黑客利用 AI 發動新型攻擊與勒索
Hackers use artificial intelligence in new system of attacks and extortion
SOCRadar 指出，一個勒索軟件關聯組織以 Phantom 自動化系統和商用 AI 模型，大規模攻擊邊緣及遠端存取系統。報道列出 CVE-2024-57727、CVE-2026-35616 和 CVE-2026-41940；人員逐一為受害者下指令並控制每一步，AI 模型協助執行攻擊。
Security researchers detail an AI-driven intrusion ecosystem operated by ransomware affiliates utilizing an autonomous framework and commercial models via OpenRouter to target edge and remote-access systems at scale.
The organization, believed to be Russian-speaking, operates as both an attack group and an infrastructure provider for other file-locking attack partners. At the heart of their operation is an automated attack system called Phantom.
According to security firm SOCRadar, the attackers exploited mass remote access and management systems, such as FortiClient EMS, SimpleHelp, cPanel, and network gateways. They used artificial intelligence-driven databases to track victims, stolen passwords, and the progress of attacks.
The campaign is characterized by its use of artificial intelligence-driven actions, but always with human approval. Specifically, a human gives the appropriate instructions for each victim and controls each step, while the attacks are carried out through programs that leverage commercial artificial intelligence models. If the models refuse to execute the commands, the operator rewrites the requests, presenting them as a legitimate security assessment.
How do invasions happen?
Initial access to the systems is achieved by exploiting known security issues in public network services. According to the perpetrators' files, the attacks exploited or engineered issues such as CVE-2024-57727 in SimpleHelp, CVE-2026-35616 for authentication bypass in Fortinet FortiClient, and CVE-2026-41940 in cPanel.
READ ALSO
Quest Diagnostics data breach with access to patient records
Once they gain access, the perpetrators follow a consistent path: they explore the network, try to gain complete control, collect passwords with special interception tools, prioritize financial, human resources, legal, and administrative files, and gather them using special network connections.
The tools and methods of blackmail
To achieve their goals, the perpetrators used a variety of custom tools and modified open source programs, such as the Phantom system for penetration testing, artificial intelligence connection tools, and special hidden communication programs that connect to remote servers.
Analysis of dozens of blackmail files written by artificial intelligence shows a data-driven approach. The perpetrators examine stolen financial information to calculate exactly how much a victim can afford to pay. They then send hidden samples of receipts and increase the pressure through phone calls with automated scripts and threats.
The stolen data is eventually published on special leak websites if the victim does not pay within a few days. However, the final results of these demands remain unknown, as no cryptocurrency wallet or payment record has been found.
Who is affected?
In total, an estimated 62 organizations were targeted, four of which ended up being published on leak websites run by INC and The Gentlemen. The United States accounts for more than half of the targets, with attacks primarily targeting the industrial, construction and energy sectors, followed by healthcare organizations and pharmaceutical companies.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
來源：DEV Community · dev.to