AI in Cybersecurity: How Attackers Use AI to Target Valuable Files

Post Views: 7

Cybercriminals are increasingly utilizing AI-driven tools to enhance various phases of cyberattacks, including code generation, credential extraction, network exploration, data classification, infrastructure management, and command execution during active breaches.

Analysis by Gambit Security revealed three distinct threat actors demonstrating how AI technologies support different attack stages. In each scenario, adversaries employed AI to develop scripts and exploitation mechanisms, locate high-value corporate assets, perform IT and DevOps functions, and generate or refine commands during ongoing intrusions.

AI-Driven Ransomware Operations

A suspected ransomware operator deployed Claude Code during intrusions targeting six organizations in late June 2026. The same actor was associated with two prior breaches. Victims spanned an Australian energy provider and entities in financial services, food production, manufacturing, IT services, property management, and distribution across multiple countries. The activity was linked to The Gentlemen ransomware-as-a-service group with medium confidence.

AI-Assisted Reconnaissance and Exploitation

The attacker used Claude Sonnet 4.6 to create and execute reconnaissance commands, develop malicious scripts, adjust firewall configurations, and evaluate business systems to prioritize targets. During network scanning, the AI analyzed technical outputs to locate critical assets such as domain controllers, file servers, and backup systems. It reviewed application databases and backup infrastructure, identifying specific data stores for exfiltration.

Data Exfiltration and AI Errors

In one instance, the operator queried which databases held the most value, prompting Claude to highlight the live production database and client document repository. The attacker accessed these systems while the AI determined their business relevance. Claude executed SQL Server backup commands on two servers, preparing compressed database dumps for transfer. One dump was successfully exfiltrated, with the AI copying the file to the operator’s machine before deleting it from the victim’s server. In another case, Claude refused to proceed when detecting interaction with an unauthorized live production system.

Credential-Harvesting Campaigns

A credential-grabbing campaign, designated Zerofot, searched the internet for inadvertently exposed sensitive files and open directories containing API keys, tokens, and authentication credentials. Its primary tool, auto_scan, identified potential sensitive files from internet-wide scans. When encountering accessible files or directory listings, the system processed these targets. The operator constructed auto_scan using OpenAI Codex and Claude Code, with instructions framed as “authorized CTF sandbox” tasks to avoid model restrictions.

Scale of Credential Theft

From April 5 to May 23, 2026, Zerofot gathered 2,975 verified credentials from 1,742 victim hosts. The collected data included SSH private keys, AWS access tokens, and credentials for platforms such as Google Gemini, OpenAI, GitHub, and Anthropic.

AI-Enabled Cryptomining Deployments

A third case examined RAGE, a custom Python-based attack framework designed to scan internet-facing services, exploit vulnerabilities, harvest credentials, and deploy cryptocurrency miners. RAGE and its supporting scripts appear to have been generated using AI. The framework integrates a DeepSeek-powered “AI Orchestrator” that provides operational guidance during mining botnet execution. It targets services including Redis, Elasticsearch, Docker, and Tomcat, with additional modules for Jenkins, Hadoop YARN, Confluence, and Supervisord.

Cloud Exploitation and Privilege Escalation

In one instance, the RAGE operator retrieved AWS credentials from an exposed Redis instance, granting access to the victim’s cloud environment. Subsequent scripts then searched cloud services for additional credentials and sensitive data.