential theft, persistence, reconnaissance, and data exfiltration. For defenders, this raises the prospect of faster and more adaptive intrusions, even when attackers possess limited technical expertise.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
