FunkSec ransomware group allegedly leverages AI tools in attacks
Miniapps chatbots
The FunkSec ransomware group used AI chatbots to develop custom malware and refine technical documentation in double extortion attacks against multiple victims. The campaign resulted in data leaks affecting over 80 victims.
- first report
- 10 Jan 2025
- last update
- 10 Jan 2025
Timeline · 1
Sources · 1
Research and catalogues
- 2025-01-10AI-Assisted Ransomware Campaign by FunkSec Allegedly Targets Over 80 VictimsAI Incident Database · incidentdatabase.ai/cite/897
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- AI role
- AI-enabled attack
- categories
- AI-generated malwareAI-assisted intrusion
- severity
- 4 · Confirmed real-world loss
- targets
- Enterprise deployment, Individuals
- owasp llm top 10
- no entry for these categories
- dates
- happened 10 Jan 2025 · first reported 10 Jan 2025
- origin
- AI Incident DatabaseDerived from the AI Incident Database (CC BY-SA 4.0).
- record
- confidence 0.90 · created 2026-10-18 06:33Z · updated 2026-10-18 06:59Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# FunkSec ransomware group allegedly leverages AI tools in attacks https://gcdradar.vercel.app/incidents/funksec-ransomware-group-allegedly-leverages-ai-tools-in-att · AIR-2025-0084 · closed 2025-01-24 - Lane: Breaches & attacks - Severity: 4 (Confirmed real-world loss) - Fix status: No fix needed - First reported: 2025-01-10 - AI role: AI-enabled attack - Products: Miniapps chatbots ## Summary The FunkSec ransomware group used AI chatbots to develop custom malware and refine technical documentation in double extortion attacks against multiple victims. The campaign resulted in data leaks affecting over 80 victims. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2025-01-10: AI-Assisted Ransomware Campaign by FunkSec Allegedly Targets Over 80 Victims (https://incidentdatabase.ai/cite/897) ## Sources - 2025-01-10 AI Incident Database: AI-Assisted Ransomware Campaign by FunkSec Allegedly Targets Over 80 Victims https://incidentdatabase.ai/cite/897 Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closedLAMEHUG LAMEHUG Malware Integrates LLM for Real-Time Command Generation
Breaches & attacks · Exploited · since 10 Jul 2025
AI - closedZoom North Korea-Linked Actors Use AI Executive Deepfakes in Zoom Phishing
Breaches & attacks · Exploited · since 22 Jun 2025
AI - closedClaude Anthropic Report Reveals Claude Misuse in Cyberattacks and Fraud
Breaches & attacks · Exploited · since 23 Apr 2025
AI - closedXanthorox AI Darknet Forum Introduces Xanthorox AI Autonomous Cyberattack Platform
Research · since 7 Apr 2025
AI - liveBOSSAI AI Agents BOSSAI AI Agents Used to Steal Taipei Emergency Dispatch Records
Breaches & attacks · Real loss · since 2 Nov 2026
AI - liveOpenAI model OpenAI model generates 948 Linux root exploits in automated run
Research · since Oct 2026 (approx.)
AI