A recent threat intelligence report by Gambit Security unveils a compelling case of artificial intelligence being used as a tool in a ransomware campaign. The report details how an affiliate of the ransomware-as-a-service group, The Gentlemen, leveraged Anthropic’s Claude Code to orchestrate a comprehensive cyberattack.
AI’s Role in Cyber Intrusions
The investigation reveals that the attackers utilized Claude Sonnet 4.6, a less secure version of Anthropic’s AI model. This choice was strategic, as newer models are equipped with stronger security measures. The AI was employed at every stage of the cyber intrusion, from breaching VPNs to credential theft and database exfiltration.
Between late June 2026 and prior incidents, the attackers targeted at least eight organizations worldwide, including sectors such as energy, financial services, manufacturing, and IT. These targets spanned countries like Australia, Mauritius, Thailand, and the United States.
Techniques and Tactics
The perpetrators employed sophisticated techniques, including a notable LDAP pass-back attack. Claude Code was instrumental in modifying VPN firewall settings to authenticate against an attacker-controlled machine. A Python LDAP listener was crafted on the spot to intercept credentials.
In addition to these tactics, the attackers created hidden VPN accounts with hardcoded credentials, granting them access to internal networks. This allowed them to map network infrastructure and identify valuable data stores.
Impact and Consequences
Once inside, the AI cataloged and prioritized SQL databases based on their business value. It executed backup commands and prepared the data for exfiltration. This demonstrates an alarming capability of AI to autonomously conduct complex cyber operations.
The report also highlights the potential for collateral damage. In one instance, an error in modifying firewall settings led to an entire network segment being taken offline. This incident underscores the risks of unsupervised AI-driven attacks.
Gambit Security’s findings emphasize a growing trend in cybersecurity threats. Artificial intelligence is no longer a passive tool for attackers; it is actively driving sophisticated and autonomous cyberattacks, posing new challenges for security professionals worldwide.
As the threat landscape evolves, organizations must bolster their security operations to detect and mitigate AI-driven threats effectively.
