gcdRadar
closedclosed 24 Jan 2025Breaches & attacks4 Confirmed real-world lossAI

FunkSec ransomware group allegedly leverages AI tools in attacks

Miniapps chatbots

The FunkSec ransomware group used AI chatbots to develop custom malware and refine technical documentation in double extortion attacks against multiple victims. The campaign resulted in data leaks affecting over 80 victims.

first report
10 Jan 2025
last update
10 Jan 2025

Timeline · 1

  1. 10 Jan 2025AI-Assisted Ransomware Campaign by FunkSec Allegedly Targets Over 80 Victims

Sources · 1

Research and catalogues

  1. 2025-01-10
    AI-Assisted Ransomware Campaign by FunkSec Allegedly Targets Over 80 Victims
    AI Incident Database · incidentdatabase.ai/cite/897

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

AI role
AI-enabled attack
categories
AI-generated malwareAI-assisted intrusion
severity
4 · Confirmed real-world loss
targets
Enterprise deployment, Individuals
owasp llm top 10
no entry for these categories
dates
happened 10 Jan 2025 · first reported 10 Jan 2025
origin
AI Incident Database
Derived from the AI Incident Database (CC BY-SA 4.0).
record
confidence 0.90 · created 2026-10-18 06:33Z · updated 2026-10-18 06:59Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text
# FunkSec ransomware group allegedly leverages AI tools in attacks

https://gcdradar.vercel.app/incidents/funksec-ransomware-group-allegedly-leverages-ai-tools-in-att · AIR-2025-0084 · closed 2025-01-24

- Lane: Breaches & attacks
- Severity: 4 (Confirmed real-world loss)
- Fix status: No fix needed
- First reported: 2025-01-10
- AI role: AI-enabled attack
- Products: Miniapps chatbots

## Summary

The FunkSec ransomware group used AI chatbots to develop custom malware and refine technical documentation in double extortion attacks against multiple victims. The campaign resulted in data leaks affecting over 80 victims.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-01-10: AI-Assisted Ransomware Campaign by FunkSec Allegedly Targets Over 80 Victims (https://incidentdatabase.ai/cite/897)

## Sources

- 2025-01-10 AI Incident Database: AI-Assisted Ransomware Campaign by FunkSec Allegedly Targets Over 80 Victims https://incidentdatabase.ai/cite/897

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

Related

  1. closed
    LAMEHUG LAMEHUG Malware Integrates LLM for Real-Time Command Generation

    Breaches & attacks · Exploited · since 10 Jul 2025

    AI
  2. closed
    Zoom North Korea-Linked Actors Use AI Executive Deepfakes in Zoom Phishing

    Breaches & attacks · Exploited · since 22 Jun 2025

    AI
  3. closed
    Claude Anthropic Report Reveals Claude Misuse in Cyberattacks and Fraud

    Breaches & attacks · Exploited · since 23 Apr 2025

    AI
  4. closed
    AI
  5. live
    AI
  6. live
    AI